[BBLISA] Recover files from formatted HD

[Edward Ned Harvey]

Nothing awesomely complex or unusual here.  A top executive has a mac at
home, with all his photos and junk on it.  He brought in his external hard
drive, and hooked it up to his dell at work.  Naiively assuming it would
work.  Windows says "new drive found" and "drive not initialized. Initialize
now?"  So he clicks yes.  Initializes and formats the drive.  All his files
are gone, he calls me for help, I take his drive away to prevent further
damage.  

Based on looking around, all the tools which recover formatted or deleted
files seem to perform regardless of past or present filesystem.  Since they
perform read-only at the block-level, looking for recognizable patterns
"this looks like a jpg" and "this looks like a .doc file" etc.

I actually bought an $80 tool, used it, recovered some stuff, but certainly
not 100%.  Just looking for other peoples' experience, to see if it's
better, worse, or same as mine.



> -----Original Message-----
> From: Ben Eisenbraun [mailto:bene at klatsch.org]
> Sent: Thursday, May 15, 2008 9:06 PM
> To: Edward Ned Harvey
> Cc: 'Back Bay LISA'
> Subject: Re: [BBLISA] Recover files from formatted HD
> 
> On Thu, May 15, 2008 at 08:55:26PM -0400, Edward Ned Harvey wrote:
> > It was a mac HD [...] that was initialized & formatted NTFS.
> 
> Those two pieces of information together, while not impossible, are
> definitely a bit unusual.  Can you give us any more info?  Were they
> running
> Windows on an Intel Mac?  Or were they using the FUSE NTFS driver under
> OS
> X?
> 
> I've used Restorer 2000 in the past to recover some data from a
> formatted
> NTFS filesystem.  It worked reasonably well.  You can download a demo
> that
> will run and give you an idea of what is recoverable.
> 
> http://www.restorer2000.com/
> 
> -ben
> 
> --
> if stupidity got us into this mess; then why cant it get us out?
>                                                    <will rogers>