Data Recovery

[Harry1980]

Hi All,

 

Not sure if I have posted this in the right forum. I have reimaged a laptop only to realise after, that the teacher has forgotten to back up a folder that was on her desktop. Is there any way that I can retrieve this folder?

 

Any help in the right direction will be most appreciated.

 

Thanks

[Steve21]

Best thing to do if you haven't installed too much yet, is just run a standard retrieval program over the whole disk.

 

Recuva should do a decent job at finding stuff, but it depends if the format specifically overwrote the part of the disk that was used to save it (Assuming it's a standard image you'd hope the same parts were blank before and after wipe)

 

Steve

[Harry1980]

Hi Steve,

 

Thanks for that. I have tried the software by scanning the C drive. It has picked up thousands of files. Majority of the files are coming up with a red circle and the status is unrecoverable. I have selected all the files regardless of status and recovered them. When it comes to opening the files they come up with various messages that I cannot open them. Please see photos below. I have also tried the files with the status as Excellent and they don’t open as well. It has also picked up files with the # and $ sign in front of the file names. Does that mean anything??

 

 

 

 

 

Is there any thing else I can do to recover these files??

[Steve21]

Red ones are overwritten by other files (Should give notes on the rightside), therefore the original data isn't there and isn't recoverable like that. The green ones should allow full recovery.

 

Ones with $# etc are generally temp files or hidden or recycle'd blahblah.

 

If most are showing red then you have a problem As the reinstall would wipe most of them and need professional recovery etc normally. Guessing it wasn't re-imaged with same image then? New one?

 

Steve

Edited September 29, 2017 by Steve21

[Harry1980]

I have tried the green ones and they don't open. I have reimaged the laptop with a new image.

[Steve21]

For none of them? They should do unless they have had bitlocker or something on it?

 

I mean in the example above the "Connect one" isn't a real file its a + so temporary/autosave etc, but if it's a normal file should

 

Steve

[Harry1980]

I'm giving the green ones another go at recovery see if that works. Also I've noticed that its picking up files from 2004 and 2005 which is quite strange because we bought this laptop about 3-4 years ago brand new!!!

[Steve21]

I'm giving the green ones another go at recovery see if that works. Also I've noticed that its picking up files from 2004 and 2005 which is quite strange because we bought this laptop about 3-4 years ago brand new!!!

 

That's the tagged date of the file though so downloads files etc could be older remember Or ones that were included in the original image as part of the OEM image etc etc

 

Steve