It looks like she done the recover already... (so it's not hanging): As per that information: It recovered but like a new computer.

Before recovering I would usually check the disk surface, using chkdsk or similar.

Electrical spikes and hard disks/bios's are not a good combination.

Any bad sectors could lead to further issues in future and the OP being back at square one. If the disk has bad sectors it's only a matter of time before more appear.

Just over writing it with a recovery disk could mask problems.

I would suggest replacing the hard disk in that case (lots of bad sectors.)

Oh and buy a surge protector.

I'm sure it's okay but a lesson for others "Check the disk surface before restoring"

if you want to recover any data from that PC, do not turn it on any more! I have got 2 programs that I use with a lot of success to recover data etc. The website is www.spotmau.com and the program you need to recover data is Super Data Rescue Package

Everytime you switch on, you risk the disk area being overwritten, so leave it as is and go out get an USB Hard drive. You will need it to recover data later on.

It is not very expensive and it does the trick. You get to download the program and burn it to a CD and then just boot it with the CD. So get that external HD ready.

another one I use quite a lot is the disk clone, that will take an image of your HD and you can then use it to restore. I will use it to clone a new computer once I get all my programs installed so I don't have to spent 2 days of my life to put everything back. Once I get an image, I can use autosync program to get my data back while i go do something else.

The data clone also has a feature for wipe data, so you can use it to clean your HD before selling it. I not tried to recover any data from such function so let me know if any of use can!

I would love to recover my data but its been a while and I don't even remember what I would have on that drive that I need. I did install it into another computer and there was no data. It wasn't a windows drive, it was formatted as another filesystem. I don't remember the details.

Is there a tool I could run on the drive if I put it back into my junk computer? (if that computer even boots, lol). My drive may be broken and formatted.


i hope you're able to recover your data

use the data tool I mentioned earlier, all you need is to hook up the hard drive to another computer (in an external case) and boot the system up using the CD. Let it run the recovery and then see what it recovers. This might take a while. So best to run it on a spare machine! I have had a recovery gone over like 2 days!

Has anyone here *actually* recovered an erased partition which has had a new partition and file system slapped on top of it by the recovery process ? The files have been overwritten, the NTFS metadata has been overwritten and so has the partition table. I guess not judging by the answers. Undeleting is one thing, salvaging from an overwrite involves highly sensitive recovery hardware that can read the platters at various write history levels. It is very expensive and time consuming.



Please do not confuse the OP , or get the OP's hopes up.

You CAN NOT undelete files from an NTFS partition once the NTFS meta data areas have been reset/recreated by a partition and format which a recovery process does and once the rescue partition has been restored. These recovery processes invariably use imaging techniques which overlay /overwrite all the critical system areas, and nearly always involves re-partitioning and re-formatting. Undeleting relies on NTFS metadata still being here which may hold starting cluster and EOF records, as well as possible previous file names. The old entries will exist and allow recovery unless overwritten /reused by new file meta operations such as files being created, renamed or moved etc. Re-formatting completely destroys the NTFS meta data and any chance of logical recovery. Re-partitioning complicates matters even worse.

Imagine writing very hard on a notepad , tear the top page off and you can still see the faint impression of what you wrote underneath. Recovery hardware can do this 13 levels deep on the disk platters with each level holding different data. This is what is required to salvage (not undelete !) the data. Ultra secure permanent erase programs rewrite disk blocks 25 times to ensure that they cannot be read. Re-formatting and partitioning is akin to throwing the notepad away to software programs which have absolutely zero control over the read resistance on the drive heads which is required to control which write layer is read by very special read write heads that simply do not exist in normal hard disks.

Not all the old NTFS meta data has been overwritten.
It is very, very simple indeed, provided the process has't written every single block as part of recovery. I have not seen a recovery process that does this.

The file rescue program scans every block on the disk, looking for blocks that might be meta data, interpret them as though they are meta data, invent a file name, fill in missing information, collect the contents, write it to an external disk. Worst case, you are left with 1000s of files that could be your data with random meaningless names. You can then use "grep" on the files, or the linux "file" utility to separate files based on content, give them an extension, and look at photos one by one, rtf documents one by one, etc.

The last time I did something like this it was 6 years ago.

I also, many years before that, I recovered a book from a Amstrad disk, by assembling raw blocks, not using any meta data. Once you know what the book is about, just grep for keywords, zero out blocks that are obviously garbage in the working image, etc. I just gave the author random blocks of text which they reassembled in a flash into the correct order. You can scan blocks for jpg magic numbers, etc.

What I normally do is zero a hard drive before I re-use it, this way, it is much easier to recover data from a partially full disk if there is a problem.

I would advise saving the disk. It is amazing how much easier recovery becomes when computers get bigger/faster. Things like photos have a good chance of beng recovered in future.

So my advice is keep the old hard drive as is, clone it, and try these tools on the clone. Try again with the latest tools in 10 years time.

