Data Recovery For A Reimage Computer

August 18, 2006 5:57 AM

I have a harddrive with Windows XP that was accidently reimaged. During the image process the partition table was delete and recreate, the drive was reformatted and the file allocation table is wipe. Data was rewritten to the drive. Am I screwed?

I've looked at numerous ask questions here, but all seem to revolve around bad harddrive. This harddrive is in working order and data has been rewritten to it.

I've tried GetbackNTFS, Security Live CD, TestDisk, and a couple others with not much luck.

Any

posted by bleucube to Computers & Internet (9 answers total)

Rough order-of-magnitude question: How much data (in terms of MB or GB) was on the drive before you reimaged it? How much are you hoping to restore? And how big is the new image?
posted by cebailey at 6:25 AM on August 18, 2006

...and how much data was rewritten to the drive?
posted by dance at 7:03 AM on August 18, 2006

I doubt any piece of software will help in this case. Most of them assume that (a) the partition table is still on the disk, just not active, or (b) that the file clusters haven't been overwritten. Point (a) obviously doesn't apply, and it's not clear if point (b) does.

If you primarily lost documents, one thing you can try is to search the free space of your drive for text. Here's what I might do:

1) boot into Linux
2) Use ntfsprogs to find the sector of the last allocated clustered on the drive
3) Use dd to copy from that sector to the end, saving it to a file on a different drive.
4) Run strings on the file and hope for the best.

Beyond that, you might have to send it away to a recovery specialist. Someone like these guys. But it will cost you anywhere from a couple hundred to a couple thousand dollars. The link I gave (which came from a quick google search) says they average $500-$800.

The most important thing to remember, though, is don't boot off the drive. Even letting Windows sit there idle will make it harder and harder to retrieve the lost data.
posted by sbutler at 7:32 AM on August 18, 2006

Response by poster: The full drive was roughly 6 GIGs with operating system and apps. I only need the MYDOCUMENTS folder which was approximately 40 megs.

The disk has been completely reimaged and other data has been copied to it. Total right now is 7 Gigs.
posted by bleucube at 7:35 AM on August 18, 2006

Response by poster: We have the drive hook up to a different box.... so it's not being booted.

Thanks for the help.
posted by bleucube at 7:36 AM on August 18, 2006

Sounds like you're screwed. Assuming most of your data was near the start of the drive, it has probably been overwritten by the new image & data. Short of serious (= v. expensive) recovery, it's gone. Sorry.
posted by blag at 7:51 AM on August 18, 2006

It was 6 GB and now with the image it's 7 GB? Oof. This is one of those rare cases where it might have been good if you HADN'T kept up with your defragging. I'd suggest using sbutler's method in the odd case that your "My Documents" folder was out toward the edge of the drive and the image didn't overwrite it. But I've got a pretty bad feeling about it right now.
posted by cebailey at 7:52 AM on August 18, 2006

Forget about it and move on. It's gone. IF there's any data that's recoverable, it'll be broken and so incomplete as to be unusable. At best, you'll be able to recover a couple of kilobytes of fragments. If it had been just a partition delete or reformat or data copy, you'dve had a chance. All three means your data is gone.
posted by Spoonman at 8:13 AM on August 18, 2006

How do you accidentally reimage a hard drive?
posted by reklaw at 12:06 PM on August 18, 2006