Industry guru Dave Taylor offers tech support on technical and business topics, including iPhone, iPod, Microsoft Windows, Sony PSP, cellphones, online advertising, CSS, Web design, business, Unix, Linux, SEO, Mac OS X, and shell script programming.     


How do I restore data from an overwritten partition?

The scenario: My primary hard drive (HD1) became infected beyond the capabilities of adware & spyware tools, AV, or firewall. I then transferred my important data files to (what I thought was) a storage hard drive, (HD2). Thinking that I had designated a second hard drive (HD2) as the storage drive, I reinstalled WIN XP Home SP1 from CD, and then installed SP 2 from CD onto HD1. Then I went looking for my saved data files. I could not find HD2 using Windows Explorer. So, I opened the case, only to find that HD2 was not connected to the system or power. Thinking back, I remembered that I had partitioned HD1 and used the large partition for storage, not HD2. Ok, now you have the story. Stupid mistake.

Having sufficiently, verbally abused myself for such an arcane move, I moved on with data recovery. I installed WIN XP Home SP1 from CD, and then installed SP 2 from CD onto HD2. I am now using HD2 as primary, and have disconnected HD1 from the system and power. I need to know how to proceed to recover as much of my data as possible, much of which is several folders of JPEGs. I have a copy of Encase 2004, which I understand is very strong, but I am intimidated by the warnings in the 300 page, online manual.


Dave's Answer:

Two potential avenues of solution for you, from the expert team that we here call the Friends of Ask Dave Taylor...

I would use GetDataBack to recover the data. If the user is now able to boot from HD2, he can run this from the Windows environment.

If not, they have a plug-in (http://www.runtime.org/peb.htm) that will work
with BartPE. Bart PE will give you a pre-boot windows environment. This utility allows you to create your own bootable CD-ROM by extracting the necessary files from your Windows XP installation CD.

PE Builder lets you add other applications by using "plugins". You can then recover the files to a local drive or even to network storage if that is an option.


You probably don't realize what Encase is. Encase is a very pricey computer forensics package, but one of the best. Used by a large number of state, local, and federal law enforcement computer investigators, amonst many large companies and forensic consultants. Anybody that doesn't know how to use it has certainly pirated it.

And a bunch of jpeg's. On a PC loaded with spyware and viruses, suggesting not the cleanest browser history I've seen. Hmm... Sounds like you might really be asking "how can I recover my porn with software that I stole?" :)

Not to mention Encase is not the right thing for the task. It's not designed for data recovery purposes.

But I'll give you the benefit of the doubt, just this once.

It sounds like you formatted and installed Windows over the top of your backup drive. Had you just formatted it and then realized the mistake, the data would be relatively easy to recover. Now that at least some of that information has been overwritten on top of being formatted, things get much more difficult. I would suggest Ontrack's EasyRecovery software as one of the leading data recovery software packages.

If Ontrack can't recover it, it's a case for a professional data recovery shop who have loads of expensive specialized equipment for jobs like this, and most don't charge anything if they can't recover the data. They generally have more than a 90% success rate, but it's typically very pricey (several hundred dollars at a minimum).

Thanks to Tommy Martin and Chris Buechler for their answers.

More Useful Windows PC Help Articles:
✔   What's the easiest way to speed up my Windows PC laptop?
My Dell Windows 7 laptop is starting to drive me crazy. It's so darn slow! I've had it a few years and I...
✔   Can I force a Windows 7 OS system update?
Every so often Windows 7 pops up a window and tells me that there are updates. That's nice, but how can I force...
✔   Fix Google Drive (Gdrive) no longer supported (out of date)?
I'm a big Google fan and have been using Google Drive for quite a while as a cloud storage device. It's a breeze,...
✔   How do I open or unpack a RAR archive on my Windows PC?
I have some ".rar" files on my Windows 8 PC and am curious how to unpack them to see what's inside. From a...
✔   How can I shrink my Windows 8 Desktop file icons?
I've figured out most things in the new Windows 8 interface, except I can't see how to easily reduce or shrink the file...

