Link to home
Start Free TrialLog in
Avatar of annasad
annasadFlag for Canada

asked on

Data recovery

hi
I have a dell laptop , i was out of home , when my cousin actually did some thing which i lost my all pictures which were placed on the desktop .  i think she has taken the system on factory default settings , and no software and no settings . i dont care about the softwares but i have lost family pictures which were very important to me .
now I need help , how to start , i have answers to some questions ..... but not all .

let me know where to start and i will do that , i am IT professional but not certainly in data recovery .
Avatar of rindi
rindi
Flag of Switzerland image

First stop working on that PC immediately. Remove the disk from it and connect it to another PC running Windows as a 2nd internal HD. Scan it using getdataback, and if the tool finds an of your files, register it so you can copy them to another location.

http://runtime.org
Just out of curiosity, what happened to your backups?
For starters, see if the photos are still on the hard drive. Depending on exactly what your cousin did, resetting to "factory default settings" may not have deleted user files. So simply do a search on the entire hard drive for "*.JPG" or "*.JPEG" files. Of course, if your photos are in some other graphics/image format, such as BMP, PNG, TIF, TIFF, etc., that's what you'll need to search for. Regards, Joe
Avatar of annasad

ASKER

i have done the JPEG search on hard disk and have not found any thing .  i believe files are deleted ...   there were no backups .. system was restored and data was lost ... thats all i can tell ..

one question here , why i cant run get data back on the same OS , or its a different to run as external drive and within the same OS .
> i have done the JPEG search

To be clear, you also looked for *.JPG...right? And also BMP, which is the other most likely format...but it's JPG most of the time.

> why i cant run get data back on the same OS

Because when a file is deleted, the file is simply marked as deleted in the file system, but the contents are still on the drive. So as long as the blocks containing the deleted file are not needed for other files, then they'll stay on the drive and "un-delete" software may be able to recover the data. But if you keep using the drive (and that's what running the OS will do), then the blocks that had been allocated to the deleted file could be allocated to a new file and the data will be overwritten. So rindi's suggestion to "stop working on that PC immediately" is spot-on and very important if you are to have any hope of recovering deleted files. Regards, Joe
Avatar of annasad

ASKER

well , correct i made a search for both JPG and JPEG , adn also bmp . but not found .

Also I would have to take hard disk out of laptop , i have to see how to open it and take hard disk out of it . hopefully i should be able to do it .

Also if you can help me to find step by step guide , how to take hard disk out , i think it should not be as difficult as to open some screws from the back of the laptop . lets do it today and see if it works .

also i think i am not going to buy software ASAP as i need to first see if i can have list of files which are required or not , then i can pay to make a search .
You don't have to take the hard disk out of the laptop...that's certainly one way to do it, but not the only way. Since you obviously have access to another computer that you're using for this EE thread, you should be able to make a bootable CD with "undelete" software on it. One product that can do this is EaseUS Data Recovery and the instructions are here:
http://www.easeus.com/data-recovery/other-recovery-software/undelete-boot-cd.htm

But, remember, creation of the CD must be done on a different computer. Do not boot the PC with the deleted files into Windows. When you turn it on, immediately enter the BIOS, set the boot sequence to have the CD first, then put the CD in the optical drive, and then boot into the EaseUS Data Recovery Wizard.

But if you don't like this idea, then removing the hard drive from the Dell laptop should be very easy...I've had many Dell laptops and it's usually just a few screws on the side or bottom of the case that secures the hard drive. On the computer you're using for this thread (not the PC with the deleted files), go to the Dell support site:
http://www.dell.com/support/home/us/en/19?c=us&l=en&s=dhs

Enter the Service Tag, which should be on the bottom of the PC, but if it isn't, click Laptops and keep clicking until you find your machine, then download the User's/Owner's Guide and the Service Manual for it. One (or both) of those will have instructions for removing the hard drive. Two example sets of instructions for Dell laptops are attached. Regards, Joe
Dell-Inspiron-700m-hard-drive-Se.pdf
Dell-Latitude-D830-hard-drive-Se.pdf
Avatar of annasad

