Data recovery on re-imaged PC

I had stored personal data on my office pc on the C drive. The other day the pc failed to boot (blue screen) and the IT department used Norton Ghost to bring the pc back to it's original state.

Is there any way of retrieving the data I had on the C drive (obviously it's not currently visible) with undelete software or has the ghost operation effectively wiped it all clean?

thanks

Re: Data recovery on pc re-ghosted

It depends on what type of imaging they carried out, and the only people who can tell you which type is the IT people who did it.

Basically, they could have done an exact copy in which case you are *mostly* snookered, or they could have done a copy which didn't take account of the empty space (can't remember the correct terminology) in which case you have some chance.

Think of a new PC with a mostly empty hard drive - if you were going to image it you could either copy the entire 60g (for example) including the 52g of empty space or you could just copy the 8g of usefull information. If they simply overwrote the file allocation table and wrote the first 8g (or whatever) back to the drive, then the files are still there in the remaining space. However, they may have been feeling very thorough that day and written the entire disk.

Google is your friend - go search for 'undelete' and 'XP' or whatever operating system you are using.

z

Re: Data recovery on pc re-ghosted

If they reimaged the PC from the Norton/Symantec Ghost image and did not retain any previously existing partitions then the answer is most likely no. If the reimaging process doesn't erase/rewrite all parts of the disk/partition then there may be a possibility that some files could be recovered but not easily. If the reimaging process does touch all parts of the disk/partition then all date is certainly gone. If in doubt and the data is very important then seek out a specialist disk recovery service provider for advice.

Why the hell did your IT department reimage the PC before trying to recover data first?!

Post crossed with previous one.

Re: Data recovery on pc re-ghosted

Podge

If they have reimaged it in such a way as Zag and Clubman pointed out then you may have a chance. However, I would strongly advise that you get your IT department to do this task. It is after all a company PC and they are the ones authorised to carry out such tasks.

You could point the IT department to try this free computer forensics tools http://www.e-fense.com/helix/index.php. You can download it onto as a CD and create a bootable CD using Linux. It contains a range of tools that may help.

I have to agree with Clubman why did they not recover the data themselves before reimaging the PC? Although I suspect that the IT policy is no data stored on local drives in order for the IT dept to get machines back up and running quickly by reimaging.

No doubt you also now know the value of keeping data on the network or backing up to another device.

C

Re: Data recovery on pc re-ghosted

Thanks for all replies.

There was no question of asking my IT dept to try and recover my files which were purely personal and which I should have backed up regularly onto a usb key but didn't figure on the pc failing.

FYI the reimaging took about 3 minutes so it probably didn't overwrite all the data on the drive but as has been pointed out it's probably not a good idea to load some software myself and hope to get away with finding the deleted folder.

Wouldn't mind , I'm always telling everyone else to back up and never bothered to backup regularly to a usb key. Also, I put the files on the local drive in case something went wrong with the network. Should have done it the other way round I guess!

Re: Data recovery on pc re-ghosted

The re-ghost of your partition/disk probably just rewrote the file table and copied over the files contained in the ghost image. As long as they didn't format the hard disk first (I suspect they didn't) you may be able to recover some files. I'm sure you should be able to find free undelete software on the web but you could, assuming your OS is Windows, try the demo from here http://www.active-undelete.com/ which will show you if there are recoverable files, although you need the full version to recover files over 64k.

D'oh! - I managed to inadvertently choose the wrong drive for a format operation and wiped my 128MB USB flash drive. However I found several useful recovery utilities on www.download.com which have allowed me to retrieve some of my files (search for terms like "hard disk", "recover", "undelete" etc). A key thing to remember in situations such as this is to try and avoid writing any new files to the drive before attempting to recover deleted files - otherwise the new files may clobber sectors that were previously used and militate against recovery of all data. Of course if you boot Windows then you don't have control over some of the files that will get written (e.g. event logs, other logs, pagefile etc.).

ClubMan said:

A key thing to remember in situations such as this is to try and avoid writing any new files to the drive before attempting to recover deleted files - otherwise the new files may clobber sectors that were previously used and militate against recovery of all data.

Click to expand...

Also, recover files to a different drive or partition so as not to write over other potentially recoverable files.

I've used a utility called Handy Recovery to recover files overwritten by pc imaging - (www.handyrecovery.com).

Chances are almost 100% that your data is still there - if i recall correctly the downloadable version of this will allow you to see what can be recovered and salvage 1 file.

For what it's worth the freeware Free Undelete 2.0 worked well for me in recovering my formatted flash drive contents (to another drive and before I had written anything to the reformatted flash drive).