I know of this is more of a "make shit" board but this was the best fit for my problem:
>be me, 8ish years ago, age 10 or 11
>look at porn on mom's laptop
>mom takes laptop to geek squad
>geeks quad does their magic
>lost all data including book she was writing, she is a journalist
>get laptop back, laptop runs fine but all her old stuff is gone, continue using laptop for multiple years after initial crash
>about a week ago, come home for Christmas, find old laptop in basement
>remember book I destroyed by watching porn as a 10 year old
>pull out old 60gb hard drive
what is the likelihood that the file of that book my mom had been working on is somewhere still on there? I've done my homework and know all the different options for data recovery, main problem would be if the fagsquad formatted the whole drive to reinstall windows xp when they "repaired" the laptop or if they just ran an anti-virus program on it and left the rest alone and reinstalled xp.
Is this worth a shot? it's been a while but I know files tend to hang around on hard drives for a while after being "deleted" before that space is needed for writing new data in its place.
Any ideas /diy/? Thanks a lot in advance.
photorec is open-source, or 'shit' by another name, while recuva is crippled unless you get the paid version.
i'd recommend instead Active@ File Recovery Professional, or Seagate File Recovery, both found on TPB. the latter actually recovers the filenames, whereas the former renames everything into new names like Found_145404647. despite that bit of stupidity, i actually prefer it. each takes about 2 hours to scan a 60gig.
and i wouldn't feel too guilty about the lost book. being forced to re-write something usually makes it way better, coz you can avoid all the first-time blunders, and tangents that go nowhere.
It would've been a sure thing the day after they got it, but now it's pretty much impossible. Just get a file recovery or undelete program and let it scan the whole drive looking for .doc files or whatever she was using at the time. You might find it, you mind find some it, it might be totally gone.
If her novel was child porn you could tell the FBi and they'd pay forensics to recover it, and then they'd put some extra on there just for good measure that they 'found' padded in her other files.
This, she might not have bothered about undeleting it or freaking out too much at geek squad because it gave her a chance to rewrite it.
Depends on what format they used.
If they are idiots, like most geeks, they they performed a quick format. And assuming that old drive was FAT32 then all a quick format does is rewrite the fat tables. It does not touch the data area.
IF they did a long format, then this zeroed the drive and the data area was overwritten. No chance to recover any data unless you are a 3 letter agency with access to a clean room.
You could try data carving the book.
First you need to know what program she was using, determine the file header and carve out file.
This works only on contiguous files, as you will not know the location of any file fragments. On a fragmented file, you will only get the first fragment, but not the whole file.
It would depend on how much the drive was used afterwards - if that was a lot, your chances are minimal bro, to say the least. As you noted yourself, you can (maybe) recover data that hasn't been overwritten, but, just for reference, best thing you can do in this situation is take the drive out, and DONT USE IT AGAIN.
If the drives still readable, make a byte for byte copy, then, see if you can extract anything from that copy. Leaving the drive in a PC is the second worst thing you can do, the worst being, continuing to use it, then hoping you can maybe recover something later, sadly, prob. too much later in this case.
how heavily was the laptop used after it was reformated?
Id give it a snowballs chance in hell, but its possible.. I recomend photorec, you can choose what file type it restores.. or icare data recovery, you can find it places or use the free version..
>geeksquad did their magic
>1 pass of zeros destroys everything
guess Im a one man three letter agency..
7 passes and I still recovered the entire drive with free recovery programs.
You might want to try a proffesional recovery app.
I recomend Internet evidence finder from Magnet Forencsics. If it's still there, it will find it.
The trial version allows you to recover just fine, for 14 days I think. Remember, if you recover a partition save it on an external hdd, not the same one you're trying to recover.
Good luck op.
But I did. Either youre some autist that thinks this stuff actually works or youre someone paid to promote the idea.. if I was some faggy youtuber Id have a video up of it, though youd just scream "he switched out the drive".
I used dban and icare data recover during the instance Im talking about, try it yourself.
