Solved

Data recovery

Posted on 2013-06-09
39
660 Views
Last Modified: 2016-11-23
hi
I have a dell laptop , i was out of home , when my cousin actually did some thing which i lost my all pictures which were placed on the desktop .  i think she has taken the system on factory default settings , and no software and no settings . i dont care about the softwares but i have lost family pictures which were very important to me .
now I need help , how to start , i have answers to some questions ..... but not all .

let me know where to start and i will do that , i am IT professional but not certainly in data recovery .
0
Comment
Question by:annasad
  • 17
  • 12
  • 5
  • +3
39 Comments
 
LVL 87

Expert Comment

by:rindi
ID: 39233164
First stop working on that PC immediately. Remove the disk from it and connect it to another PC running Windows as a 2nd internal HD. Scan it using getdataback, and if the tool finds an of your files, register it so you can copy them to another location.

http://runtime.org
0
 
LVL 87

Expert Comment

by:rindi
ID: 39233166
Just out of curiosity, what happened to your backups?
0
 
LVL 51

Expert Comment

by:Joe Winograd, EE MVE
ID: 39233177
For starters, see if the photos are still on the hard drive. Depending on exactly what your cousin did, resetting to "factory default settings" may not have deleted user files. So simply do a search on the entire hard drive for "*.JPG" or "*.JPEG" files. Of course, if your photos are in some other graphics/image format, such as BMP, PNG, TIF, TIFF, etc., that's what you'll need to search for. Regards, Joe
0
 
LVL 1

Author Comment

by:annasad
ID: 39236135
i have done the JPEG search on hard disk and have not found any thing .  i believe files are deleted ...   there were no backups .. system was restored and data was lost ... thats all i can tell ..

one question here , why i cant run get data back on the same OS , or its a different to run as external drive and within the same OS .
0
 
LVL 51

Expert Comment

by:Joe Winograd, EE MVE
ID: 39236191
> i have done the JPEG search

To be clear, you also looked for *.JPG...right? And also BMP, which is the other most likely format...but it's JPG most of the time.

> why i cant run get data back on the same OS

Because when a file is deleted, the file is simply marked as deleted in the file system, but the contents are still on the drive. So as long as the blocks containing the deleted file are not needed for other files, then they'll stay on the drive and "un-delete" software may be able to recover the data. But if you keep using the drive (and that's what running the OS will do), then the blocks that had been allocated to the deleted file could be allocated to a new file and the data will be overwritten. So rindi's suggestion to "stop working on that PC immediately" is spot-on and very important if you are to have any hope of recovering deleted files. Regards, Joe
0
 
LVL 1

Author Comment

by:annasad
ID: 39236274
well , correct i made a search for both JPG and JPEG , adn also bmp . but not found .

Also I would have to take hard disk out of laptop , i have to see how to open it and take hard disk out of it . hopefully i should be able to do it .

Also if you can help me to find step by step guide , how to take hard disk out , i think it should not be as difficult as to open some screws from the back of the laptop . lets do it today and see if it works .

also i think i am not going to buy software ASAP as i need to first see if i can have list of files which are required or not , then i can pay to make a search .
0
 
LVL 51

Expert Comment

by:Joe Winograd, EE MVE
ID: 39236432
You don't have to take the hard disk out of the laptop...that's certainly one way to do it, but not the only way. Since you obviously have access to another computer that you're using for this EE thread, you should be able to make a bootable CD with "undelete" software on it. One product that can do this is EaseUS Data Recovery and the instructions are here:
http://www.easeus.com/data-recovery/other-recovery-software/undelete-boot-cd.htm

But, remember, creation of the CD must be done on a different computer. Do not boot the PC with the deleted files into Windows. When you turn it on, immediately enter the BIOS, set the boot sequence to have the CD first, then put the CD in the optical drive, and then boot into the EaseUS Data Recovery Wizard.

