Runtime’s Data Recovery Blog

Folks, we need to be serious about this. A recent survey shows that 40% of hard drives bought on eBay hold personal and even worse, corporate data.

When you give a computer to a friend or co-worker, or even sell it, it still has all of your data on it. Even if you format the drive. If you do not believe me, try it for yourself. Take a drive with data on it that you no longer need, format it, then run GetDataBack. You will see all of your data. This will not work however if you are using Vista.

Vista has changed they way a format works and now does a low level format. You can find this information at http://support.microsoft.com/kb/941961. This is good and this is bad. If you accidentally format a drive in Windows Vista, that data is gone forever. Not even a hardware recovery company can recover the data for you.

We are going to show you how to use DiskExplorer to low level format a drive so that no data can ever be recovered from it. This is useful when you want to give a drive to someone or sell your computer. You will low level the drive, then install Windows. None of the data that was on the drive can be recovered.

WARNING - THIS WILL DESTROY ALL THE DATA ON YOUR DRIVE. IF YOU DO THIS BY ACCIDENT, THERE IS NOT A WAY TO UNDO IT. THIS IS A PERMANENT SOLUTION.

The full resolution video can be found here.

We have created a video tutorial regarding error 8000FFFF and how to fix it on YouTube. Here is the list of files that are needed to be run from the command prompt and they need to be run from the Windows\System32 folder. A high quality version of the movie can be found here (WARNING!! This file is 100MB in size).

• Net stop vss
• Net stop swprv
• regsvr32 ole32.dll
• regsvr32 vss_ps.dll
• Vssvc /Register
• regsvr32 /i swprv.dll
• regsvr32 /i eventcls.dll
• regsvr32 es.dll
• regsvr32 stdprov.dll
• regsvr32 vssui.dl - (For Windows 2003 only)
• regsvr32 msxml.dll
• regsvr32 msxml3.dll
• regsvr32 msxml4.dll
• Net start vss
• Net start wsprv

When recovering the data after Raid Reconstructor has finished and you have a virtual image, we give people two options; You can use GetDataBack for NTFS or you can use Captain Nemo.

If your controller card went out or you had a drive physically fail in a raid 5, then you can generally use Captain Nemo. Captain Nemo is a file system mounter. It’s only job is to mount the file system. If your file system is in good shape, then you will see your data and directory structures almost immediately and copy them at that point. If the file system is damaged, then Nemo will give you an error about the partition or file system and will not present you with any of your data.

This is where GetDataBack comes in. GetDataBack is a data recovery tool.

• If you need to recover deleted files, then you must use GetDataBack.
• If your file system is damaged, then you must use GetDataBack.
• If Captain Nemo give you any problems at all, then use GetDataBack to recover your data.
• If you see your data in Captain Nemo but can not see the files you are looking for, use GetDataBack.

Here is a breakdown of the differences between GetDataBack and Captain Nemo. You can easily see where and when you would want to use GetDataBack vs Captain Nemo.

Here is some good information for people using Shadow Copy and Windows XP. You can avoid having to reactivate XP by simply copying a file from your Windows directory and saving it on a USB stick, floppy drive, or CD. When you first activated Windows, XP creates a file called “WPA.DBL” and stores it in the C:\WINDOWS\SYSTEM32 directory.

Open Windows Explorer and click Tools>Folder Options

Click the view tab, select the following options

Go to the Windows\System32 folder and copy the wba.dbl file and save it a CD, floppy, or USB drive.

Now you can use Shadow Copy to copy the OS to another drive. Once it is done, boot into safe mode.

Click yes that you know you are in safe mode

Open Windows Explorer and go to the Windows\system32 folder, rename the exsisting file to wba.old and paste the saved file back into the folder.

Reboot and you do not need to reactivate windows.

Remember that this will only work if you use the WPA.DBL file on the same computer that it was originally activated on. If you install XP on a different machine and try to copy the WPA.DBL file there, it won’t activate. Basically, XP looks at the hardware of the computer to create a unique profile for just that one computer. If you change the hardware to many times, it will also not work as activation looks for hardware changes as well. This should easily work for a single drive change though.

Shadow Copy is a simple program that copies all files from one place to another. Other than usual file managers, such as Windows Explorer, it copies all files including locked and open files. This is made possible by using Microsoft’s Volume Shadow Services (VSS).

Today we are going to go over Shadow Copy. Locate the Shadow Copy icon on your desktop.

Start Shadow Copy and you will be presented with the following screen:

You will need to enter the source drive, the files you want to copy and the destination. In this example, we are going to copy all the files. You can limit the files being copied by entering in a file name (test.txt), the start of a file name (t*.*), or an extension (*.txt).

Once you click start, it will create the shadow and start copying the files. You can see the progress in the bottom bar.

Once the copy process is done, it will state how many files and the total size that was copied to the new drive.

Now you will need to set the partition active. Right click on My Computer and select Manage.

Then you need to go into Disk Management and find your drive you copied the data to. Right click on it, set it to active and you are all set. Shut the machine down, remove the old drive and boot up with the new one.

Tips:

* You also might need to set a new Disk ID using DriveImage XML.
* You will probably have to reactivate Windows and some other copy-protected programs.

Automate Shadow Copy

Shadow Copy can be run from the command prompt, batch or task scheduler. The available switches are:
Switch Description
/s copy subdirectories
/j parse junctions
/i ignore errors
/y overwrite existing files
/r overwrite read-only files

It’s free!

Since we do not charge for Shadow Copy, we do not provide any support for it. If you have problems with VSS, please check the DriveImage XML documentation and the DriveImage FAQ. If you want to boot from a copied drive, also check these resources. If nothing helps please check online.

