Solved

Cloned wrong hard drive!

Posted on 2014-09-26
22
339 Views
Last Modified: 2014-10-10
I had a customer w a bad laptop screen and I attempted to clone the data to another drive that already had data on it.

Accidentally, the other drives image was written over the data of the customer that I need.
 Is there a way to recover the entire image or can I recover data files?  The customer needs the information.
0
Comment
Question by:EricZ213
  • 7
  • 4
  • 3
  • +5
22 Comments
 
LVL 14

Expert Comment

by:JAN PAKULA
Comment Utility
you could try deep scan o with Recuva

https://www.piriform.com/recuva


but i doubt that you will be able to recover all image

you might have some success in recovering some files - but again some sectors might be overwritten - so it is very unlikely that you recover all the information
0
 
LVL 90

Expert Comment

by:John Hurst
Comment Utility
Since the clone overwrites everything, you would probably need an advanced recovery outfit to get data from it. From a practical perspective, you have lost the data that was there.
0
 

Author Comment

by:EricZ213
Comment Utility
Are there any places I could send it out to that you would recommend?  This data is crucial to the success of a company and is required for operation.  I did clone the drive, but have not booted to the OS, just used it as an external to pull data.  Does that make a difference?
0
 
LVL 14

Expert Comment

by:JAN PAKULA
Comment Utility
yes it would make a difference

send it to these people

http://www.krollontrack.com/data-recovery/data-recovery-services/

it will be pricy - but they will be able to recover it all
0
 
LVL 90

Expert Comment

by:John Hurst
Comment Utility
In terms of services, look in your geographic location (which is not mine).

I realize the difficulty you are in, but you might ask what backups exist. The disk could have equally well had a hard crash or the laptop stolen.
0
 
LVL 19

Expert Comment

by:Rob Hutchinson
Comment Utility
Ditto what Jan Pakula said, if you 'really' need the data:

1) do not boot to the drive

2) Do not use any other software to recover the data.

3) call Kroll Ontrack and get them to perform the data recovery. This company has been doing data recovery almost as long as hard drives were made, basically meaning that they are the best.
0
 
LVL 70

Expert Comment

by:garycase
Comment Utility
OnTrack is indeed an excellent recovery company ... but the simple fact is that it's VERY unlikely that the data can be recovered.    This isn't a case where the drive you need to recover data from has failed, but you have actually over-written all of that data with a clone of a different drive.     To recover the data that's "underneath" the magnetic layer of the current data requires VERY expensive equipment and a very high level of expertise ... and even then the likelihood of a full recovery isn't very high => and any data that can be recovered will likely cost $1,000 or even several times that.

Bottom line:   I agree with John Hurst:  "... From a practical perspective, you have lost the data that was there. "
0
 
LVL 9

Expert Comment

by:nattygreg
Comment Utility
OK, let me breathe a ray of hope, I accidentally formatted my data disc, with my wedding photo and all my program and backup files.

This operation requires you to be tech savvy, so I hooked up the drive to my Ubuntu machine via enclosure, and use photo-rec and recovered all my files. including my wedding photos, the only draw back was, that I had to rename everything cause they came back with weird file names. I hope this helps.
0
 
LVL 70

Expert Comment

by:garycase
Comment Utility
Formatting a drive is FAR different than cloning another drive to it.

Formatting only writes headers for the file structure.    Cloning a drive will cause all of the sectors that have data on the old (cloned) drive to be written to the new drive you're cloning to.

It's trivial to "un-format" a drive and recover all, or at least a very high %, of the data.    It's nearly impossible to do that if you're actually written to all of the sectors.    The only real hope here would be if the drive that he cloned has FAR less data on it than the drive he cloned it to -- AND the important data on the target drive was written to sectors beyond where the cloned image was written.    Overall, that's a very low-probability scenario.
0
 
LVL 95

Expert Comment

by:Lee W, MVP
Comment Utility
In general, I agree with John Hurst and garycase.  Once the data has been overwritten, the probability of recovery is slim.  *IF* possible you will almost certainly spend high thousands and maybe more than that to recovery the data.

Now, you said you cloned the drive - how did you clone the drive?  Often, people use this term inaccurately or at least use it with a different definition in mind.  What did you use to clone the drive?  was it identical drives (in terms of size) or was one drive significantly larger than the other?

Some solutions may do a bit-for-bit copy of the disk - if this was done, then you're almost certainly out of luck.  HOWEVER, if the copy/clone was just of data and the "reminder" of the empty space was essentially ignored by the copying/cloning software, then it may have simply marked the space as available and data recovery MIGHT be able to recover SOME of the data at a RELATIVELY reasonable price (a few hundred to low thousands).  It also depends on how much data was on the original drive and how much data was copied.

I DO agree with John - you need to look at the backups.
0
 
LVL 70

Expert Comment

by:garycase
Comment Utility
+1 on the backups.    Surely the company has SOME of the critical data backed up.    If not,  you certainly need to emphasis to them that you should NEVER have data that "... is crucial to the success of a company and is required for operation."  only stored in one place.    This data should be backed up at least twice -- once on site and at an off-site location.

While clearly the mere existence of the high-end (and pricey) data recovery companies shows that backups are all-too-often overlooked, there's NO reason for a small company that can easily backup all of their data onto a single disk or a small NAS to overlook this critical function.

On the other hand, you should also never be cloning a drive to a drive that already has data !!    It's far safer to simply IMAGE the drive you want to save ... you'll then be saving that image to a file on the target drive -- so other files won't be deleted in the process.
0
Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 23

Expert Comment

by:Dr. Klahn
Comment Utility
There was a study done some years back indicating that yes, given extremely sensitive read amplifiers, the tiny fractional bits left behind in the magnetic domains could sometimes be read.  However, this was "the government" doing that study, they had the advantage of knowing what was on the drive originally, and Three Letter Agencies have an unlimited amount of money to throw at such problems.

