Link to home
Start Free TrialLog in
Avatar of WellingtonIS
WellingtonIS

asked on

Undelete files from a formatted drive

I have a tech who reformatted a machine and didn't save the users files.  Is there any free ware that I can use to undelete this stuff?  It only one drive a "C" drive no partitions so I need something that will either work like that or something I can do over the network.
Avatar of T Bilderback
T Bilderback
Flag of United States of America image

GetDataBack is a good program to use. Provided the data wasn't damaged in any way. Good luck!
Avatar of WellingtonIS
WellingtonIS

ASKER

OK if I use a jump drive to restore do you think that will work?  The use only has one drive.
You can save the recovered data to an external. That would probably be the easiest way to make sure it gets to the new OS. IF the drive you need to scan isn't loaded with an OS, I'd suggest hooking the lone drive up to another machine and running GDB from there. But you'd also still want to save the recovered files to an external of sorts. You could TRY to boot to the program to restore, I've just never tried it like that. I've had better luck with it the other way.
the drive was reformatted with the same OS.  I it just will not let me install the program because there's only one drive.
Testdisk might be able to help - Open Source

(but if you have already installed a new OS and wrote to the disk, then you're going to have a low likelihood of success no matter which tool you choose)
OK I'll keep that in mind but I have to try
You should be able to install GDB on your current drive if there's an OS? I can install it on mine here and I only have one as well. Maybe try the second program mentioned?
Avatar of BillDL
If you install any application on the same hard drive that you are trying to recover data from, there is a realistic probability that the files installed by the application, and the large amount of space needed by "temp" files created by a data recovery program, will overwrite a significant number of the very files that you are trying to recover.

The only safe way to mitigate the chance of further data loss is to temporarily connect the hard drive to a computer that is already running an operating system in which you have installed a data recovery application.

Note:  GetDataBack (https://www.runtime.org/data-recovery-software.htm) is free to try, but if it shows you a list of recoverable files you then need to buy a licence to copy them out and effectively recover them.  This application is better at recovering data after a drive is formatted or has filing system corruption than a free but simpler "undelete" program like Recuva (https://www.piriform.com/recuva).

Your alternative to connecting the affected drive to another computer is booting it to a "Live CD" that runs in its own environment and in memory only, without having to write to the hard drive in that computer.  The folks that sell GetDataBack have a Live CD to download as an *.ISO that you load into CD Burning software to burn a bootable Linux-based CD (https://www.runtime.org/data-recovery-live-cd.htm).
i agree with all above
1-GDB is by far the best tool for recovery
2-as said above, the free tools will show the recovereable files and folders
3-it will also save the folder structure

but as said by Billdl- you should NOT use this drive - not even to boot from; hook ik to a working system on which you install the recovery software, to avoid overwriting the files to recover

Billdl - by the way - do the GDB people have a "bootable CD" running from usb stick also?
I hadn't actually checked out the GDB Live CD for a while nobus, because thankfully I haven't had the need to recover anything, but yes it does allow installation to bootable USB Flash Drive via one of the desktop items after booting to the CD:

Preinstalled software includes GDB for FAT and NTFS, and one of the Desktop items is "Install To Flash", which "Installs a bootable copy of the Runtime Live CD on a USB stick".

https://www.runtime.org/data-recovery-live-cd.htm

It comes with the obligatory disclaimer though:
The Runtime Live CD uses Linux kernel 3.3.2 (Knoppix). As our software are native Windows programs they run under a WINE emulation. We have tested our software in that environment and most functions "appear" to work. However, an emulation is an emulation only. There might be circumstances and combinations of software and hardware, where the Runtime Live CD and/or the Runtime Software programs it contains, do not work, or might be destructive. The Runtime Live CD is therefore "experimental" and you assume all risks for its use.
I have succesfully used Puran File Recovery.
OK because get back didn't work - I will try that.
what do you mean with"get back didn't work?"
if you mean GDB could not recover your files, chances are very low another tool will do so
but i'm interestied in case something turns up
It found a lot but not the user files.  I'm going to do some work on it over the weekend while the user isn't here with not interruptions.
ASKER CERTIFIED SOLUTION
Avatar of nobus
nobus
Flag of Belgium image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Was able to get the files back using Puran File Recovery however, they are too corrupt and will not open .
I agree with nobus. IF GDB didn't work, chances are low for other programs to work. There are businesses that do extensive data recovery. One I'd recommend is called Gilware.
Well I doubt we will go that way.  But thanks everyone for your suggestions.
>>  Was able to get the files back using Puran File Recovery however, they are too corrupt and will not open .   <<   you did not get the files back, only a link to the files in the fat tables
GDB does not show these as recovereable - another + for them
Puran File Recovery gets your files back (not only links to the ...), it also shows if they are overwritten or not.
Hi WellingtonIS

I am curious about something.  Did you install Puran on the same computer, or did you run a "portable" version of the software, or did you remove the hard drive and connect it to another computer that had Puran installed on it?

Did the software actually tell you that the files you were going to recover were "corrupt", or did they simply not open properly in their associated programs after being recovered?
Hi BillDL
I think it's obvious that you don't touch the drive that you want to recover (In the given situation, with OS reinstalled on the same drive, chances for old files not to be overwritten were small). Whenever possible I connect the screwed drive to another computer. You can install but also have a portable version of Puran (or Recuva). These both show you the condition of the found files - unrecoverable (meaning completely overwritten) / poor / good / excellent ...
Sorry, you probably saw the comment before I edited it.  I accidentally copied and pasted your name instead of the asker's, to whom I was directing my question.

You and I know that it is "obvious", but the asker did mention away back near the beginning of the question:
"the drive was reformatted with the same OS.  I it just will not let me install the program because there's only one drive."
:-)
shit happens
I installed it on the same computer that was overwritten (formatted). I restored it to both the same hard drive and another hard drive.  I never took the original drive out.  The files seem to be there you can see them and you can see they have information, however when you try to open them with either Excel or Word it says the files are corrupted and they will not open.  Same with the PDFs too.
Puran File Recovery states:
"More than 50 formats/data patterns list expandable to hundreds of formats is included. Hence almost everything can be recovered".
It's not clear whether the default is 50 or 100, but either way I would expect that Excel, Word, and PDF would be among the available patterns that the software would use to recognise and reassemble such files.

That being the case, the combination of formatting and continuing to use the same drive has wrecked your chances of file recovery.
Unfortunately, I agree what's more than strange is you can see the size of the files the & names  have been changed and they will not open.  For example when I try to open an Excel spreadsheet it tells me that the file format or file extension is not valid