But if you don't like this idea, then removing the hard drive from the Dell laptop should be very easy...I've had many Dell laptops and it's usually just a few screws on the side or bottom of the case that secures the hard drive. On the computer you're using for this thread (not the PC with the deleted files), go to the Dell support site:
http://www.dell.com/support/home/us/en/19?c=us&l=en&s=dhs

Enter the Service Tag, which should be on the bottom of the PC, but if it isn't, click Laptops and keep clicking until you find your machine, then download the User's/Owner's Guide and the Service Manual for it. One (or both) of those will have instructions for removing the hard drive. Two example sets of instructions for Dell laptops are attached. Regards, Joe
Dell-Inspiron-700m-hard-drive-Se.pdf
Dell-Latitude-D830-hard-drive-Se.pdf
0
 
LVL 1

Author Comment

by:annasad
ID: 39236824
very much appreciated , allow me to follow above steps and see if i can have my luck on it .
0
 
LVL 69

Expert Comment

by:Merete
ID: 39240864
annasad I can 100% garrantee get Databack will do exactly that, even deleted files, it will recover files even if the HDD had been partitioned.
I have done this myself and it works even a dead drive.
Just follow the instructions the others have provided and move the drive to  an external enclosure or set it to a secondary drive in another computer,  or connect your laptop via a lan.
install get data back on that PC and run it.
There is several version, but what's really great the fully functioning trial will let your run it and see it for yourself
The price is reasonable and a lot cheaper than getting someone to do it for you.
Youtube has lots of videos so you can see yourself.
http://www.youtube.com/watch?v=XQBprGyy_Ko
here's the guide well a read first
http://www.runtime.org/howto.htm
http://www.runtime.org/howto_datarecovery.pdf

The main reason why you can't restore from the same drive is the files on your current C drive will lose their file association, I have also tested this trying to restore deleted off my main C drive it cant be done on the same drive, all my music changed their music names to the wrong names and were corrupted. It was test as I had already backed them up.

Good Luck and don't worry.
If you need further assistance just let us know
PS, any chance you had uploaded any of these photos to facebook or Skydrive from windows live mail?
0
 
LVL 5

Expert Comment

by:Pankaj_401
ID: 39247263
You can also give a try to Kernal Data recovery as well, in order to get your precious images back
they have plenty of software for data recovery solution
0
 
LVL 41

Expert Comment

by:Jackie Man
ID: 39273659
@Merete

I have done this myself and it works even a dead drive<- How do you do that?
0
 
LVL 1

Author Comment

by:annasad
ID: 39285974
i need sometime to perform above steps and so requested to not put question on abondon. once i perform above steps then i will answer the results .
0
 
LVL 69

Expert Comment

by:Merete
ID: 39286056
Hello annasad
I started off with the trial of Get Data Back ( ntfs) just to see if
(1) I could access my drive/s
(2) if I could see my files.
Remember there is two versions Fat and ntfs.
http://www.runtime.org/data-recovery-software.htm
Quote from Get Data Back
Recover My Files - Try it free and see your deleted files!
http://www.recovermyfiles.com/?gclid=CM35rPiFiLgCFYUhpQodTB4AJQ

Here's what I did, once the trail tested successfully I bought it so I could recover all my files over ten drives from past computers
First:
I bought an external HDD case that supports both ide and sata . It also comes with a power adapter like the one you see on the USB HDD
They also known as a CADDY.
I have some photos somewhere but can't find them atm
Looks like this, I didnt bother with any screws or put the cover back on to the case I just let it sit on the table as is with the HDD inserted.
And another showing you how to
http://www.computershopper.com/peripherals/howto/build-your-own-external-hard-drive
Continuing>
I dropped the dead HDD or any of the HDD I have from old computers
 in to external case
connected the appropriate ide or sata cable to the drive, connected the power socket the white one inside the external case to the drive that's inserted,
 then the power cord on the case plugged that in to the power AC, then connected into USB in my computer,  and then waited
If there was a problem with HDD structure which most had a damaged boot loader or something wrong with the clusters windows threw up a message it needs to format it first I just ignore that of course,

Ran get Data back and by passed the messages about bad cluster etc  do I want to continue
and then the files structure appeared and I then systemmatically went through them and copy back to my C drive.
I still have the drives and can access them anytime using Get Data Back.
http://www.runtime.org/reviews.htm
Images>
3.5 external HDD case
Most important that you don't use it on your system drive and that is the drive you are running and working within.
Please read the Guides first and the feedback etc
Frequently Asked Questions about GetDataBack
http://www.runtime.org/data-recovery-faq.htm
Watch youtube video, this will give you a picture of how it works.
If you follow the steps it is so easy I had 100% success with all the drives I tested.
I now feel unless it is a very serious problem with a HDD there is no such thing as lost files anymore that's how confident I am, but do read and learn first.
GetDataBack for NTFS Tutorial on scanning an image
http://www.youtube.com/watch?v=XQBprGyy_Ko
If you have any questions ask away.
Regards Merete
0
 
