Recovering NTFS partition off repartitioned hard drive
 

Someone gave me their Maxtor 80GB hard drive to try to recover their files off of. It had an NTFS partition with Windoze EX-P. Apparently, some of the Windoze files got corrupted and wouldn't boot. He then reinstalled Windoze, reformatting the hard drive. I'm not sure he used the same partition scheme on it. He then gave it to me to try to recover his files from his previous Windoze installation. I put the hard drive in my Slackware box running a 2.6 kernel with NTFS support and proceeded to mount the NTFS partition. Looking over the partition, I concluded all of his files from his previous Windoze installation were gone, as only system files were on it. I then partitioned it as one EXT3 partition and fsck'ed it. It did find some errors. Someone told me that some of the data should still be recoverable from the original Windoze install. If this is true, could someone point in a direction as to recovering these files?

Thanks!
Josh

Just for the sake of illustration, if the files in question existed on Monday, but then the system became corrupted on Tuesday, and your friend reformatted the hard drive Wednesday, reinstalled XP on Thursday, and then he gave you the hard drive on Friday, my guess would be that without specialized tools, you are plain out of luck. I will emphasize that this is not my area of expertise, but I seriously doubt that a file on a corrupted system could survive both a reformat and a reinstall and then be recovered by "Joe Public", even if he was highly experienced.

There are data recovery services which can probably do the work for you, but it won't be cheap. I'm not trying to be negative but as I understand it, you need highly specialized tools, and need to disassemble the hard drive to do a very precise magnetic scan on the platter surface in order to recover any data, and even that's not guaranteed. Had your friend given you the drive sometime on Tuesday (using the same example) I'm pretty sure you easily could have recovered it - all you'd really need to do would be to mount the drive manually and retrieve the files. After the reformat and reinstall though, I would say that recovery would probably be out of reach to the general public. Anyone with better info - please post. -- J.W.

Thanks for the reply. That's kind of what I was thinking. The guy that told me there may still be data from the original install said he has a friend that works for the government that has been able to retrieve data from 15 formats ago! Of course, he also works for the government. I was just wondering if software like this would be able to recover files from Monday of your illustration. My understanding is that when he installed XP on Thursday, it would only permanently delete Monday's files that were on the same physical part of the drive that the XP install was being put on. Meaning, only some of the files would be, theoretically, partially overwritten or permanently gone.

So, there's probably no software way to grab what's on the surface of the disk? I don't know anything about this kind of thing. Even if he would've given me the drive Wednesday, after deleting partitions, I may've been able to recover it then. I know I've deleted partitions and then created them again with the same parameters and the files are all still there.

Josh

Josh -- well I just don't know whether that software would work or not. Along those lines, Yes, if you start talking law enforcement and/or federal agencies, their have the maximum data recovery resources that are available. Personally I'm somewhat skeptical about claims that it would be possible to "always" recover old data (when you overwrite data, to a certain degree, due to the fact that the disk is magnetic, there will be some residual magnetic charge from the previous data, sort of like a double exposure photo, where the older image is faintly visible. At some point though, like maybe an 8 or 9 exposure photo, it seems hard to imagine that the original data could be conclusively recovered. Just my opinion, this is not a statement of fact).

Perhaps your friend should give the disk to his govt friend. As I said, there are data recovery services available, but realistically, the more times data has been overwritten, the less likely it will be for the general public to get it back. Good luck with it either way -- J.W.