Results 1 to 2 of 2
2012-12-02, 23:46 #1
Advice on recovering deleted data?
I'm helping a friend reinstall Windows in his hard drive, and it appears that there was some hooliganism with his drive. His user account appears to have been deleted, whether accidentally by himself, or from some nasty malware, I'm not sure. All that's left is the default Guest and Administrator accounts, with nothing in them.
Now I'm looking for some good software to recover his account/data. I've already removed the drive from his laptop, and hooked it up to my computer via a drive dock, so it's ready for work. I'm specifically looking for pictures, as almost everything else on the drive is expendable.
Aside from the data recovery recommendations though, I have another question: assume that the data recovery program works, but instead of just pulling off his user account data, it recovers everything: images from websites stored as cookies, pictures stored by programs in Program Files, etc. How would I go about separating his personal pictures from everything that might be recovered? Would I simply have to go through every file with him, one by one, to try and pick up the pieces? It seems very tedious, as there could be literally thousands of files to go through, most of which are just part of the system or installed programs.
On the one hand, I could go through it - with or without him - and get the data recovered, one file at a time. I don't know if I like this approach, as it will take a long time, and I don't know what to look for: he might, because it's his stuff. I don't want to have to delete a recovered picture because I don't think it is important, only to find that it really is useful or needed.
On the other hand, should I just dump the data that I've recovered into his lap, and let him sort through it? It doesn't seem like something a good, professional data recovery business would do, and while I'm just a helpful individual, I'd like to think I'd do the professional thing. Additionally, I'd feel bad giving him all that work, and it might look like I was indifferent to helping him, as I wouldn't be taking the time to help him find what he needed among all the recovered files. Still, it is his stuff, and not my responsibility right? Doesn't that end after I recovered the data and helped him reinstall Windows?
It's getting pretty deep here, so I guess I should finish this. I'm just not sure at which point I should stop helping him go through the files recovered or not - once I find a program I can use to do so for this situation, that is!"Violence is the last refuge of the incompetent." - Issac Asimov, from his novel "Foundation"
2012-12-03, 02:54 #2
- Join Date
- Apr 2011
- Thanked 134 Times in 115 Posts
A few questions to answer there Diogones.
First up, to address your points about how far to go in recovering data, collating and organising it for your friend: Are you getting paid for the work? If not, then I would do not much more than the minimum as a favour. If your friend is a close contact, then you may feel obligated to attempt to do extra work, but it is a grey area that could lead to pain. How do you know what is required and what is junk for example. What happens if you make a mistake and do not recover needed data? What happens if you come across sensitive data?....Lots of questions that could challenge a friendship, or at least make you uncomfortable (which I sense in your comment already).
However, if your friend is paying for a service, then you should set out up front what you can recover and the state that the data may be in once the work is complete. Your friend should agree to that before you start work. It needn't be a heavyweight legal document, but just a simple statement of what could be done and an agreement against that: keeps everything clean and above board.
Now, turning to the recovery itself. Yes, there are many data recovery programs, but often they have restrictions unless you buy the full package. I would download and burn a Linux Live CD, or better still, in this case Hirens Boot CD which can find specific types of files as required. Boot the second machine off that CD and inspect the drive to recover any data that remains.
I do find it odd that your friends account is missing. Malware would not normally do that: it could be a ransomeware infection hiding files, or there could be a corruption on the drive. Either way, mounting the drive offboard as you have done should allow for an inspection and recovery.In God we trust; all others must bring data.
- William Edwards Deming. 1900 - 1993