LVL 1

Author Comment

by:annasad
ID: 39311680
well , great very rich information . in my case system has come to factory default settings .
and everything is formatted ..

any way i would like to tell you so far success i have done , i have connected the hard drive in a cage and now using another system for using get data back . but which option to select ??

i have selected one of the option which says including system which is formatted or partitioned .

in my case system is not portioned but it came to factory reset settings ...  so i am trying which is the most appropraite option .

Also is there any way where i can select to restore images only .. not the whole data . because i am only selected to images .
0
 
LVL 87

Expert Comment

by:rindi
ID: 39311736
You can try the options one by one if the first one you choose doesn't give you any good results. Once getdataback has scanned your disk, you can look for the data you need, you can scroll through the directory structure and then select the files you want to keep to copy off. But you have to scan the whole disk first.
0
 
LVL 69

Expert Comment

by:Merete
ID: 39312589
annasad the things is there is nothing to fear really
 once Get Data Back has found your files, it is just that a recovery program, you can do no wrong really as it can recover deleted files formatted drives.
A new way of thinking lol,
I understand the caution feeling since we do feel a bit anxious with the prospect of losing all our photos and precious stuff and seeing it again is like a second chance.

I just chose I don't know use default settings
When I saw some errors I chose to ignore and it continued
Your not restoring the entire data, but in order to select what you want it must scan the whole drive directory first
then it shows the drives directory tree in explorer and you can browse through them.
It is up to you what you want by selecting the folder on the left
If your images are in my pictures then select the my pictures folder
here you can either right click the my pictures folder and copy or select individual images on the right highlight one then go to the top view to see it
Look at the top menue for your other options,
Note in your mind where you restoring/copying to and how big is your drive your windows is on?
Ensure you have sufficient space for your copy back remembers windows requires a bit as well. Defrag your main C drive first ( your windows drive)
Do it in increments.
Once you buy it you have it for life and can rerun it as many times as you like.
Here's my steps with my USB drive just to show you.
You can use the BACK  tab anytime once it has loaded files
Look around the navigation panel for your options.
runtime startselect partition that is the biggestRuntime 3scanningDirectories foundchoose searchchoose my picturesviewing imagesright click copycopy toRun time guide please read it to get the answers you seek.
http://www.runtime.org/howto_datarecovery.pdf
0
 
LVL 1

Author Comment

by:annasad
ID: 39313104
for some reason .. scan is running for a long long time .. its been 8 hours that its running ...

let see when it comes to an end and if i can see any images found . i will keep you posted in next couple of hours .
0
 
LVL 69

Expert Comment

by:Merete
ID: 39313128
8 hours is odd?
My example using a 1TB USB HDD
Check my screenshots and is this how you have done it, it takes around 3 minutes to scan for the files.
0
 
LVL 1

Author Comment

by:annasad
ID: 39313147
may be less than that .. i was busy with other stuff too :-) .. but not less than 2 hrs for sure .
As of now just waiting on this window
Capture.JPG
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 69

Expert Comment

by:Merete
ID: 39313155
I see it's populating Tree?
I'll just rerun my Get Data back and check where this is seen'
0
 
LVL 1

Author Comment

by:annasad
ID: 39313159
yeh i can see now the tree , and i am now searching JPEG files from that .. lets see
0
 
LVL 69

Expert Comment

by:Merete
ID: 39313160
I don't see this at all?
Once I select the partition next then it scans takes a minute then extracts the MFT takes about 1 minute
extracting MFTand loads my files
files loaded
 But ok let it run, seems your doing it differently.
Could also be the drive has problems?
0
 
LVL 69

Expert Comment

by:Merete
ID: 39313163
Lol your searching for jpeg, never organised them into one folder, have fun "Grins"

May I ask if you have this drive in secondary position right?
0
 
LVL 1

Author Comment

by:annasad
ID: 39313176
well yes this drive is secondary ...  i just found pictures .. and i found the folder name too which is 000B79 . then i went into folder in tree and i can see the images , some of them are opening while some of them windows picture viewer is unable to show me .

