Archive for April, 2008

Four scenario options in step 1

Wednesday, April 16th, 2008

Q: What are the four options I am presented with when starting GetDataBack for FAT or GetDataBack for NTFS?

A: These options change the settings that are used when scanning the drive for data. Lets go into each one in detail.

Option #1 – I don’t know use default settings:

This option leaves all settings turned off. It does not recover deleted files, lost files, duplicate file names, and it does not do an excessive search.

Option #2 – Systematic file system damage, e.g. Format or FDisk:

This turns on none of the options as well.

Option #3 – Sustained file system damage, e.g. a new operating system was installed

This turns on the option to recover deleted files and allows duplicate file names to be recovered.

Options #4 – I want to recover deleted files

This also turns on the option to recover deleted files and allows duplicate file names to be recovered.

You can find all of these options by clicking on Tools>Options.

You can then click the environment tab for additional options.

Stayed tune for the next post. We will go over what each of the options really do.

I reinstalled Windows, can I recover my data?

Friday, April 4th, 2008

Q: I have reinstalled Windows and all of my software, but I forgot to backup all my pictures and music before the re-install. Can you I recover that data now?

A: It really depends on how much data you had before you did the re-install and how much data you have written since.

When you reinstall Windows, it formats the drive. This takes all the clusters of data and marks them so they can be overwritten. The data is still on the drive after the format and can still be retrieved. The damage happens when you reinstall Windows. You need to follow all the directions as outlined at http://runtime.org/howto_datarecovery.pdf. When you get to step 3 of our software, the first thing that people assume is that since they can see the file name, the data is recoverable. This is an incorrect assumption. In the NTFS file system, the file’s name, size, date, time and the clusters used by the data are stored in the Master File Table (MFT) Entry.

When you test a file in the demo version of GetDataBack for NTFS, it reads this information and reaches out to the clusters of data that are used by that file and retrieves them. If those clusters have not been overwritten by the re-installation of Windows, then the file will be recoverable. However if the re-installation of windows has written anything to these clusters, it still grabs these clusters and you either see ascii characters in your documents, it will tell you it needs to convert the document or it will simply tell you there is no preview available.

Re-installing just Windows XP alone will easily overwrite 2GB. Windows Vista overwrites 10GB+. If you have a System Restore CD that you have used from HP, Compaq, Dell, Gateway, Sony, or whatever company your computer was built by, this does a considerable amount of damage. A Windows XP System Restore with all the demo software does about 30GB of overwriting, while a Vista System Restore does between 30 to 50GB of overwriting. This means any MFT entries that were in those locations are overwritten as well. This means you files, if those clusters were not overwritten themselves, will not have any file names, directory structures, or possibly the correct sizes and you will need to do a Lost File Recovery with our software to see if that data is retrievable.

I understand this is a lot of technical jargon to most people, but it important information to know when trying to do a recovery. If you have any questions, feel free to contact us at info@runtime.org.