ASKER

very much appreciated , allow me to follow above steps and see if i can have my luck on it .
annasad I can 100% garrantee get Databack will do exactly that, even deleted files, it will recover files even if the HDD had been partitioned.
I have done this myself and it works even a dead drive.
Just follow the instructions the others have provided and move the drive to  an external enclosure or set it to a secondary drive in another computer,  or connect your laptop via a lan.
install get data back on that PC and run it.
There is several version, but what's really great the fully functioning trial will let your run it and see it for yourself
The price is reasonable and a lot cheaper than getting someone to do it for you.
Youtube has lots of videos so you can see yourself.
http://www.youtube.com/watch?v=XQBprGyy_Ko
here's the guide well a read first
http://www.runtime.org/howto.htm
http://www.runtime.org/howto_datarecovery.pdf

The main reason why you can't restore from the same drive is the files on your current C drive will lose their file association, I have also tested this trying to restore deleted off my main C drive it cant be done on the same drive, all my music changed their music names to the wrong names and were corrupted. It was test as I had already backed them up.

Good Luck and don't worry.
If you need further assistance just let us know
PS, any chance you had uploaded any of these photos to facebook or Skydrive from windows live mail?
You can also give a try to Kernal Data recovery as well, in order to get your precious images back
they have plenty of software for data recovery solution
@Merete

I have done this myself and it works even a dead drive<- How do you do that?
Avatar of annasad

ASKER

i need sometime to perform above steps and so requested to not put question on abondon. once i perform above steps then i will answer the results .
Hello annasad
I started off with the trial of Get Data Back ( ntfs) just to see if
(1) I could access my drive/s
(2) if I could see my files.
Remember there is two versions Fat and ntfs.
http://www.runtime.org/data-recovery-software.htm
Quote from Get Data Back
Recover My Files - Try it free and see your deleted files!
http://www.recovermyfiles.com/?gclid=CM35rPiFiLgCFYUhpQodTB4AJQ

Here's what I did, once the trail tested successfully I bought it so I could recover all my files over ten drives from past computers
First:
I bought an external HDD case that supports both ide and sata . It also comes with a power adapter like the one you see on the USB HDD
They also known as a CADDY.
I have some photos somewhere but can't find them atm
Looks like this, I didnt bother with any screws or put the cover back on to the case I just let it sit on the table as is with the HDD inserted.
And another showing you how to
http://www.computershopper.com/peripherals/howto/build-your-own-external-hard-drive
Continuing>
I dropped the dead HDD or any of the HDD I have from old computers
 in to external case
connected the appropriate ide or sata cable to the drive, connected the power socket the white one inside the external case to the drive that's inserted,
 then the power cord on the case plugged that in to the power AC, then connected into USB in my computer,  and then waited
If there was a problem with HDD structure which most had a damaged boot loader or something wrong with the clusters windows threw up a message it needs to format it first I just ignore that of course,

Ran get Data back and by passed the messages about bad cluster etc  do I want to continue
and then the files structure appeared and I then systemmatically went through them and copy back to my C drive.
I still have the drives and can access them anytime using Get Data Back.
http://www.runtime.org/reviews.htm
Images>
3.5 external HDD case
Most important that you don't use it on your system drive and that is the drive you are running and working within.
Please read the Guides first and the feedback etc
Frequently Asked Questions about GetDataBack
http://www.runtime.org/data-recovery-faq.htm
Watch youtube video, this will give you a picture of how it works.
If you follow the steps it is so easy I had 100% success with all the drives I tested.
I now feel unless it is a very serious problem with a HDD there is no such thing as lost files anymore that's how confident I am, but do read and learn first.
GetDataBack for NTFS Tutorial on scanning an image
http://www.youtube.com/watch?v=XQBprGyy_Ko
If you have any questions ask away.
Regards Merete
Avatar of annasad

ASKER

well , great very rich information . in my case system has come to factory default settings .
and everything is formatted ..

any way i would like to tell you so far success i have done , i have connected the hard drive in a cage and now using another system for using get data back . but which option to select ??

i have selected one of the option which says including system which is formatted or partitioned .

in my case system is not portioned but it came to factory reset settings ...  so i am trying which is the most appropraite option .