so have a look at this , and now real game .. its asking 79 $ in order to copy them . any tip ???

i hope you know what i am talking about .

but i tell you .. you are a good teacher .
Capture-2.JPG
0
 
LVL 1

Author Comment

by:annasad
ID: 39313181
if you look closely you would find out that this folder is lied under my windows folder and also this 000b79 folder is even not deleted ,  is it possible that this folder is somewhere found in windows folder .
I tried to find out this folder in windows folder but it didnt show up .

my sense is saying that if this folder is not shown as deleted , and not compressed and nor compressed , it may be somewhere placed and i may even not to recover it ??
0
 
LVL 69

Expert Comment

by:Merete
ID: 39313193
Yep you have to pay for it now annasad, it is a trial, and you have confirmed that they are recoverable.

I cant fully answer you but it looks right,
since you used the search for jpg, could be any type of jpg in any directory, a jpg for windows for sure.
To scan for your photos may be requires a specific name.
I would suggest to you just do the normal scan
When my scan finished it shows the normal directories and then I just  scroll down to My Documents or My Pictures etc,
browse through my folders.
0
 
LVL 1

Author Comment

by:annasad
ID: 39313194
no , i think i am wrong , the root directory is NTFS which is shown as red color , that means that windows folder is part of NTFS and this is deleted .
0
 
LVL 69

Expert Comment

by:Merete
ID: 39313318
Get Data Bach recovers deleted files/ partitions as well.
 First, check "Recover deleted files" in the Options screen. Then run GetDataBack as usual until it has build the Recovery Tree. "Permanently deleted" files can be found in their original folder (if still available). Files from "emptied recycle bins" can be found below the RECYCLE directory.
Note that these files have lost their original file names, but still have their original extensions.
recover deleted filesThere is a guide to every aspect.
http://www.runtime.org/howto.htm
But you need to buy it to continue any further.
I did inform you this had a fully functioning Trial to see if you can recover your files.
It is worth it as you can then use it for life.
A lot cheaper than paying someone to recover which can costs hundreds
Regards Merete
0
 
LVL 87

Expert Comment

by:rindi
ID: 39313348
The scan can take very long, depending on the size of the disk and what is found. 8 hours isn't long at all.
0
 
LVL 1

Author Comment

by:annasad
ID: 39313349
you are absolutely right .  i am sure that i should buy it . only problem is .. some of the pictures are not getting displayed . i think so they are damaged . As this data belongs to some one else .. i  just need permission to buy that for him .

thanks anyway . I would give you full marks with A grade . thanks for all your help with this software .
0
 
LVL 1

Author Comment

by:annasad
ID: 39315436
I have recovered file .. however many of the files are not rendering with Microsoft windows viewer however the size of the file is shown as per actual .. like most of the pics  are shown above 3.2 mb .
widnows-Photo-Viewer.JPG
0
 
LVL 1

Author Comment

by:annasad
ID: 39315606
As a reference .. this is how recovered files are shown . also attached one of corrupted image file
recovered-files.JPG
i-phone-pictures-184.JPG
0
 
LVL 69

Expert Comment

by:Merete
ID: 39316283
Hi annasad
Are we working on an iPhone?
Please let me know.

My tests produce invalid format wrong header. etc as well.
Those are the thumbnail view of the image from windows Photo Viewer
Photo viewer thumbnailBut these are not opening?
The second one doesn't load at all, says it is not valid jpeg??
What could be happening here is you have copied back the library instead of the actual photo?
Are you trying to save images off an iPhone?
I am not familiar with the storing of images on a iPhone but I dare say
 like iTunes, iPhoto defaults to copying the files and then managing those copies on its own, and in order to view them outside of this iPhoto use that software to export them.
If you have another iPhone in there it may be solved by exporting these images from iPhoto  on that iphone.
how do i save photos from iPhoto to jpeg
https://discussions.apple.com/thread/3453543?start=0&tstart=0

Where does iPhoto store imported photos?
https://discussions.apple.com/thread/3272818?start=0&tstart=0
http://www.fatcatsoftware.com/iplm/Documentation/iPLM/pgs/libraryfolder.html
iPhoto
http://forums.macworld.com/index.php?/topic/126112-how-and-where-does-iphoto-save-pictures/
0
 