There is a new version of DriveImage XML available today. We now have a new option on compression and we have made the software much faster.

Lets have a look. This was the old version backing up a 10GB NTFS partition that has 5.93GB of data on it. We were backing the data up to the My Documents folder on the C drive.

As you can see, it took about 12 and a half minutes to complete the backup.

The backup size of the dat and xml file was 5.28GB

Now we backed up the same data on an external drive with the same settings as :

It only took about 20 seconds longer, but this is a small drive with not a lot of data. Had this been 100 or 200GB of data, the extra time would have been substantial.

There are some new options on the new version. You have the ability to choose if you want fast or good compression. Fast is much much faster. Good is still pretty slow but it does a good job. We recommend that you always use the fast option.

So now we took the new version and backed up the same drive with the fast option and saved the data and xml in My Documents

Only 3 minutes and 15 seconds!
The file size is only slightly larger as well, but this will be different on everyone’s computer:

Now we will take the same settings as above and save the data to a USB 2.0 External drive:

Still only 4 and a half minutes!

A few things about the slow compression:

The slow compression is still faster than the old version by two minutes in our internal test.

The size is about 500 MB smaller than the fast compression, however this will again vary with the types of files you have and how many files you have.

!!IMPORTANT!! There are a few issues with the new version. The image you make on the new version is not compatible with the old version. If you have a BartPE with the old version, rebuild it with the new version as the image will not restore with the old software.

We do not offer any support for this software since it is free, however if you have an issue that you feel needs to be looked at, let us know.

Lets have a look at making a partial image in DiskExplorer. This is important when making an image of a drive with damage.

Lets start DiskExplorer:

Switch to hex mode my pressing F3 and go to sector you want to start the image at:

Once the sector is selected, press CTRL-SHIFT-END and it will select the sector you chose to the end of the drive:

Now, click on Edit>Copy to file:

Pick the file name and location and click save. You can see the size of the image at the top of the file location box.

If you have any questions, feel free to contact us at info@runtime.org.

This is because of our copy protection. There is an easy way to fix this though inside Vista and Server 2008.

When you start our software in Vista or Server 2008, you may get a screen that looks like this:

Click on the option to close the program. Then to fix this, you need to go to your run command and type the following:

You will be given the System Properties box. Click on Advanced -> Performance Settings:

You will then arrive at Performance Options. Click on Data Execution Prevention:

Click the add button and path to whatever version of our software you are using. We used RAID Reconstructor in this case. RAID Reconstructor should be C:\Program Files\Runtime Software\RAID Reconstructor\raid.exe. All of our software will be found in C:\Program Files\Runtime Software\.

Once RAID Reconstructor is in the list, click OK to close the Performance Options and OK again to close System Properties

Go ahead and start any of our software, and it should work with no problems now.

Q: What are the four options I am presented with when starting GetDataBack for FAT or GetDataBack for NTFS?

A: These options change the settings that are used when scanning the drive for data. Lets go into each one in detail.

Option #1 - I don’t know use default settings:

This option leaves all settings turned off. It does not recover deleted files, lost files, duplicate file names, and it does not do an excessive search.

Option #2 - Systematic file system damage, e.g. Format or FDisk:

This turns on none of the options as well.

Option #3 - Sustained file system damage, e.g. a new operating system was installed

This turns on the option to recover deleted files and allows duplicate file names to be recovered.

Options #4 - I want to recover deleted files

This also turns on the option to recover deleted files and allows duplicate file names to be recovered.

You can find all of these options by clicking on Tools>Options.

You can then click the environment tab for additional options.

Stayed tune for the next post. We will go over what each of the options really do.

Q: I have reinstalled Windows and all of my software, but I forgot to backup all my pictures and music before the re-install. Can you I recover that data now?

A: It really depends on how much data you had before you did the re-install and how much data you have written since.

When you reinstall Windows, it formats the drive. This takes all the clusters of data and marks them so they can be overwritten. The data is still on the drive after the format and can still be retrieved. The damage happens when you reinstall Windows. You need to follow all the directions as outlined at http://runtime.org/howto_datarecovery.pdf. When you get to step 3 of our software, the first thing that people assume is that since they can see the file name, the data is recoverable. This is an incorrect assumption. In the NTFS file system, the file’s name, size, date, time and the clusters used by the data are stored in the Master File Table (MFT) Entry.

When you test a file in the demo version of GetDataBack for NTFS, it reads this information and reaches out to the clusters of data that are used by that file and retrieves them. If those clusters have not been overwritten by the re-installation of Windows, then the file will be recoverable. However if the re-installation of windows has written anything to these clusters, it still grabs these clusters and you either see ascii characters in your documents, it will tell you it needs to convert the document or it will simply tell you there is no preview available.

Re-installing just Windows XP alone will easily overwrite 2GB. Windows Vista overwrites 10GB+. If you have a System Restore CD that you have used from HP, Compaq, Dell, Gateway, Sony, or whatever company your computer was built by, this does a considerable amount of damage. A Windows XP System Restore with all the demo software does about 30GB of overwriting, while a Vista System Restore does between 30 to 50GB of overwriting. This means any MFT entries that were in those locations are overwritten as well. This means you files, if those clusters were not overwritten themselves, will not have any file names, directory structures, or possibly the correct sizes and you will need to do a Lost File Recovery with our software to see if that data is retrievable.

I understand this is a lot of technical jargon to most people, but it important information to know when trying to do a recovery. If you have any questions, feel free to contact us at info@runtime.org.