Anyone play with any data recovery tools?

Long story short- A Windows update screwed my MBR last week and I made an error trying to recover it. I should have whacked it with ERD Commander right off to recover the files but like an idiot I tried the "restore MBR" option in the XP recovery console and made it worse I think.

ERD Commander doesn't see any files with or without the MBR being in place and Spin-Rite doesn't either (opention #2 data recovery) however in the Spin-rite raw data snapshot you can clear see that there is data on the drive.

I have set the drive aside so that I can work on it as time permits and try to recover what I need when the correct tool presents itself.

Nothing earthshaking was lost, just a years worth of mail which I'd like back but not mission critical...

Ive always had a very high success rate of retrieving data with GetDataBack for NTFS/FAT.

http://www.runtime.org/data-recovery-software.htm

endo wrote on 12.09.09 at 15:49:31:

Ive always had a very high success rate of retrieving data with GetDataBack for NTFS/FAT. http://www.runtime.org/data-recovery-software.htm

I assume this runs from a boot disc?

A not-so funny aside- This is the second time I have had to setup the machine in 3 days!

I made the mistake of clicking on a link leading to a torrent site and my (fully patched) machine was INSTANTLY hit with drive-by trogan/spyware code.

I mean the page wasn't even fully loaded and I was franticlly hitting the back button (as soon as I hit the link I knew I made a mistake and hit back) and it closed the browser out and rebooted the machine!

When it restarted the firewall had been shut off and there was a flashing "microsoft icon" flashing in the tray telling me I was infected and had to download "x" software to cure the problem.

I blew away the harddrive with a hard low level format and reloaded everything and deleted the links from my backed up favorites.

Never saw anything that fast before, I had the DSL modem shut down before the attack had even finished shutting my OS though so what ever did it was out of luck reporting anything home.

I made good experiences with Easy Recovery some weeks ago.
http://www.ontrack.de/easyrecovery-professional/
I accidently erased the partition of my backup HDD, this program helped me get all my files back.

Hi

I use a Boot disc CD called, "MultiBoot EmergencyCD ver. Jul 2oo9"
It includes a LOT of programs to diagnose and correct any system problems you may have.  It has saved my bacon on several occasions.

CD Contents:

* miniPE v2k5.o9.o3 ( 24 Jul 2oo9 )
* Hiren's BootCD 9.9
* QuickTech Pro
* CheckIt 7.1 Pro - test, benchmark hardware
* SpinRite 6.0 HD Maintenance & Recovery Tool
* OnTrack Data Advizor 5.oo
* OnTrack EasyRecovery 6.10
* Acronis Disk Director Server 1o.o.2169
* Acronis True Image Echo Server with UR 9.7.8344
* Active BootDisk 2.1o
* HDD Regenerator 1.71
* EuroSoft PC-Check 6.o5
* Memtest86+ 2.11

Good luck!   8-)

/Edit:  SpinRite is the best hard drive tool out there.

gdonovan wrote on 12.09.09 at 17:09:10:

I made the mistake of clicking on a link leading to a torrent site and my (fully patched) machine was INSTANTLY hit with drive-by trogan/spyware code.

just out of curiosity,what torrent site was it? I was under the impression that torrent sites are not really harmful (tons of ads aside),unless they are total fakes of course..

Torrents should be a last resort IMHO.  There are much faster and reliable sources.

If Freeware/OpenSource fails, so far I had very good success rates with Stellar Phoenix.

(it should be noted, however, that a purchased Copy of this Software is hard-bound to the installed hardware at the time of installation, making prolonged use of the Software virtually impossible - which is a severe downfall)

ps47 wrote on 12.09.09 at 21:51:29:

gdonovan wrote on 12.09.09 at 17:09:10: I made the mistake of clicking on a link leading to a torrent site and my (fully patched) machine was INSTANTLY hit with drive-by trogan/spyware code. just out of curiosity,what torrent site was it? I was under the impression that torrent sites are not really harmful (tons of ads aside),unless they are total fakes of course..

Mininova.

Parted Magic Linux Live CD

http://partedmagic.com/

It contains a tool called TESTDISK - fully rebuilds ANY windows (and some other O.S.) MBR records.

This has saved my raid array 5 times already!

gdonovan wrote on 12.09.09 at 17:09:10:

Mininova.

wow.I have considered mininova as one of the safest-but I admit I haven't been there for a while,as I download stuff only rarely (basically only if I can't get it anywhere else)..maybe they got hit by a hacker or something.

anyway,good luck with the data recovery.

ps47 wrote on 13.09.09 at 08:37:45:

gdonovan wrote on 12.09.09 at 17:09:10: Mininova. wow.I have considered mininova as one of the safest-but I admit I haven't been there for a while,as I download stuff only rarely (basically only if I can't get it anywhere else)..maybe they got hit by a hacker or something.

Maybe, but it has always been shady with redirects too, I'll not go anywere near it unless I'm running the Linux laptop and transfer any files via sneakernet only.

paulpsomiadis wrote on 13.09.09 at 05:32:22:

Parted Magic Linux Live CD http://partedmagic.com/ It contains a tool called TESTDISK - fully rebuilds ANY windows (and some other O.S.) MBR records. This has saved my raid array 5 times already!

I'll try it today.

EDIT- Running now.

gdonovan wrote on 13.09.09 at 13:28:25:

paulpsomiadis wrote on 13.09.09 at 05:32:22: Parted Magic Linux Live CD http://partedmagic.com/ It contains a tool called TESTDISK - fully rebuilds ANY windows (and some other O.S.) MBR records. This has saved my raid array 5 times already! I'll try it today. EDIT- Running now.

No dice, so far no luck at all.

Question- So far nothing has been able to crack this, I have even gone as far as to take the drive and assign it a drive letter and mark the partition as active.

However.

The drive is being marked as '"0" in size and I assume it would have to be formatted.

If quick format is chosen, in theory the data isn't touch just marked as not being there. I'm thinking if the drive shows a size then spin rite or another program might be able to undelete or recover the data.

Thoughts?

I had a evaluation version of Ontrack on my Win2000pro box and have been trying it out on the drive.

Ontrack can see files and rebuild or do raw data recovery but the files are all scrambled to hell and back.

I have it doing a scan now, will let you know how it turns out.

gdonovan wrote on 14.09.09 at 02:56:21:

I had a evaluation version of Ontrack on my Win2000pro box and have been trying it out on the drive. Ontrack can see files and rebuild or do raw data recovery but the files are all scrambled to hell and back. I have it doing a scan now, will let you know how it turns out.

1 file in 1000 is not scrambled, what a mess!

So far the only tool that has worked at all has been the Ontrack data recovery, nice to have this one in my toolkit for future disaster.

I guess it is time to bite the bullet and go with some sort of automated backup solution.

Might be a little late on this but Active Undelete I've had incredible amount of success with and think it works better then EZRecovery if you can get it. It's what we use at work if we need to use a recovery tool off of our sales reps laptops that don't have access to our network for the most part and store things locally.

jandarsun8 wrote on 15.09.09 at 22:39:34:

Might be a little late on this but Active Undelete I've had incredible amount of success with and think it works better then EZRecovery if you can get it. It's what we use at work if we need to use a recovery tool off of our sales reps laptops that don't have access to our network for the most part and store things locally.

I can look into it, the partition and files look shredded though.

It does take a while to run, we set the drives up as a secondary drive and let it run over night as it does take a good 4-8 hours to run sometimes. As long as the bios recognizes that there's a drive there and the platters spin up, we've had pretty good luck with it.