How do I restore data from an overwritten partition?

The scenario: My primary hard drive (HD1) became infected beyond the capabilities of adware & spyware tools, AV, or firewall. I then transferred my important data files to (what I thought was) a storage hard drive, (HD2). Thinking that I had designated a second hard drive (HD2) as the storage drive, I reinstalled WIN XP Home SP1 from CD, and then installed SP 2 from CD onto HD1. Then I went looking for my saved data files. I could not find HD2 using Windows Explorer. So, I opened the case, only to find that HD2 was not connected to the system or power. Thinking back, I remembered that I had partitioned HD1 and used the large partition for storage, not HD2. Ok, now you have the story. Stupid mistake.

Having sufficiently, verbally abused myself for such an arcane move, I moved on with data recovery. I installed WIN XP Home SP1 from CD, and then installed SP 2 from CD onto HD2. I am now using HD2 as primary, and have disconnected HD1 from the system and power. I need to know how to proceed to recover as much of my data as possible, much of which is several folders of JPEGs. I have a copy of Encase 2004, which I understand is very strong, but I am intimidated by the warnings in the 300 page, online manual.

Dave's Answer:

Two potential avenues of solution for you, from the expert team that we here call the Friends of Ask Dave Taylor...

I would use GetDataBack to recover the data. If the user is now able to boot from HD2, he can run this from the Windows environment.

If not, they have a plug-in (http://www.runtime.org/peb.htm) that will work
with BartPE. Bart PE will give you a pre-boot windows environment. This utility allows you to create your own bootable CD-ROM by extracting the necessary files from your Windows XP installation CD.

PE Builder lets you add other applications by using "plugins". You can then recover the files to a local drive or even to network storage if that is an option.

You probably don't realize what Encase is. Encase is a very pricey computer forensics package, but one of the best. Used by a large number of state, local, and federal law enforcement computer investigators, amonst many large companies and forensic consultants. Anybody that doesn't know how to use it has certainly pirated it.

And a bunch of jpeg's. On a PC loaded with spyware and viruses, suggesting not the cleanest browser history I've seen. Hmm... Sounds like you might really be asking "how can I recover my porn with software that I stole?" :)

Not to mention Encase is not the right thing for the task. It's not designed for data recovery purposes.

But I'll give you the benefit of the doubt, just this once.

It sounds like you formatted and installed Windows over the top of your backup drive. Had you just formatted it and then realized the mistake, the data would be relatively easy to recover. Now that at least some of that information has been overwritten on top of being formatted, things get much more difficult. I would suggest Ontrack's EasyRecovery software as one of the leading data recovery software packages.

If Ontrack can't recover it, it's a case for a professional data recovery shop who have loads of expensive specialized equipment for jobs like this, and most don't charge anything if they can't recover the data. They generally have more than a 90% success rate, but it's typically very pricey (several hundred dollars at a minimum).

Thanks to Tommy Martin and Chris Buechler for their answers.

Categorized: Windows PC Help (Article 4239, Written by Dave Taylor)
Tagged:
Previous: How do I set up a password-protected private blog?
Next: Need an exemplary publishing contract?

Subscribe!

Never miss another Q&A article! Click to subscribe:

Comments

Hate to start a flame here, but if you were using any flavor of UN*X or Mac OS X, this would not have happened. Whereas windows makes no destinction between different partitions and different physical drives, under UN*X physical drives are called hda, hdb, sda, sdb, and so on. Partitions are called hda1, hda2 (or in your case, hda1 and hda5) etc.

Posted by: Tim at October 20, 2005 6:27 PM

Hello,

I suggest use EASEUS DataRecoveryWizard utility. Speaking about me, it was
easily able to restore deleted, lost file and unformat drive,
so I think you will also find it quite useful. Really recommended
tool, give it a try.

http://www.easeus.com/

Posted by: data recovery at January 14, 2006 8:55 PM

Hi,

I have two different questions!

1) What is a partition?

2) I have a Windows XP Home Edition laptop that will not boot. It also wont run safe mode and last config ect. I have the start up disk and changed the boot option to CD/DVD Drive first. Now it runs the cd inside(The Windows XP Home Edition Disk). I run the disk and it ask me some questions such as use recovery or reinstall the software. I do this then i get to a part where it says something about partitions and then i get lost and dont know what to do!

Posted by: Andrew at April 10, 2007 7:42 PM

i just install xp and i get 40gb i make partition of disk but in the end i find jst 1 disk C: with only20gb what i can do
thank you

Posted by: jihed at May 17, 2007 4:26 AM

i had a partition problem in my hard drive i mean one of my partition lost among four and i used partition magic but it doesn't work out well. Atlast i made up my mind to go to some Data recovery centre and HDRC is the best i recommended. It was exactly what they recommended and they made me very happy with their 100% job. Head offs to HDRC. I can drop here their sites www.hdrconline.com if incase you want to log in.
janiffer

Posted by: Janiffer at August 30, 2007 2:19 AM

Sounds like you might really be asking "how can I recover my porn with software that I stole?" :)

Really? Helping the guy without showing off your knowledge would be a bit more polite..

Posted by: user at December 26, 2010 10:55 AM

i have problem tha i have 4 partiton c,d,e,f and when i install xp on c, that i reboot my system d,e,f partiton not show..only one c partiton is shown and get whole hard disk in one partiotion i user easeuse sw but how the error overwritten partion...
so my queston is that how i recover my data through overwritten partion...

Posted by: Rashid at June 24, 2011 11:05 PM

I have something to say, now that you mention it, but ...

I do have a lot to say, and questions of my own for that matter, but first I'd like to say thank you for all your efforts on this Web site by buying you a cup of coffee!

I do have a comment, now that you mention it!

How can I fix too little virtual memory in Windows?

How do I install Windows XP in Boot Camp on my Mac?

How do I download photos onto my Apple iPhone?

How do I convert WMA to MP3 audio files in Windows Media Player?

How can I add a Google search box to my site?

How can I put music on my Apple iPod?

How can I get my Nintendo DS to connect to the Internet?

How do I reset my Mac OS X administrator (root) password?