[LS_Dragons]

As many of us have done, I recently had a major UH-OH moment. As in UH-OH, where the hell did my "E" drive go. I tried to do a dual boot install of LINUX and ended up hosing the MBR of my C: drive - which held the database entries for my dynamic volume (the long gone E drive). Anyway, I finally gave up and just reformatted the E drive and actually ended up installing WinXP onto that drive (long story - but I had to do that to get it to format). Then deleted everything from E: so I had a blank 80GB drive. That 80GB drive was where I had EVERYTHING - My Docs, My Pictures, My Downloads, My P*RN :-) , My Everything. I came across a recommendation for FILERECOVERY for Windows - and decided to give it a shot. 4 hours later - ALL MY STUFF IS BACK. HIGHLY RECOMMENDED!
http://www.filerecovery.com/index.htm

LS_Dragons

[gamehead200]

If you formatted your E drive, then how did you recover your stuff?

[speedz]

WOW. Pretty god damned amazing...

[LS_Dragons]

It was not only formatted - but XP was installed on top of it. This application does a deep scan on every sector on the drive and can piece the sectors that make up each file back together. Formatting does not destroy data - just re-initiates the file system - that data is still there. I have found a couple of items that when I tried to open - would fail. But, I recovered over 500 files. If only a few are 'bad' out of that many - I will take it. If I had used this application after only formatting, I would likely have had 100% success. I did not mention that before I used the application - I had started to re-use the drive, so I had saved new data to the drive. That messed up the success rate a bit. All in all - I am very pleased.

LS

[MSNwar]

Nice.

I may enroll in the Computer Forensic Boot Camp.

Been thinking about this for a few months.

[Snoop]

ouch no way i would pay 60$ for that prog!
would rather back up my hardrive

[zipp51]

Looks good LS, I could have used that prog many times over.Glad you got your stuff back.Thanks bud.

[LS_Dragons]

Elite - I agree with you.... a backup is much cheaper. However, as I did not have a backup (I was actually using that drive as a sort of back up - I didn't install ANYTHING to it) I figured a recovery program was worth it.

*cough* By the way.... I did not pay $60 for it *cough*

Hey MSNwar -- I noticed that stuff about the computer forensics. If you do it, I would be really interested in your experience. Sounde very interesting

LS

[HashDump]

LS,

Isn't it incredible the things we discover in times of disaster that was brought upon by our tinkering w00t

The file recovery proggy looks like a great tool to have.

[FthrJACK]

i have R-Studio, it does the same thing and more besides. To those wondering how they work, when you delete something you dont actually delete it, its just marked to not show up in your OS. its still on the disk, but its been marked as "ok to overwrite"
otherwise every time you deleted a file your hard drive would spend time clearing the info off the drive - not very efficient.

[MSNwar]

FthrJack is correct. Another method is one that Norton uses. It changes the first didgit of the file name. But it has to be installed before the recovery.

If you really wanted to make the contents of the hard drive impossible to recover you have to 0 Fill (zero fill) the hard drive. Magnets work good to.

LS_Dragons. I'll let you know. I will converse with them tonight or tomorrow. They offer the class in Clearwater, Florida and the U.K.

FthrJack, do you know anything about their courses?

[Drewdatrip]

So if formating a drive in DOS doesnot set it all to Zeros...how do you?
And is it better...are there any benifits?

=Drew

[MSNwar]

Drew, zero fill utilities are available from the hard drive manufacturer's web sites.

from the PCguide.com,
When most users today talk about "low-level formatting" a drive, what they are really talking about is doing a zero-fill. That procedure will restore a functional drive (that is, one that does not have mechanical problems) to the condition it was in when received from the factory. There are occasions when a modern hard disk can become so badly corrupted that the operating system cannot recover it, and a zero-fill can help in this situation. Stubborn boot sector viruses for example can be hard to eradicate without resorting to low-level intervention. Since the zero-fill cleans all programs and data off the drive it will get rid of almost any data-related problem on the drive, such as viruses, corrupted partitions and the like. Just remember that it's a bit like burning down your house to get rid of termites: you lose everything on the drive.

Guide

info from Seagate
Click Here

Seagate Download Page for Disk Wizard (formerly Disk Mgr)
Disk Wizard Starter Edition

I use the above zero fill utility for all major manufacturer hard drives.

[Drewdatrip]

Thankx for the info mate...
A few other things....
Any benifits? performance? etc etc?

=Drew

[MSNwar]

Sooner or later all hard drives will start loosing data to a certain degree. The physical armature inside the drive slips and no longer aligns with the disc sectors. As we know, the data is within the sector. Error messages often alert us to this fact without an internal examination of the drive. Such as file not found. Maybe a utility is unable to locate a partition one minute and the next minute the problem no longer exsist. Same with the file not found error message.

The fix is to create a new MBR, set new partitions, and reformat the drive. This configures a new geometry and the armature will function properly until slippage occurs once again. Drive fitness programs are available to analyze the hard drive state and make corrections as necessary. In any event, when a low level disk operation such as zero-fill is implimented we loose the data, yes, but we also obtain a hard drive with a longer life span. I guess that might be a benifit. Performance is obviously improved since read and write data is no longer interrupted due to the new geometry.

One advantage of the zero-fill utility is related to WinME. People that upgraded to WinME from Win98 and later decided to dump ME and move back to 98. People that used a WinME boot disk to reformat and reinstall Win98 executed an uneducated error. The WinME Boot disk will perform the operation, but with errors unknow to the average user. M$ unknownly (maybe) did not inform us that the two boot disks were actually incompatible in a technical sense. The end result is a hard drive with a slightly different MBR. Basicly, the hard drive contains the MBR for WinME and the OS is Win98 in the end. Not compatible in the true sense. This phenomia is realized when users start receiving MBR errors without justification. Partition Magic 6.0 and up will correct the MBR, but it is a manual procedure. Herein lies the solution, the zero-fill utility free from the disk manufacturer. Like pcguide put it, we loose everything, but the drive is laid out in a blank state awaiting a new MBR, etc.

wew

[LS_Dragons]

****! Thanks MSNWar -- now we ALL know everything we need regarding Hard Drive Health and Maintenance. Excellent summary. Now - how long before FthrJACK pipes in to elaborate and show off his great knowledge on the subject. :-)

LS

[MSNwar]

LS_Dragons, on Dec 6 2002, 05:39 PM, said:

Now - how long before FthrJACK pipes in to elaborate and show off his great knowledge on the subject.  :-)

LS

Now worries Bro. Our kung fu is better than his. w00t

[FthrJACK]

you could use ghost to transfer a lot of data onto the disk a few times, try get as much to the disk capacity as possible.
about which courses? pc forensics? id love to do a course like that

[MSNwar]

FthrJACK, on Dec 7 2002, 02:08 AM, said:

about which courses? pc forensics? id love to do a course like that

filerecovery.com also teachs PC Forensics courses, which looks very interesting. I hope to take the basic course within the next six months. Personally, I would prefer to take the course in the UK.

I asked around and a PC Forensics Specialist earns $25.00 an hour.

[FthrJACK]

why do it here?
i think you just like touring europe bud heh