LVL 1

Author Comment

by:annasad
ID: 39316421
well this is correct that i copied root folder which had many other folders in it , rather than copying images from folder . i identified where these images are located and copied the single folder of 14 GB which had all the folders and among all fodler almost 40 percent pictures are shown where rest of 60 % appears as mentioned above .

first image is the error when i try to open the image . and second one is image which shows this message .

now these are not all iphone pictures and i am using windows 7 and format of all pictures are jpeg . at the same time , i am able to open pictures in the same folder .
folder-000b79-was-copied.JPG
not-only-iphone-pictures.JPG
DSC01150.JPG
0
 
LVL 69

Expert Comment

by:Merete
ID: 39316526
Since we are both running windows 7 cant test using iPhoto.
It seems to me you may have copied over icons for all kinds of things, as you said you did a search for jpeg and it found all of them including windows icons.
And when you view them they are sorted with viewable and non viewable system files?

 I can open DSC01150.JPG and is an icon from the windows 7 start ORB ?? lol well that's good news.
DSC01150.JPGstart orbI would suggest to you just look in Docs and Settings/User Name  My Pictures.
Or expand Users folder further down to pictures.
Not in the system files
Docs and settingsAre you renaming them?
0
 
LVL 87

Expert Comment

by:rindi
ID: 39316678
You can't expect to get everything back, as some of your data was overwitten by the factory restore or whatever your friend did.

This shows how important regular backups are, and also that you shouldn't backup just to one backup media, as that can go bad too.
0
 
LVL 1

Author Comment

by:annasad
ID: 39316705
no i am not re naming them .also i made a search for all Jpeg which are more than 3 Mb almost .
i dont think that it should be a windows icon . you see the name of the Jpeg , none of the windows icon name comes as  DSC01105 , these names are when you take the pictures from camera .

a windows icon can not be with this name .  i believe that its corrupted .  also this folder does not in the root of windows ,  and all the pictures are found in one single folder , i believe most of them .

i think i am closing this exercise as this is not a professional work that i am doing , i am doing it for a friend and whom i have told to stop here , as this is not my core job .

however I found need to find that if there are any software which can fix the pictures , I have heard that there are some plenty of them .
0
 
LVL 69

Accepted Solution

by:
Merete earned 500 total points
ID: 39319541
annasad you have done a fantastic job for your friend so far, a professional would have used similar tools.
I agree that file may be corrupted as the file name is the same as a camera, however the file is the picture I showed you. A start orb/ the windows logo.
Corrupted for sure
Corrupted images like this may not be repairable to my knowledge when the integrity ie the headers are damaged. This is the original.
You can try Ifran View
http://www.ehow.com/how_7395844_fix-lost-header-jpeg-files.html

I saw this same similar when testing recovery techniques with some mp3 songs
 when I tried to recover some mp3 the files lost their association and was replaced with the  wrong song name to the wrong track.
Luckily I had backed every up over several USB drives and was able to restore everything.
This can happen because>
As quoted by Get Data Back
Do not write anything anymore to the drive you want to recover the data from!
This principle is not meant to terrorize you, it's meant to preserve your data.
After a data loss your data is not protected by the Operating System anymore the way it was before.
The OS thinks that the space where your lost data resides is free and can be used.
This means that the next copy operation, installation of programs, and even attempting booting from the drive can permanently overwrite your lost files
So as long as those files are not overwritten by new data, it's highly possible to get back formatted data.
freeware recuva
http://www.piriform.com/recuva/features
http://www.piriform.com/recuva
0
 
LVL 1

Author Closing Comment

by:annasad
ID: 39321434
great end to end help !!!
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

I previously wrote an article addressing the use of UBCD4WIN and SARDU. All are great, but I have always been an advocate of SARDU. Recently it was suggested that I go back and take a look at Easy2Boot in comparison.
Today companies are subjected to more-and-more data, and it won't stop any time soon.  But there are obvious opportunities for reducing data, particularly data duplicated among companies.
This Micro Tutorial will give you a basic overview of Windows Live Photo Gallery and show you various editing filters and touches to photos you can apply. This will be demonstrated using Windows Live Photo Gallery on Windows 7 operating system.
The goal of the tutorial is to teach the user what exposure is and how to use the exposure slider. Analyze the photo that you want to edit, then adjust the exposure slider to your liking.

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now