Recovering Overritten Data?

[Beebu]

My co-worker in Hong Kong made a terrible mistake when attempting to import all of his data from the mail client that comes with Snow Leopard into a new corporate Gmail account. Instead of creating a new account like he was supposed to, he changed the existing account (as the email addresses are the same, so he decided not to read the instructions), which essentially wiped out all of his old emails on the computer.

He used data rescue 2, and it was unable to recover any emails. He is running Snow Leopard, and has the time machine feature disabled as well.

The only option I know of to recover the emails is to retrieve them from the server, but it only saves the last 30 days worth, and he's missing nearly 8 times that.

If anyone knows if it's still possible to recover any of the emails, please let me know. Any help would be greatly appreciated, as at this point, I basically told him the emails are gone.

Thank you.

 

[DaveSimmons]

... and of course he never did any manual backups?

When his hard drive dies he's going to lose all of his files, not just 8 months of emails.

 

[Beebu]

... and of course he never did any manual backups?

When his hard drive dies he's going to lose all of his files, not just 8 months of emails.

Not sure if he's ever done any manual backups. He's asleep right now, I can ask him through gchat later when he wakes up.

Other than a backup though, is there no way to recover those files?

 

[Fedaykin311]

The only way to recover overwritten data is to send the drive to a data recovery company. They remount the platters and scan the drive with an electron microscope.

Unless his emails are with more than 5 figures, he's just SOL.

 

[bkch0]

The only way to recover overwritten data is to send the drive to a data recovery company. They remount the platters and scan the drive with an electron microscope.

Unless his emails are with more than 5 figures, he's just SOL.

They certainly do not remount platters or use electron microscope to retrieve data. LOL..

 

[pandemonium]

It is extremely unlikely those e-mails aren't actually recoverable since storage systems don't write over freshly deleted blocks immediately. Unless your co-worker is installing or storing tons of stuff all the time and this was a long time ago or the drive has sustained physical damage it's likely the data isn't retrievable.

Tell them to get a different data recovery program...90% of the time data can be recovered by software. The other 10% it will need to be sent to a data recovery service.

They certainly do not remount platters or use electron microscope to retrieve data. LOL..

Yes, they do remount drives for recovery. And not electron microscopes, but magnetic microscopes as it were. That's a pricey process however.

 

[Voo]

They certainly do not remount platters or use electron microscope to retrieve data. LOL..

Wait we don't restore it bit for bit? And just because we're storing several hundred GB per in^2? Pah No really they stopped doing that almost a decade ago - completely unfeasible with modern disk densities.

The first thing after overwriting data is NOT to use the drive anymore since the data isn't really overwritten but just the mappings. If he wrote data afterwards to the drive he maybe has already overwritten the data (and no, a FS doesn't distinguish between "recently used LBAs" and others, so it's just luck), otherwise he should just use several recovery softwares and try what he finds.

 

[kmmatney]

Well, that's why you have backups. If this guys hard drive suddenly went bad, he would have also lost all his emails. Just common sense to backup your hard drive every once in a while.

I don't know much about OSX, but it sounds like the data rescue software (they now have a version 3) is the best thing to try. If that doesn't work, then he's probably out of luck.

 

[taltamir]

My co-worker in Hong Kong made a terrible mistake when attempting to import all of his data from the mail client that comes with Snow Leopard into a new corporate Gmail account

uh... what? Gmail stores all the emails on the google servers. What did he actually DO, because I am not quite getting it.

And what makes you think the data was overwritten as the title says?

 

[imagoon]

uh... what? Gmail stores all the emails on the google servers. What did he actually DO, because I am not quite getting it.

And what makes you think the data was overwritten as the title says?

When you get a corporate gmail account, you can push your old enterprise email to gmail, IE via 'reverse' IMAP where the client pushes the email up rather than pulling it down. We have done it with several migrations. Likely he changed the settings in the email client and wiped out his local mail store. You have to run the push first as some applications with delete the local mail store because it syncs online in only 1 direction.

 

[taltamir]

When you get a corporate gmail account, you can push your old enterprise email to gmail, IE via 'reverse' IMAP where the client pushes the email up rather than pulling it down.

Actually I did that with my home gmail account. I simply added my gmail account as IMAP to thunderbird and then copy pasted all my emails to the gmail inbox and sent directories from their respective directories in thunderbird; did the same with my dad, and for a friend I did it with his outlook...
POP has directionality (which can't be reversed). The way IMAP works its not technically reversing, you just get direct server access which allows copying to it as well as reading from it. That being said, thank you for that simple and direct explanation, I think if I was clueless about what IMAP was it would have helped... but I am not confused on what IMAP is, I am confused about what the OP is saying happened.