Also is there any way where i can select to restore images only .. not the whole data . because i am only selected to images .
You can try the options one by one if the first one you choose doesn't give you any good results. Once getdataback has scanned your disk, you can look for the data you need, you can scroll through the directory structure and then select the files you want to keep to copy off. But you have to scan the whole disk first.
annasad the things is there is nothing to fear really
 once Get Data Back has found your files, it is just that a recovery program, you can do no wrong really as it can recover deleted files formatted drives.
A new way of thinking lol,
I understand the caution feeling since we do feel a bit anxious with the prospect of losing all our photos and precious stuff and seeing it again is like a second chance.

I just chose I don't know use default settings
When I saw some errors I chose to ignore and it continued
Your not restoring the entire data, but in order to select what you want it must scan the whole drive directory first
then it shows the drives directory tree in explorer and you can browse through them.
It is up to you what you want by selecting the folder on the left
If your images are in my pictures then select the my pictures folder
here you can either right click the my pictures folder and copy or select individual images on the right highlight one then go to the top view to see it
Look at the top menue for your other options,
Note in your mind where you restoring/copying to and how big is your drive your windows is on?
Ensure you have sufficient space for your copy back remembers windows requires a bit as well. Defrag your main C drive first ( your windows drive)
Do it in increments.
Once you buy it you have it for life and can rerun it as many times as you like.
Here's my steps with my USB drive just to show you.
You can use the BACK  tab anytime once it has loaded files
Look around the navigation panel for your options.
User generated imageUser generated imageUser generated imageUser generated imageUser generated imageUser generated imageUser generated imageUser generated imageUser generated imageUser generated imageRun time guide please read it to get the answers you seek.
http://www.runtime.org/howto_datarecovery.pdf
Avatar of annasad

ASKER

for some reason .. scan is running for a long long time .. its been 8 hours that its running ...

let see when it comes to an end and if i can see any images found . i will keep you posted in next couple of hours .
8 hours is odd?
My example using a 1TB USB HDD
Check my screenshots and is this how you have done it, it takes around 3 minutes to scan for the files.
Avatar of annasad

ASKER

may be less than that .. i was busy with other stuff too :-) .. but not less than 2 hrs for sure .
As of now just waiting on this window
Capture.JPG
I see it's populating Tree?
I'll just rerun my Get Data back and check where this is seen'
Avatar of annasad

ASKER

yeh i can see now the tree , and i am now searching JPEG files from that .. lets see
I don't see this at all?
Once I select the partition next then it scans takes a minute then extracts the MFT takes about 1 minute
User generated imageand loads my files
User generated image
 But ok let it run, seems your doing it differently.
Could also be the drive has problems?
Lol your searching for jpeg, never organised them into one folder, have fun "Grins"

May I ask if you have this drive in secondary position right?
Avatar of annasad

ASKER

well yes this drive is secondary ...  i just found pictures .. and i found the folder name too which is 000B79 . then i went into folder in tree and i can see the images , some of them are opening while some of them windows picture viewer is unable to show me .

so have a look at this , and now real game .. its asking 79 $ in order to copy them . any tip ???

i hope you know what i am talking about .

but i tell you .. you are a good teacher .
Capture-2.JPG
Avatar of annasad

ASKER

if you look closely you would find out that this folder is lied under my windows folder and also this 000b79 folder is even not deleted ,  is it possible that this folder is somewhere found in windows folder .
I tried to find out this folder in windows folder but it didnt show up .

my sense is saying that if this folder is not shown as deleted , and not compressed and nor compressed , it may be somewhere placed and i may even not to recover it ??
Yep you have to pay for it now annasad, it is a trial, and you have confirmed that they are recoverable.

I cant fully answer you but it looks right,
since you used the search for jpg, could be any type of jpg in any directory, a jpg for windows for sure.
To scan for your photos may be requires a specific name.
I would suggest to you just do the normal scan
When my scan finished it shows the normal directories and then I just  scroll down to My Documents or My Pictures etc,
browse through my folders.
Avatar of annasad

ASKER

no , i think i am wrong , the root directory is NTFS which is shown as red color , that means that windows folder is part of NTFS and this is deleted .
Get Data Bach recovers deleted files/ partitions as well.
 First, check "Recover deleted files" in the Options screen. Then run GetDataBack as usual until it has build the Recovery Tree. "Permanently deleted" files can be found in their original folder (if still available). Files from "emptied recycle bins" can be found below the RECYCLE directory.
Note that these files have lost their original file names, but still have their original extensions.
User generated imageThere is a guide to every aspect.
http://www.runtime.org/howto.htm
But you need to buy it to continue any further.
I did inform you this had a fully functioning Trial to see if you can recover your files.
It is worth it as you can then use it for life.
A lot cheaper than paying someone to recover which can costs hundreds
Regards Merete
The scan can take very long, depending on the size of the disk and what is found. 8 hours isn't long at all.
Avatar of annasad

