Un-move? files

[obiwaynekenobi]

Hey guys, my girlfriends motherboard went out. When she got it RMA's by asus she was re-installing and had a small problem

The windows install setup didn't detect her SATA drive, just the IDE. so she accidently removed the partition that had all of her data backed up on it.

So the question is if I can't undelete the partition, Is there anyway I can recover the files that were marked as "Moved" instead of deleted from the NTFS file system off of the main drive? She had a lot of Taxes and various iformation that she has lost that we would like to recover.

Thanks

~obi~

 

[myocardia]

I don't know which works the best, because I got my first CD-RW before this type of software ever existed. But, here's a Google search for you: undelete freeware, and here's another one that may or may not be more useful: recover partitions Good luck, maybe she won't be too mad at you. Maybe you won't even have to sleep on the couch tonight.:laugh:

 

[Lord Evermore]

I'm not really sure what you mean by files that were marked as "moved". There's no such thing as far as I know. A file can be marked as deleted, or if you move it to a new folder, it's just recorded as being in that folder now.

It's not really clear which drive you're referring to as the "main drive" either. If the SATA drive was the original boot drive, I'd assume that's the main drive, but then there shouldn't have been any problem recovering the files from it, but I wouldn't expect her personal files to have been stored on that drive.

If of course she actually installed Windows on top of the space on the drive where this partition was, then her data is lost unless it's important enough to pay hundreds or thousands of dollars to a data recovery company to attempt to get the data out, by using methods to read the magnetic fields of the bits extremely closely to find the original data. A few random files might be recoverable, if they happened to be located on part of the drive that has not yet been overwritten, but every moment the drive is being used reduces the likelihood that it can be retrieved. Anything that's within the large area that Windows takes up, or its pagefile, or any areas where any files happen to have been written temporarily, none of the old files will be recoverable anymore, except maybe partial files.

 

[obiwaynekenobi]

Originally posted by: myocardia
I don't know which works the best, because I got my first CD-RW before this type of software ever existed. But, here's a Google search for you: undelete freeware, and here's another one that may or may not be more useful: recover partitions Good luck, maybe she won't be too mad at you. Maybe you won't even have to sleep on the couch tonight.:laugh:

heh she was the one that did it, I woke up to her quiet upset about it.

Iwill try the recover partition tonight see if we can save it.
I tried the undelete freeware and came up with nothing.

 

[obiwaynekenobi]

Originally posted by: Lord Evermore
I'm not really sure what you mean by files that were marked as "moved". There's no such thing as far as I know. A file can be marked as deleted, or if you move it to a new folder, it's just recorded as being in that folder now.

It's not really clear which drive you're referring to as the "main drive" either. If the SATA drive was the original boot drive, I'd assume that's the main drive, but then there shouldn't have been any problem recovering the files from it, but I wouldn't expect her personal files to have been stored on that drive.

If of course she actually installed Windows on top of the space on the drive where this partition was, then her data is lost unless it's important enough to pay hundreds or thousands of dollars to a data recovery company to attempt to get the data out, by using methods to read the magnetic fields of the bits extremely closely to find the original data. A few random files might be recoverable, if they happened to be located on part of the drive that has not yet been overwritten, but every moment the drive is being used reduces the likelihood that it can be retrieved. Anything that's within the large area that Windows takes up, or its pagefile, or any areas where any files happen to have been written temporarily, none of the old files will be recoverable anymore, except maybe partial files.

I apologize, it was really late/early and I was still half asleep when I wrote it.

She has two HDD's the first main drive is a Sata Drive. This was the drive she wanted to format. The secondary drive was an IDE laptop drive that she had a converter for so it would run in her desktop PC

What happened was, she got the board back from Asus, I went to bed and she put her system together. (Yes, I have a geek gamer Girl, be jealous) I woke up to her quite upset because the only drive that showed up that she could install windows on was the IDE laptop drive, not the sata. She had deleted the partition and then realized it was the laptop drive. (It was 12:30 in the morning it was late and she was tired mistakes happen)

The reason why this is a big deal is because this is where she had all of her data backed up on. Although in the past I've done Burn back up before I've done a F&R. We didn't think much of it at this point. so we just didn't do it.

Anyway I'm digressing.

So the problem is that we need the data that was on that drive, I'm afraid that now that she's removed the logical partition to the laptop drive that the data is just gone. I'm hoping to find a way to recover the data on that deleted partition. I'm afraid of recreating the partition and formatting it, that it would make it even harder to recover the data.


the reason why I was asking about "Un Moving" Files is because all of the data that was on the laptop Drive was Moved from the Sata drive. When you move or delete data the clusters that were used are just marked. this is what makes it so you can undelete files I was hoping that there was a way to recover the files that had been marked as "Moved" Un delete programs don't look for moved CRC's just deleted ones.

 

[Lord Evermore]

Well, you've got a pretty decent shot of recovering the data from the IDE drive, since it sounds like the realized in time what she'd done, and didn't actually write any new data to it, just deleted the partition.

Recovery software (as opposed to just "undelete" software) might be able to locate and read out the old file table, and locate the files using that (it'll have to store the files on another drive as it recovers them). Failing that, it actually scans every bit of the drive, looking for file structures that it can use to estimate where a file used to exist. So even if the MFT is unusable, it should still be able to get the data. However there's always a chance that some bits of it won't be recovered properly for some reason, so there could be some corruption of the files.

As for retrieving the files from the SATA drive, that's unlikely. Once they were moved from the drive, the space became available for use by the OS, and it was probably overwritten since then. Even if you could read the MFT and get the file locations for the ones marked Moved, the actual space on the drive has probably been reused at least partially. I'd never even heard of this marking as Moved thing, since as far as the drive is concerned, if you move it from one drive to another, you've deleted it.