disaster recovery

[gwlubin]

can someone answer this question?

how do disaster recovery companys recover data that has been wiped from a hard disc. does a trace of the data remain? where is it? how do they get to it?

in windows, if I delete a file it goes into my recycle bin, when I empty that, where does the data go?

i need answers to these questions. NOW!

[Deb]

Imagine a wall painted white.[nbsp][nbsp]The white paint is your data.[nbsp][nbsp]When you decide you want to paint the wall blue, you have essentially 'deleted the white paint' and have opened up the space on the wall to receive the blue paint.[nbsp][nbsp]The key is, the white paint is still there for you to change your mind up until the point that you actually scrape off the white paint and start rolling on the blue paint.

When a file is written to disk it is kind of "painted" onto the disk itself.[nbsp][nbsp]When you delete the file, the computer decides that that area of the disk is now available for other files to 'paint' over. Sometimes (not always) this data can be recovered as long as it has not already been rearranged or 'painted over'.

To recover the data, if you are not experienced in doing so, it is best to hire someone who does know how to do it.[nbsp][nbsp]It is also best to Touch Nothing until your data has been received.[nbsp][nbsp]The more you do on that disk the less chance you have of recovering the data that was lost.

Deb

[Binky]

The one and only time I picked up a copy of Wired magazine they had an article on data recovery. They reported that one company in particular was so good that they'd recovered data from computers that had been blown up, burned, and driven over by steam rollers. Even worse than that they'd saved data from computers running Windows. Amazing. I was fascinated by this so read on to see how it was done but the article talked only about how much money this company made. I never looked at another Wired and am still wondering how it's all done.

[gwlubin]

i would love to know how to undelete email from outlook express after you have removed it from the 'deleted items' bin. does anyone know?

g/

[Justin]

Sorry, but once you have deleted it from the deleted folder, it's gone for good :([nbsp][nbsp]That's exactly why they have the deleted folder (like the Trash folder in QuestMail) - so you have a second chance.

Me personally - I have removed the recycle bin, as when I delete something I want it gone for good :)

------------------
Justin Nelson
FutureQuest Support

[gwlubin]

thanks deb very informative

Futurequest. The complete guide to life, the universe and everything
[This message has been edited by gwlubin (edited 08-05-99)]

[Deb]

ROFL!!!

(I wish)

[Bi4Be]

Justin, don't you ever accidently right click on then stumble on the letter "d" (enabling deletion after right click) or click on "Delete" after right clicking when you meant to click smoething like "Rename"?

[Ron]

DOS (which is still very much a part of Windows) deletes files by marking the directory entry as available and zeroing out the first character of the file name. It does not erase the file! So even if it's deleted from the recycle bin (or where ever) you still have some chance of getting it back. All it takes is a good disk editor, a little knowledge, and a whole lot of guts! :)

As Deb said, though, the more you use the disk the less chance you can recover deleted files. Since the space has been marked as "available," there's always the chance it will be written over the next time you save a file (and writing over it DOES erase it for good).

The other kind of data recovery, the ones that make the big bucks, is much more than just manipulating bits on the drive. I toured a plant in California several years ago and was astonished at what they can accomplish with a crashed disk drive. Basically, they have a "clean room" similar to those used in building hard disks - where the air is filtered of even the smallest particles. Very, very expensive. They remove the platters from the crashed disk, replace the electronics and mechanics, and voila - virtually a brand new disk, but with the data still sitting on it.

[Justin]

Justin, don't you ever accidently right click on then stumble on the letter "d" (enabling deletion after right click) or click on "Delete" after right clicking when you meant to click smoething like "Rename"?
Two things - first, I don't right click to rename - all you have to do is click on it once to highlite it, then click again and you're renaming it :)[nbsp][nbsp]Second, it asks for confirmation before deleting.

I guess I'm just a little bit careful or something... I hated the recycle bin ever since the first time I installed 95, and with 98 and TweakUI included on the CD, you can easily get rid of the recycle bin and all traces that it ever existed :) Oh, plus at the time I only had a 1.2 gig drive, so disk space was precious - if I deleted stuff it was because I needed the room, and the recycle bin made that task more difficult :)

But I'm weird like that.... ;)

------------------
Justin Nelson
FutureQuest Support

[gwlubin]

so ron, if i wanted to undelete my oe5 bin where would I look and waht would thefile look like?

g/

[JoelM]

Justin is 1/2 correct in the fact that the first character of the filename is changed to an 0xE5 (sigma character)to denote to the OS that the directory entry is available for over-write ... but that the data is still out there on the disk clusters.

The primary FAT (file allocation table)(there are two) chain for the file is also zeroed out denoting that the clusters on disk are available for overwrite/reuse.[nbsp][nbsp]If any application begins to use these clusters, after all they have been marked for availability, then the data on them is essentially lost.[nbsp][nbsp]Before use/overwriting you are able to recover the file by using the FAT2 copy of the cluster chains.
==========
BTW ....
The NSA has shown that since the R/W heads "wobble" a bit going around the disk (or actually the disk passing under them), it is possible to retreive much of the data even after it has been "overwritten" multiple times.[nbsp][nbsp]That's why we have to dis-assemble and grind off the media from the platters before we can remove a hard disk from a "secured facility".[nbsp][nbsp]I've always wondered how much bits and pieces of data are all the valuable, but I guess enough to trash all those perfectly good disk drives.

Joel

[Binky]

Well, it finally happened: I don't understand all of how this works but my partitions got hooped and, using my Norton rescue disk to restore them, I wound up with my entire drive empty. Lost all my data files. Well, I figured that, physically, the files must still be there. I tried a program from Powerquest called "Lost & Found" http://www.powerquest.com/lostandfound/index.html
that the guy in the computer store said would save me the thousands of dollars a data recovery company would charge me. It worked!

The trial version won't actually restore the data but shows you what it finds. Then you can decide whether it's worth paying for the working version.