Let's stay in touch!
Sign up for my weekly AskDaveTaylor Newsletter and you'll receive even more tech and gadget help right to your inbox, along with exclusive news and industry updates. It's good stuff. I promise!
    Enter your name: and your email addr:  








Reader Comments To Date: 11

Tim said, on October 20, 2005 6:27 PM:

Hate to start a flame here, but if you were using any flavor of UN*X or Mac OS X, this would not have happened. Whereas windows makes no destinction between different partitions and different physical drives, under UN*X physical drives are called hda, hdb, sda, sdb, and so on. Partitions are called hda1, hda2 (or in your case, hda1 and hda5) etc.

data recovery said, on January 14, 2006 8:55 PM:

Hello,

I suggest use EASEUS DataRecoveryWizard utility. Speaking about me, it was
easily able to restore deleted, lost file and unformat drive,
so I think you will also find it quite useful. Really recommended
tool, give it a try.

http://www.easeus.com/

Andrew said, on April 10, 2007 7:42 PM:

Hi,

I have two different questions!

1) What is a partition?

2) I have a Windows XP Home Edition laptop that will not boot. It also wont run safe mode and last config ect. I have the start up disk and changed the boot option to CD/DVD Drive first. Now it runs the cd inside(The Windows XP Home Edition Disk). I run the disk and it ask me some questions such as use recovery or reinstall the software. I do this then i get to a part where it says something about partitions and then i get lost and dont know what to do!

jihed said, on May 17, 2007 4:26 AM:

i just install xp and i get 40gb i make partition of disk but in the end i find jst 1 disk C: with only20gb what i can do
thank you

Janiffer said, on August 30, 2007 2:19 AM:

i had a partition problem in my hard drive i mean one of my partition lost among four and i used partition magic but it doesn't work out well. Atlast i made up my mind to go to some Data recovery centre and HDRC is the best i recommended. It was exactly what they recommended and they made me very happy with their 100% job. Head offs to HDRC. I can drop here their sites www.hdrconline.com if incase you want to log in.
janiffer

user said, on December 26, 2010 10:55 AM:

Sounds like you might really be asking "how can I recover my porn with software that I stole?" :)

Really? Helping the guy without showing off your knowledge would be a bit more polite..

Rashid said, on June 24, 2011 11:05 PM:

i have problem tha i have 4 partiton c,d,e,f and when i install xp on c, that i reboot my system d,e,f partiton not show..only one c partiton is shown and get whole hard disk in one partiotion i user easeuse sw but how the error overwritten partion...
so my queston is that how i recover my data through overwritten partion...

Yulja said, on February 9, 2012 12:15 AM:

There are many data recovery software, not only Ontrack. Frankly speaking, it is not the best one. When you can't recover data with it, just use any other - ZAR (the most configurable software), ReclaiMe (the least configurable), UFS explorer (one of the smartest software) and so on.

Innocent said, on October 20, 2012 12:05 AM:

Hi Dave,

Good morning. I hope you can assist with this:

If a file is OVERWRITTEN, can EnCase receover this 6 months down the the line on a reasonably heavily used computer?

Dave Taylor said, on October 20, 2012 11:43 PM:

"Innocent", no, I think that you're out of luck, especially six months later.

mahadev said, on March 29, 2013 9:18 AM:

i have problem that i have 4 partition c,d,e,f and when i install xp on c, that i reboot my system d,e,f partition not show..only one c partition is shown and get whole hard disk in one partition i user easeuse sw but how the error overwritten partition...
so my question is that how i recover my data through overwritten partition?

Starbucks coffee cup I do have a lot to say, and questions of my own for that matter, but first I'd like to say thank you, Dave, for all your helpful information by buying you a cup of coffee!

I do have a comment, now that you mention it!











I will never send you any unsolicited email. Ever.






Check This Out Too...

 
Look for Answers
Need Help? Ask Dave Taylor!


Follow Me on Pinterest

Find Me on Google+
ADT on G+
© 2002 - 2013 by Dave Taylor. All Rights Reserved.

Note: This web site is for the purpose of disseminating information for educational purposes, free of charge, for the benefit of all visitors. We take great care to provide quality information. However, we do not guarantee, and accept no legal liability whatsoever arising from or connected to, the accuracy, reliability, currency or completeness of any material contained on this web site or on any linked site. Further, please note that by submitting a question or comment you're agreeing to my terms of service, which are: you relinquish any subsequent rights of ownership to your material by submitting it on this site. My lawyer says "Thanks".
"Ask Dave Taylor®" is a registered trademark of Intuitive Systems, LLC.