What are my chances of recovery please

[Musical]

Hi,

My brother has a laptop and Im reasonably sure its a 60Gig drive (approx). 256 RAM. No partitioning. The long and the short of it is he doesnt save much stuff at all except some AVI's and JPEGS. The drive is, going from memory, at least 75% Free.

 

Now, he deleted some JPEGS about a year ago or a tad more and Ive been meaning to help him to try and get these back, as hes not that tech savvy. You know how it goes, sometimes things just slip by you and its not until now that this scenario has come up again. SO after googling about recovery options I've only just seen that you guys also have software to hopefully deal with this. Ive been using CCCleaner for years.

 

Ive told him not to save anything on the computer and use it as minimally as possible until we at least give it a go. I know its probably too long now, and Im thinking about 2 questions .... wouldve temp files from surfing the net overwritten these JPEGS by now? and wouldve the swap file done the same???

 

Ive also DL'd a utility "Restoration" and tested it on my system to see if it could recover some random different file types. I was able to successfully get Word Docs and PDFs and txt files way past a year old, from both my C partition which is constantly 75 to 80% full and my D drive as well. JPEG seem to be the hardest to recover. I was able to go back on my system which I use heavily and recover at least some. This was sporadic though and in windoze explorer some things had 0 kbs but showed a thumbnail. Others had certain Kbs showing but showed no thumbnail . Go figure. : /

 

Any help greatly appreciated

Musical

[kroozer]

It's anybody's wild guess what the odds are of recovering those files. Why not simply install Recuva and find out? Takes only a few minutes.

[Musical]

I wont be going to my brothers for 2 days so it'll have to wait until then. Im trying to find out whats possible if anyone can shed any more light ...... some utilities can recover even files that have been overwritten????

[hazelnut]

Also have a little read here

 

http://docs.piriform.com/recuva/introducing-recuva

[marmite]

Im thinking about 2 questions .... wouldve temp files from surfing the net overwritten these JPEGS by now? and wouldve the swap file done the same???

Hi Musical

 

The bottom line is that it's not the age of the files that is relevant. As you have already alluded to, it's the amount of data that's been written to the files in between time that is the crucial factor.

 

The swap file is in a fixed location (unless of course he's recreated or moved it). But almost any other file written to that disk (like temp internet files, software patches/upgrades, software temporary files, log files etc) could have overwritten the old photos.

 

You will see some files listed that aren't in a good enough condition to recover, as you have already discovered running Restoration.

 

As kroozer says, best thing to do is to suck it and see. I'd set Recuva to deep scan and just see what's there. hazelnut's link and the documentation around it has all the info you need.

 

Also, download the portable version and run it off a USB stick ... otherwise the Recuva installation will overwrite some of the space.

 

No software will recover files that have been completely overwritten.

[Musical]

Thanks Hazelnut for the link, and yes Id read most of that section but not specifically the part you linked to.

 

Thanks Marmite for your very imformative post ! especially about the swap file. Nope he wouldnt know what one was much less change it, so thats all good. However in this case the biggest issues of concern (from my understanding ) are the internet temp files whilst surfing and the lack of defragging in the past. ( NONE ) and he's had the computer a couple of years. Fortunately I dont think they will have had for quite a while any updates from the Free Avira which Im on also and which we will dump VERY shortly as its become absolutely ludicrously impossible on dialup to DL the massive file (30 odd MBs! ) to stay up to date, but thats another story.

 

Yes I will run the executable from off of my USB Flash Drive.

 

May I ask, Marmite, what you mean by "completely overwritten" ...like, is there a certain amount of complete "passes" that happens before it is deemed unrecoverable? How would fragmentation play into this, in that the file is in many places over the HDD due to the lack of defragging and which indeed is why I mentioned it as a possible problem. Hope Im making sense

 

Musical

[marmite]

May I ask, Marmite, what you mean by "completely overwritten" ...like, is there a certain amount of complete "passes" that happens before it is deemed unrecoverable? How would fragmentation play into this, in that the file is in many places over the HDD due to the lack of defragging and which indeed is why I mentioned it as a possible problem. Hope Im making sense

Yep you're making sense

 

But no, I wasn't referring to the number of passes, I was referring to just parts of the file being overwritten as opposed to all of it being overwritten. Once data is overwritten no software can read it what was there before, as I said earlier.

 

However you might get a scenario where, completely by chance, a file is partially overwritten by some process or other leaving the file 'semi-intact' to the point where 'a' file can be recovered, but it won't be quite the original. So depending on what type of file it is, you might get something that's enough to get what you wanted from the remainder of the file. I've seen this randomly happen with jpegs ... where you get part of a picture. But getting a usable file is extremely unlikely.

 

And indeed to all intents and purposes it's not worth considering ... really I was just being unnecessarily pedantic. Where a file has been overwritten properly by secure deletion software (as in the software does it's job!) then a file won't be recoverable at all, even after just a one-pass overwrite.

 

The lack of defragging on your brother's machine may increase the chance of some recovery ... but as people have said it's really down to how much use it's had.

 

PS ... and I take it you have another drive that you can recover files to (like an external drive, or even a USB stick if you don't need too much space) ... Recuva doesn't restore files 'in situ'!

[Musical]

"Where a file has been overwritten properly by secure deletion software (as in the software does it's job!) then a file won't be recoverable at all, even after just a one-pass overwrite."

 

If Im understanding you correctly in that its only securely deleted files that cant be recovered by any software, Im just talking about ordinarily deleted files by firing it in the rubbish tin, as in theres no way my brother wouldve "securely deleted" these files. Does this make a difference?