If the drive was re-partitioned and re-formatted, then nothing is left. Image restores replace every block in the NTFS system areas. Every block is re-written.

Well, with NTFS being a log based system, there is a reasonable chance these programs can recover stuff, just by scanning for contiguous blocks and magic numbers. I can believe that all master file tables are lost. Perhaps there are directories, which are just files in NTFS, in the log aren't they? Anyway, assume there aren't any directories even.

First thing to do is create a negative image. All blocks currently allocated to files on the disk, after this HP restore, including partition tables and meta data need to be written with zeros, in the negative copy, and all other blocks, perhaps 80 to 90% of the disk, which is still intact, copied over. Now run over that, looking for files starting on 4K boundaries (if it is a modern optimised disk), then zero them out, after copying them over, invent a file name. Keep scanning the disk for recognised intact objects, and copy them over.

Things like an uncompressed tar files are a real boon, as boundaries are fuzzed compared to placement on the disk, and you can piece together fragments in the log that were split, copy one over, zero it out in the negative. Each time you pull out something from the negative, it increases your chance of finding more boundaries. This is why these programs iterate, and take days to recover stuff.

So perhaps 80% are the data is still there, and as tools get better, more and more of it will become accessible, provided you just run recover on an image, leaving the original disk intact.

that's all very well, but as a novice home user the op doesn't stand a chance, we also have no idea what the pc's own recovery utility did, did it just copy windows back, did it totally re-partition, format and then copy, did the op re-partition sometime in the past etc etc

the bottom line here is, Op, unless you are willing to pay a professional company to do the data recovery for you then the chances of you getting anything back are slim, and every time you turn the pc on the chances get slimmer.

__________________
https://starkindustries.ch/
http://www.swissr2.ch/
http://www.tk16431.com/

I have with FAT32, and many computers and harddrives are still delivered with FAT32 formatted disks. In fact, I can't recall ever having one that I've not had to convert.

Exactly-
We don't know what it did- I initially suspected what the other user said (all lost because of the HP restore) but I was thinking maybe it's a simple "system restore" from windows.


You are right, chances are slim but try "recuva" does not harm to much-
Anyway I doubt they will go for a professional restore because it's deadly expensive.


In all case the summary of that topic is obvious:



So the best solution is prevention (ie do regular backups
backups
backups
backups
backups
backups
backups)

Clone the drive with a gparted live image CD (not downloaded on this PC) onto a new external drive, swap the external for the internal, or just unplug the internal and boot over USB. grab a beer and relax. Save this time capsule for now. Your son could be a computer PhD in future. Who knows.

If there isn't a program that does all this today, there will be in 5/10 years.

This is an HP laptop with a recovery partition. NTFS is mandatory. No new internal hard disks are formatted FAT32. You need to go back and think that claim over, all are delivered unformatted from the factory, sold in unformatted sizes. HP do not sell laptops with FAT32. Maybe you mean USB pen drives ?

@P42 - a little knowledge is a dangerous thing, NTFS logging is meaningless here, you really have to grasp the fact that no NTFS metadata is logically readable by a driver after the format and re-partition, any attempt to read NTFS system areas will read the new NTFS area which has no information about the old NTFS filesystem. As I said before, to read previous sector details you need expensive equipment. All the recovery options mentioned will only work if nothing else had been written to those areas.

From HPs site:

"After running a recovery, my programs and files are gone


That is to be expected. As mentioned else where, the recovery process deletes all the files on the hard drive and installs only the original programs and drivers. Before running a recovery, users are prompted to back up their files to a memory stick or DVD or other external storage device. Files that were deleted during a recovery cannot be restored. Also, any new programs or updates were deleted and must be reinstalled. "

Tom

This is because HP recovery involves restoring a factory image of the Windows system. This requires NTFS and involves deleting the old partition, recreatign it, formatting it and then overlaying the image. It works well. The recovery partition can be kept as a hidden partition on the drive and involves very little effort to get the PC hard drive back to it's factory shipped state.

Once those image blocks have overwritten the old blocks, un-delete,un-partition and recovery programs are rendered useless. Recovery involves removing the platters and placing them in a bespoke drive that can read the previous layers of the magnetic surface. Very expensive, very time consuming.

It may be true of recent HP's and indeed recent HDs - but certainly not of older device- which the OP's may well be. For the benefit of other readers of this thread, if a harddrive is a few years old, then there is a reasonable chance that the disk is FAT32 and therefore may be more easily recoverable than a NTFS formatted drive.

Older machines running XP or Win98 , with drives less than 4GB.

This is not the case here. The mere mention of a boot up recovery procedure involves NTFS and Windows 7/Vista.

ah geek fights, much better then bitch fights lol

How long do these restores take?

I have never used HP restore. The restore processes I have used were not dependent on drive size. It would take 7 hours to properly erase a 2TB drive, at a typical 60mb/sec. If it took less than a few hours, the data is likely still there.