Cloned wrong hard drive!

I had a customer w a bad laptop screen and I attempted to clone the data to another drive that already had data on it.

Accidentally, the other drives image was written over the data of the customer that I need.
 Is there a way to recover the entire image or can I recover data files?  The customer needs the information.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JAN PAKULAICT Infranstructure ManagerCommented:
you could try deep scan o with Recuva

but i doubt that you will be able to recover all image

you might have some success in recovering some files - but again some sectors might be overwritten - so it is very unlikely that you recover all the information
JohnBusiness Consultant (Owner)Commented:
Since the clone overwrites everything, you would probably need an advanced recovery outfit to get data from it. From a practical perspective, you have lost the data that was there.
EricZ213Author Commented:
Are there any places I could send it out to that you would recommend?  This data is crucial to the success of a company and is required for operation.  I did clone the drive, but have not booted to the OS, just used it as an external to pull data.  Does that make a difference?
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

JAN PAKULAICT Infranstructure ManagerCommented:
yes it would make a difference

send it to these people

it will be pricy - but they will be able to recover it all
JohnBusiness Consultant (Owner)Commented:
In terms of services, look in your geographic location (which is not mine).

I realize the difficulty you are in, but you might ask what backups exist. The disk could have equally well had a hard crash or the laptop stolen.
Rob HutchinsonTech Lead, Desktop SupportCommented:
Ditto what Jan Pakula said, if you 'really' need the data:

1) do not boot to the drive

2) Do not use any other software to recover the data.

3) call Kroll Ontrack and get them to perform the data recovery. This company has been doing data recovery almost as long as hard drives were made, basically meaning that they are the best.
Gary CaseRetiredCommented:
OnTrack is indeed an excellent recovery company ... but the simple fact is that it's VERY unlikely that the data can be recovered.    This isn't a case where the drive you need to recover data from has failed, but you have actually over-written all of that data with a clone of a different drive.     To recover the data that's "underneath" the magnetic layer of the current data requires VERY expensive equipment and a very high level of expertise ... and even then the likelihood of a full recovery isn't very high => and any data that can be recovered will likely cost $1,000 or even several times that.

Bottom line:   I agree with John Hurst:  "... From a practical perspective, you have lost the data that was there. "
Natty GregIn Theory (IT)Commented:
OK, let me breathe a ray of hope, I accidentally formatted my data disc, with my wedding photo and all my program and backup files.

This operation requires you to be tech savvy, so I hooked up the drive to my Ubuntu machine via enclosure, and use photo-rec and recovered all my files. including my wedding photos, the only draw back was, that I had to rename everything cause they came back with weird file names. I hope this helps.
Gary CaseRetiredCommented:
Formatting a drive is FAR different than cloning another drive to it.

Formatting only writes headers for the file structure.    Cloning a drive will cause all of the sectors that have data on the old (cloned) drive to be written to the new drive you're cloning to.

It's trivial to "un-format" a drive and recover all, or at least a very high %, of the data.    It's nearly impossible to do that if you're actually written to all of the sectors.    The only real hope here would be if the drive that he cloned has FAR less data on it than the drive he cloned it to -- AND the important data on the target drive was written to sectors beyond where the cloned image was written.    Overall, that's a very low-probability scenario.
Lee W, MVPTechnology and Business Process AdvisorCommented:
In general, I agree with John Hurst and garycase.  Once the data has been overwritten, the probability of recovery is slim.  *IF* possible you will almost certainly spend high thousands and maybe more than that to recovery the data.

Now, you said you cloned the drive - how did you clone the drive?  Often, people use this term inaccurately or at least use it with a different definition in mind.  What did you use to clone the drive?  was it identical drives (in terms of size) or was one drive significantly larger than the other?

Some solutions may do a bit-for-bit copy of the disk - if this was done, then you're almost certainly out of luck.  HOWEVER, if the copy/clone was just of data and the "reminder" of the empty space was essentially ignored by the copying/cloning software, then it may have simply marked the space as available and data recovery MIGHT be able to recover SOME of the data at a RELATIVELY reasonable price (a few hundred to low thousands).  It also depends on how much data was on the original drive and how much data was copied.

I DO agree with John - you need to look at the backups.
Gary CaseRetiredCommented:
+1 on the backups.    Surely the company has SOME of the critical data backed up.    If not,  you certainly need to emphasis to them that you should NEVER have data that "... is crucial to the success of a company and is required for operation."  only stored in one place.    This data should be backed up at least twice -- once on site and at an off-site location.

While clearly the mere existence of the high-end (and pricey) data recovery companies shows that backups are all-too-often overlooked, there's NO reason for a small company that can easily backup all of their data onto a single disk or a small NAS to overlook this critical function.