ASKER

you are absolutely right .  i am sure that i should buy it . only problem is .. some of the pictures are not getting displayed . i think so they are damaged . As this data belongs to some one else .. i  just need permission to buy that for him .

thanks anyway . I would give you full marks with A grade . thanks for all your help with this software .
Avatar of annasad

ASKER

I have recovered file .. however many of the files are not rendering with Microsoft windows viewer however the size of the file is shown as per actual .. like most of the pics  are shown above 3.2 mb .
widnows-Photo-Viewer.JPG
Avatar of annasad

ASKER

As a reference .. this is how recovered files are shown . also attached one of corrupted image file
recovered-files.JPG
i-phone-pictures-184.JPG
Hi annasad
Are we working on an iPhone?
Please let me know.

My tests produce invalid format wrong header. etc as well.
Those are the thumbnail view of the image from windows Photo Viewer
User generated imageBut these are not opening?
The second one doesn't load at all, says it is not valid jpeg??
What could be happening here is you have copied back the library instead of the actual photo?
Are you trying to save images off an iPhone?
I am not familiar with the storing of images on a iPhone but I dare say
 like iTunes, iPhoto defaults to copying the files and then managing those copies on its own, and in order to view them outside of this iPhoto use that software to export them.
If you have another iPhone in there it may be solved by exporting these images from iPhoto  on that iphone.
how do i save photos from iPhoto to jpeg
https://discussions.apple.com/thread/3453543?start=0&tstart=0

Where does iPhoto store imported photos?
https://discussions.apple.com/thread/3272818?start=0&tstart=0
http://www.fatcatsoftware.com/iplm/Documentation/iPLM/pgs/libraryfolder.html
iPhoto
http://forums.macworld.com/index.php?/topic/126112-how-and-where-does-iphoto-save-pictures/
Avatar of annasad

ASKER

well this is correct that i copied root folder which had many other folders in it , rather than copying images from folder . i identified where these images are located and copied the single folder of 14 GB which had all the folders and among all fodler almost 40 percent pictures are shown where rest of 60 % appears as mentioned above .

first image is the error when i try to open the image . and second one is image which shows this message .

now these are not all iphone pictures and i am using windows 7 and format of all pictures are jpeg . at the same time , i am able to open pictures in the same folder .
folder-000b79-was-copied.JPG
not-only-iphone-pictures.JPG
DSC01150.JPG
Since we are both running windows 7 cant test using iPhoto.
It seems to me you may have copied over icons for all kinds of things, as you said you did a search for jpeg and it found all of them including windows icons.
And when you view them they are sorted with viewable and non viewable system files?

 I can open DSC01150.JPG and is an icon from the windows 7 start ORB ?? lol well that's good news.
User generated imageUser generated imageI would suggest to you just look in Docs and Settings/User Name  My Pictures.
Or expand Users folder further down to pictures.
Not in the system files
User generated imageAre you renaming them?
You can't expect to get everything back, as some of your data was overwitten by the factory restore or whatever your friend did.

This shows how important regular backups are, and also that you shouldn't backup just to one backup media, as that can go bad too.
Avatar of annasad

ASKER

no i am not re naming them .also i made a search for all Jpeg which are more than 3 Mb almost .
i dont think that it should be a windows icon . you see the name of the Jpeg , none of the windows icon name comes as  DSC01105 , these names are when you take the pictures from camera .

a windows icon can not be with this name .  i believe that its corrupted .  also this folder does not in the root of windows ,  and all the pictures are found in one single folder , i believe most of them .

i think i am closing this exercise as this is not a professional work that i am doing , i am doing it for a friend and whom i have told to stop here , as this is not my core job .

however I found need to find that if there are any software which can fix the pictures , I have heard that there are some plenty of them .
ASKER CERTIFIED SOLUTION
Avatar of Merete
Merete
Flag of Australia image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of annasad

ASKER

great end to end help !!!