"Pro" hard drive recovery

[pixeltarian]

Hi, I have a friend (also happens to be my boss) who needs some photos recovered. Just to put the dire need in perspective:
they had been taking a photo of their newborn every week, and this HD is the only place the photos exist (besides the now full-of-new-images SD card).

I tired NTFS getdataback, and a few other recovery applications and could find the image files, but they were all corrupt. I couldn't view them in anything. I even tried to fix the image headers with data from good images.

It was the system drive with windows XP pro (NTFS) on it.

He gave the computer to his brother in law to put windows 7 on it. personally, when I work on people's computers I always ask "are you absolutely sure there's nothing you need off this HD?!" and I'm probably more offended than I should be that this guy didn't ask that.

so at this point:
- drive has been formatted
- new OS has been installed
- I'm about 8+ hours into reading about recovery options with seemingly no light at the end of the tunnel.

He now wants to take it to the geeksquad.
so... I have a few questions about where to go from here:


1. Will the geeksquad do anything beyond trying recovery programs?
2. what are they going to do that I can't do with the help of google and forums?
3. if they most likely can't do anything, is there a next step?
4. if the US government knew that these images were actually maps that reveal the location of public enemy #1, how would they go about retrieving the data?

any and all help would be insanely appreciated. I feel really bad for the guy. yeah, he will get a big lecture on how to make sure this never happens again, and no I won't do this much running around for him for free if it does. I just know him and his wife and feel like it's a pretty rotten situation.

thanks again,

~ Jeffrey James

 

[John_VanKirk]

Hello,

First thing I would look at is copying all the files from the SD card to a folder on a good HDD, and see what you have. Might all be there, depending on how big the card is.

You might try PC Inspector, to see if it will find any of the files on the now repartitioned, formatted, and OS installed HDD. It can locate files without headers and may be able to extract some files.

Anytime you repartition and quick reformat a HDD, you remove the directory structure to locate old data. If you fully format a HDD, you write over the data on the drive. When you install an OS, and begin writing to that HDD, you overwright the old data with new files, and the more you use it, the more new data gets written over the old data. So the best thing to do if you have a failing or bad mechanical drive, is not to reformat it or write anything to it until you've thoroughly exhausted every way to copy off the data.

There is nothing more the GeekSquad is going to do to find images on a reformatted drive more than what you've done.

There are commercial (expensive) companies that can attempt to extract data from a bad drive. Usually they charge $100-$250 to examine the drive, and then north of $1000 to actually extract data. Several names are DRG, OnTrack, and Convar.

 

[Paperdoc]

You could try one thing. Given the history, a lot of space at the very front of the HDD has been overwritten with new data. So, even if your recovery software finds an old directory listing with a reference to where a file started, any near the start of the HDD will likely have the wrong data.

However, there is a remote possibility that other files farther into the HDD have not yet been overwritten. So you could try GetDataBack NTFS (or some other tool) again and concentrate on files farther down the list. IF it's possible (I don't know - depends on the software tool) you could set the data recovery software to look ONLY in the Free Space of the disk. That is all those areas that have NOT been assigned to new files by the new OS and the new directory structure that have been installed. Just maybe, if the Format operation was NOT a Full Format, those data file remnants may be there.