On the other hand, you should also never be cloning a drive to a drive that already has data !!    It's far safer to simply IMAGE the drive you want to save ... you'll then be saving that image to a file on the target drive -- so other files won't be deleted in the process.
Dr. KlahnPrincipal Software EngineerCommented:
There was a study done some years back indicating that yes, given extremely sensitive read amplifiers, the tiny fractional bits left behind in the magnetic domains could sometimes be read.  However, this was "the government" doing that study, they had the advantage of knowing what was on the drive originally, and Three Letter Agencies have an unlimited amount of money to throw at such problems.

I don't think even Kroll can deal with this one.
EricZ213Author Commented:
@Lee W....

It was done using clonezilla.   It runs a format of the drive, then writes the image.  The other drive was an 80 GB drive and this is a 160 GB
Gary CaseRetiredCommented:
As I noted above, "... The only real hope here would be if the drive that he cloned has FAR less data on it than the drive he cloned it to -- AND the important data on the target drive was written to sectors beyond where the cloned image was written."

There's some hope of that here, but quite candidly it's very unlikely.   Since the cloned drive was only half the size of the target, then the 2nd half of the drive wasn't written to (except for formatting headers).    In addition, it would only write those sectors that contained data, so just how much of the first 80GB was written to depends on how full the drive you cloned was.

In any event, recovering the data is a task for a professional data recovery company.    As I noted earlier, this is likely to be a very expensive process ... Lee W is right on in noting that even if this is the "good" case where some of the data wasn't overwritten it will still cost "... a few hundred to low thousands",  and he's also right that if that's not the case it could easily cost "... high thousands and maybe more ..."

... Hopefully the company whose data you had on the target drive has backups.
Rob HutchinsonTech Lead, Desktop SupportCommented:
You can always contact Ontrack, and get a quote too:

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Gary CaseRetiredCommented:
Even OnTrack doesn't have the equipment to do "magnetic mining", where the previously written information can sometimes be recovered using statistical techniques based on the magnetic field strength -- a relatively low-percentage endeavor anyway.

It IS possible to recover some data with those techniques, but it's FAR too expensive to be cost effective; and I'm not aware of any commercial company that does this anyway -- the efforts I'm aware of were all done in government labs by 3-letter intelligence agencies.

The simple fact (as noted several times already by several folks) is that unless the data you need to recover was beyond the area you wrote with your cloning operation, the data is simply gone.
Rob HutchinsonTech Lead, Desktop SupportCommented:
Well, what if it 'was' beyond the overwritten area?

I just think that Ontrack should at least take a far as I know, they don't charge for unrecovered data.
Gary CaseRetiredCommented:
Certainly won't hurt for a data recovery outfit to look at it ... but if the data was in fact past the overwritten area, much less expensive alternatives, like GetDataBack or OnTrack's own Easy Recovery Pro,  will be able to recovery the data.    Note that these are both "data safe" recovery utilities -- they do NO writing to the drive that they're working on ... so there's no harm trying them before resorting to professional data recovery.

This is simply not a case that lends itself to professional recovery -- the disk hasn't failed;  the sectors aren't corrupted or damaged; the drive electronics are fine; etc.    The user has simply overwritten much of the disk; and if the important data was in that part of the disk, it's gone -- plain and simple.    If the user is lucky enough that the important data is on a different part of the disk than the cloned data, then a good recovery utility can recovery it fairly easily.
Rob HutchinsonTech Lead, Desktop SupportCommented:
To have someone start with contacting Ontrack is not necessarily a 'bad' thing. The people at Ontrack are not out to take every penny you have. They will be able to look at the drive, tell if the data can be recovered so then you can decide if you want to pay them or not.

It's been a while since I used them, but the link above says, "free data recovery quote"

Ontrack's "Easy Recovery Pro" for non-techies; is not actually that easy...ditto with GetDataBack.

Why make the questioner so paranoid that he's going to lose thousands of dollars so that he never even gets their professional opinion?

Even if he decides not to use OnTrack, at least they can tell him if there is any data worth recovering.
Gary CaseRetiredCommented:
Agree it won't hurt to send it in for a free quote.   I just don't want him to be overly-optimistic.

If he's going to send it in for professional recovery, I'd also recommend an alternative to OnTrack ... Gillware  [ ].    These guys are VERY good;  also provide a free estimate and "no recovery, no fee" policy; and will even send you a pre-paid mailer to send your drive in, so it costs ZERO for them to have a look and let you know if anything's recoverable.   They're also significantly less expensive than OnTrack.

Certainly doesn't hurt to send the drive in to one of these guys for an evaluation -- but as I've noted several times, it's also VERY unlikely they're going to be able to help unless the data is outside of the area where the cloned image was written ... and that seems very unlikely.
JohnBusiness Consultant (Owner)Commented:
@EricZ213  - It is now 5 days past the incident. Did the customer have backups of the data?
EricZ213Author Commented:
Thanks Rob
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.