 

Wow, thanks for the explanation about the fragments! If youre thinking youre being unecsessarily pedantic well it was to my advantage how else does one learn?.

 

"The lack of defragging on your brother's machine may increase the chance of some recovery ... "

Obviously Im not understanding this correctly. Would you care to explain this a bit more?

 

Yep I know about restoring to another means so as not to write over anything on the C drive. My flash drive is 4 Gigs and plus theyve a 4 gig one too so we should be sweet. I dont think there were GBs and GBs of piks.

 

and thanks for your prompt replies Marmite, I really appreciate it.

 

Musical

[kroozer]

"The lack of defragging on your brother's machine may increase the chance of some recovery ... "

Obviously Im not understanding this correctly. Would you care to explain this a bit more?

Defragging involves moving files - which may move them directly on top of those files you wish to recover. This process overwrites the original files and when that happens they are gone forever, kaput, terminated, unretrievable.

[Musical]

Yes kroozer thats what I wouldve thought but perhaps Marmite has a further explanation or Ive misunderstood something (which isnt hard for me to do where computers are concerned) .

[marmite]

"Where a file has been overwritten properly by secure deletion software then a file won't be recoverable at all, even after just a one-pass overwrite."

 

If Im understanding you correctly in that its only securely deleted files that cant be recovered by any software, Im just talking about ordinarily deleted files by firing it in the rubbish tin, as in theres no way my brother wouldve "securely deleted" these files. Does this make a difference?

Mentioning secure deletion was in the context of talking about 'complete passes', which you had mentioned in your previous post. The number of overwrite passes is often used in the context of secure file deletion. Secure deletion is a way of making a file irretrievable, and it's usually used when you deliberately want to make sure you can't recover a file.

 

But it's not the only way that a file becomes irretrievable. As long as the data gets overwritten by other data then you won't be able to get it back. At the moment you permanently delete a file in Windows (by emptying the Recycle Bin for example) then the data is still there on the drive, but Windows has removed it's pointer to it so as far as you're concerned it's gone. However because that area on the drive hasn't been overwritten yet you should, at that moment in time, be able to get the file back.

 

From that point on though, as far as Windows is concerned that area of the file is 'free space' - there's no file there as far as the OS is concerned. To a large degree it's then pot luck as to whether and when that area of the disk is overwritten. The more disk write activity that takes place the greater the chance that the file will be completely or partially overwritten. As I've mentioned before you can get partially overwritten when, for example, new files are written over that top of deleted ones. Files are different sizes ... so you might get a small file which goes bang in the middle of where your original was, or you may get a huge file that obliterates it completely.

 

"The lack of defragging on your brother's machine may increase the chance of some recovery ... "

Obviously Im not understanding this correctly. Would you care to explain this a bit more?

Exactly wot kroozer says. The less the drive has been disturbed by disk writes, the greater the chance of recovery. As far as defragging goes, deleted files constitute free space, so as part of the defragging process the places where the deleted files are could be overwritten by the blocks (undeleted files) that the defragger is moving around. So if the drive hasn't been defragged then that's better for your recovery chances.

[Musical]

OK guys I see many times on many forums people dont bother to post results (for better or for worse) when theyve been helped. I think that shows a lack of appreciation. So here goes...

 

The deep scan was run from my 4 Gig USB flash drive. The results brought up just over 6,000 picture files and most were just remnants of webpages and most said were excellent for recovery.

 

I started saving ones he picked out onto this as well, but after going through about 2000 piks I just copied the lot onto a new USB Seagate 500 Gig External that was still in the wrapper.. with the view that he could peruse them all in a more timely fashion, because he was a bit confused as some of them we recovered he thought were actually on the HDD afterall.

 

However, the good news is I was able to recover the very 1st piks he did with his 1st camera!!!, though I still dont know how many he initially deleted and how many of those he'll recover. I had absolutely no idea as to what he needed to recover as the files are only allocated a number according to the search I believe, and theres no date and they seem to be in random order chronolgically. You had to just work your way through all of them in other words. Still beggars cant be choosers and its amazing any turned up at all!

 

So all in all I think this looks likely for a success story given those 1st licks coming up. : ).

 

Thanks for your help

Musical

[marmite]

OK guys I see many times on many forums people dont bother to post results (for better or for worse) when theyve been helped.

Yep that's quite often true, so thanks for letting us know

 

Glad your recovery effort seems to be going fairly successfully.

[mr don]

I wont be going to my brothers for 2 days so it'll have to wait until then. Im trying to find out whats possible if anyone can shed any more light ...... some utilities can recover even files that have been overwritten????

 

Now, if they have been over-written, it may be hard to recover. Handy Recovery cannot recover from a secure wiped drive, but it can recover from password protected user accounts, deleted files, deleted/changed partitions, RAW/lost partitions, etc. I used it and it is great! Just need the full version to be able to recover. I believe they have a version 1 for free, but vers 3 & 4 are both far more powerful.

 

Other options to try are... System Restore back to a working date, or try to remember if there is a backup copy/zipped archive with the same data somewhere on the drive. System Restore may not work if the files are in the My Documents folder(s) as they are protected from changes made during restore, I believe!

 

Hope this helps!

[Musical]

Hi Mr Don,

Thanks for your suggestions : ). Yes my brother had them in My DOcuments. Not sure if you read all the posts but it looks like a success story and Im pleased about this as I really wasnt expecting to recover anything at all, much less the 1st photos he'd taken! I havent got back to him about how much he's sorted through and recovered as this time of the year is pretty busy.

 

Musical