Likely he changed the settings in the email client and wiped out his local mail store

How exactly though. He says it was wiped by "creating a new account", he says the DATA was overwritten (secure erased? zero filled?) and that he tried data recovery that isn't getting it. If the data is on the server via IMAP than there is nothing offline for him to overwrite.

You have to run the push first as some applications with delete the local mail store because it syncs online in only 1 direction.

With IMAP local storage is temporary at best, so I can see how local data was wiped... but why would...

Ok let me see if I am getting it.
Lets say he has a gmail account called account1@gmail.com I am thinking:
1. He created a new account called account2@gmail.com
2. then he went and deleted account1@gmail.com
3. then he went to thunderbird/outlook and removed the IMAP of account1@gmail.com and set up an IMAP of account2@gmail.com... where he expected all his emails from his deleted account1 to magically be transported to account2 because he had both set via imap on the same thunderbird/outlook instance? Only instead he found out that there are no emails stored locally anymore. Hence the "overwriting" and "can't be recovered"... they were never actually THERE. IMAP means that the NAMES of emails are stored locally, data is only retrieved if an email is viewed and only held temporarily, the data is permanently stored on the server...
Is this what happened?

If the above is the case than there is absolutely nothing he can do locally to retrieve it. If he already contacted gmail and they got back some of his emails, well thats all he would ever get back.

That being said, it is possible to manually configure a program (like thunderbird) to download all emails and keep a copy of them locally when using IMAP. If you do that then there is local data to theoretically recover, however it would indeed get deleted if you delete the account in thunderbird/outlook... But it would not be secure erased. IF he actually set it up to store local copies of all emails then there is data to recover, the problem is finding it. I am not sure exactly how such local copies of IMAP account emails would be stored locally and whether the program he tried would be able to find and recover that.
Just because something is plausible doesn't mean that there are commercially available to tools you can purchase to do it. Then again, maybe there ARE tools who can do that... IF this is the specific situation he has then this indeed would be a good place to ask. I would like to know though which program he was using, whether my assertion of what he did is accurate, how long ago it happened, and whether he modified the local storage settings from their default values.

 

[Voo]

I think he didn't use gmail before but had a different solution (any email server with POP activated?). And while pushing those emails onto gmail, he accidently deleted them.

PS: And you can interestingly configure gmail to use POP and not save your emails, though I don't see many advantages from that.

 

[taltamir]

I think he didn't use gmail before but had a different solution (any email server with POP activated?). And while pushing those emails onto gmail, he accidently deleted them.

The question I am trying to ask is "how exactly". We can't really make suggestions if we don't know.

PS: And you can interestingly configure gmail to use POP and not save your emails, though I don't see many advantages from that.

Yea, I was aware. I totally agree with you about not seeing any reason to do that.

 

[Beebu]

His old email address and new email address are the same, but the new one is using gmail. When he went to set up imap, he just made changes to his original email account instead of adding the new gmail account to apple mail to copy his emails over. By changing the original account, it wiped all of the existing emails. Im typing this on my phone, so I apologize if anything sounds messed up.

 

[taltamir]

His old email address and new email address are the same, but the new one is using gmail.

Understood, google lets you use custom domain names if you have them. I actually use that feature myself.

By changing the original account, it wiped all of the existing emails.

That just doesn't make any sense. He might have accidently wiped out all emails but its not "by changing the original account". it would be by deleting the account on the original host.

Basically very little changes about my assessment of what happened (only a superficial detail changed; the name of the account. But that makes no difference at all whatsoever). My assessment of what he did is:
0. he had email account1@company1
he then:
1a. (1a or 1b can be done in either order) created a gmail corporate account to create a gmail account that is the same (also account1@company1)
1b. (1a or 1b can be done in either order) Deleted the account1@company1 from the previous host provider.
2. (optional) Changed his IMAP setting on his apple to account for whatever differences in server or password were made (since it uses a custom domain it is plausible for the IMAP address to remain unchanged)
3. Got surprised that all his emails are gone.
4. Contacted the previous email hosting company, from which he deleted the account, and recovered 30 days worth of emails.

Ok, anyone knows what the local storage settings (default and optional) are for apple mail on IMAP? Does apple mail allow you to set it to store all IMAP messages locally and is it the default? Because my guess would be that it wouldn't (which means that there is nothing that can be done to recover the lost emails)

PS. If you don't know what you are doing, don't try and play IT. Get a computer tech to do things like that (or learn before doing... and make backups). Anyone who has the tiniest clue how those things work would have not made the series of mistakes he did.