>I used dban
it wouldn't surprise me if there existed phony versions of disk-wiping software put out by TLAs in order to fool people into thinking they're safe. in fact, i have a faint memory of wiping a disk a few years ago, then looking at it with a hex editor, and seeing that there was plenty of data (real data, not random data) left untouched.
>It would be a miracle to recover anything
>Photorec seems to be the most recommended recovery software.
>Next would be recuva I think.
Not necessarily a miracle. If the drive still spins, it's quit possible. What lowers the chances isn't the age, as much as the fact it was used afterwards.
I've recovered images from 8 year old SD cards using photorec before. The camera the card had been in died, wrote part of a corrupted image, then never started again. It had been formatted and re-used in a newer camera for some time, then forgotten about in a drawer. I just played with photorec to see what it could do, and it recovered dozens of images from the dead camera, and the replacement. So I'd say Op has a fighting chance.
pass of zeros destroys everything
>guess Im a one man three letter agency..
>7 passes and I still recovered the entire drive with free recovery programs.
Do people know you posses a magical ability that even the NSA and CIA can't do with unlimited money?
Then you didnt wipe the drive properly.
The simple fact of the matter is that the hard drive only reports to the controller a 1 or a 0. It cannot be told to report the magnetic level recorded on the disk. If your disk writes 0x000000 then it will return to the controller a 0x0000000 when asked what's there. The drive doesnt have the physical capability to measure in any way what could have been there.
There are cases where you can wipe the free space but still recover "deleted" chunks of data in the empty unused spaces of partial blocks.
Numerous studies on modern drives have shown that a single wpie of zeroes across an entire platter puts data recover even beyond the reach of three letter organizations.
I used a live cd and wiped the whole drive, Ive used dod and dod short before and still gotten data.
so either dban sold out to the cia, drive wiping just dont work, dban just dont work, or my computer(s) are incompatible with whatever dban runs off of.
all I know is I wasnt given enough options to be able to "wipe the drive wrong".
Did you verify the wipe?
There are a lot of programs that claim to wipe, but when verified are shown not to wipe.
But IF you were able to recover files after wiping the volume, then your wipe did not work properly.
DBAN has trouble detecting and wiping SATA drives sometimes since it was initially designed for IDE/SCSI drives.
With the right version and configure your BIOS correctly you can definitely do it, but seeing as you still recovered data, I'm guessing that was the problem.
No, I keep it a secret like Arrow.
it they are sata drives, one computer I know does have some issues with linux that requires acpi to be turned off just to be able to boot.. so it wouldnt surprise me if that one had issues.
the second computer that doesnt have linux issues, I cant recall if I used that to wipe or if I wiped on the first and then switched the drive over.. but you may be right.
I can say it didnt have any problems detecting the drive, and it took hours to complete the process and the counters seemed to be working.
when you say "verify the wipe" what are you meaning? is that an actual thing or do you mean run data recovery software?
my partitions were deleted and the files didnt show up in the file manager anymore
>only report to the controller
there's your problem. you can actually remove the platters and have them read by a far more sophisticated machine. there are data recovery specialists who own these machines. costs about 1000$ though.
I got a drive as well. it's a WD passport portable drive with some precious shit on it. Now, the drive wouldn't show up on my computer so after a lot of hassle I couldn't resist the temptation and I opened the drive to see if I could "unlodge" the reader arm... noob logic. This didn't solve anything, but is there still a chance to somehow get the data out, even after opening it?
what made you think the arm was stuck?
if it wasnt showing up because the controller was fried you could have replaced the controller board from a similar drive
but opening it probably fucked it with dust
got the blue screen of death when I tried booting the damned thing up. I was in the process of making a Linux live cd to fix whatever wasn't allowing the hard drive to boot when my mom asked me to return the laptop for some reason, I have no idea why considering it doesn't turn on and is an old as hell piece of shit. oh well. Thanks a lot for all the responses, if I ever need to recover anything in the future I'll definitely try all the programs and methods you suggested. as far as shit posting, shitposters gonna shitpost, nothing we can do. quote in pic related. Thanks again /diy/ I appreciate it a lot.