I don't think even Kroll can deal with this one.
0
 

Author Comment

by:EricZ213
Comment Utility
@Lee W....

It was done using clonezilla.   It runs a format of the drive, then writes the image.  The other drive was an 80 GB drive and this is a 160 GB
0
 
LVL 70

Expert Comment

by:garycase
Comment Utility
As I noted above, "... The only real hope here would be if the drive that he cloned has FAR less data on it than the drive he cloned it to -- AND the important data on the target drive was written to sectors beyond where the cloned image was written."

There's some hope of that here, but quite candidly it's very unlikely.   Since the cloned drive was only half the size of the target, then the 2nd half of the drive wasn't written to (except for formatting headers).    In addition, it would only write those sectors that contained data, so just how much of the first 80GB was written to depends on how full the drive you cloned was.

In any event, recovering the data is a task for a professional data recovery company.    As I noted earlier, this is likely to be a very expensive process ... Lee W is right on in noting that even if this is the "good" case where some of the data wasn't overwritten it will still cost "... a few hundred to low thousands",  and he's also right that if that's not the case it could easily cost "... high thousands and maybe more ..."

... Hopefully the company whose data you had on the target drive has backups.
0
 
LVL 19

Accepted Solution

by:
Rob Hutchinson earned 500 total points
Comment Utility
You can always contact Ontrack, and get a quote too:
http://www.krollontrack.com/data-recovery-quote/
0
 
LVL 70

Expert Comment

by:garycase
Comment Utility
Even OnTrack doesn't have the equipment to do "magnetic mining", where the previously written information can sometimes be recovered using statistical techniques based on the magnetic field strength -- a relatively low-percentage endeavor anyway.

It IS possible to recover some data with those techniques, but it's FAR too expensive to be cost effective; and I'm not aware of any commercial company that does this anyway -- the efforts I'm aware of were all done in government labs by 3-letter intelligence agencies.

The simple fact (as noted several times already by several folks) is that unless the data you need to recover was beyond the area you wrote with your cloning operation, the data is simply gone.
0
 
LVL 19

Expert Comment

by:Rob Hutchinson
Comment Utility
Well, what if it 'was' beyond the overwritten area?

I just think that Ontrack should at least take a look...as far as I know, they don't charge for unrecovered data.
0
 
LVL 70

Expert Comment

by:garycase
Comment Utility
Certainly won't hurt for a data recovery outfit to look at it ... but if the data was in fact past the overwritten area, much less expensive alternatives, like GetDataBack or OnTrack's own Easy Recovery Pro,  will be able to recovery the data.    Note that these are both "data safe" recovery utilities -- they do NO writing to the drive that they're working on ... so there's no harm trying them before resorting to professional data recovery.

This is simply not a case that lends itself to professional recovery -- the disk hasn't failed;  the sectors aren't corrupted or damaged; the drive electronics are fine; etc.    The user has simply overwritten much of the disk; and if the important data was in that part of the disk, it's gone -- plain and simple.    If the user is lucky enough that the important data is on a different part of the disk than the cloned data, then a good recovery utility can recovery it fairly easily.
0
 
LVL 19

Expert Comment

by:Rob Hutchinson
Comment Utility
To have someone start with contacting Ontrack is not necessarily a 'bad' thing. The people at Ontrack are not out to take every penny you have. They will be able to look at the drive, tell if the data can be recovered so then you can decide if you want to pay them or not.

It's been a while since I used them, but the link above says, "free data recovery quote"

Ontrack's "Easy Recovery Pro" for non-techies; is not actually that easy...ditto with GetDataBack.

Why make the questioner so paranoid that he's going to lose thousands of dollars so that he never even gets their professional opinion?

Even if he decides not to use OnTrack, at least they can tell him if there is any data worth recovering.
0
 
LVL 70

Expert Comment

by:garycase
Comment Utility
Agree it won't hurt to send it in for a free quote.   I just don't want him to be overly-optimistic.

If he's going to send it in for professional recovery, I'd also recommend an alternative to OnTrack ... Gillware  [https://gillware.com/ ].    These guys are VERY good;  also provide a free estimate and "no recovery, no fee" policy; and will even send you a pre-paid mailer to send your drive in, so it costs ZERO for them to have a look and let you know if anything's recoverable.   They're also significantly less expensive than OnTrack.

Certainly doesn't hurt to send the drive in to one of these guys for an evaluation -- but as I've noted several times, it's also VERY unlikely they're going to be able to help unless the data is outside of the area where the cloned image was written ... and that seems very unlikely.
0
 
LVL 90

Expert Comment

by:John Hurst
Comment Utility
@EricZ213  - It is now 5 days past the incident. Did the customer have backups of the data?
0
 

Author Closing Comment

by:EricZ213
Comment Utility
Thanks Rob
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Does your iMac really need a hardware upgrade? Will upgrading RAM speed-up your computer? If yes, then how can you proceed? Upgrading RAM in your iMac is not as simple as it may seem. This article will help you in getting and installing right RA…
This article is an update and follow-up of my previous article:   Storage 101: common concepts in the IT enterprise storage This time, I expand on more frequently used storage concepts.
This video teaches viewers how to encrypt an external drive that requires a password to read and edit the drive. All tasks are done in Disk Utility. Plug in the external drive you wish to encrypt: Make sure all previous data on the drive has been …
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now