Quote:
For the first point, you are not right. A data cleaning could clean the "unused mft entries", just creating new files that would occupy those entries.
Maybe, but even then a good data recovery software would still find those dummy new files... For instance I've sometimes found doing recoveries (those are past experiences, which can be as relevant as new experiments) a bunch of files with names like "
ZZZZ.ZZZ", and found out that those files were created by CCleaner while doing some of its wiping operations (not that "clean" I would say...).
Quote:
Also, the disk was formatted / restored. Same partition size, new, empty MFTs created in the same place, overwriting the old ones. Again, wanna know for sure, do experiments.
I'm figuring that the former situation was : Windows 8 install + a few added softwares + personal files (probably hundreds or thousands of them) ; and the new situation is : Windows 8 install (with only the default softwares supplied with that computer) and nothing else, so it wouldn't be enough to overwrite all the previous MFT records (considering that a comfortable space is reserved for the MFT when an NTFS partition is formatted).
In similar situations in the past I've been able to recover many files in perfect condition, and some more would appear in the directory tree even if they were no longer readable (actual data being overwritten). I've had a situation where someone had a Windows install, installed Ubuntu over it, then re-installed Windows over Ubuntu, and the drive had bad sectors all over the place, and with ddrescue + R-Studio I was able to recover most of the personal files intact from
both filesystems ! (And I was generously retributed with a bottle of washing machine soap – environmentally friendly ! – and two half-broken bowls... that was two and a half years ago for the sister of my former neighbour... my second tough case of the genre...)
Quote:
For the rest, the hard disk is already messed with, so people cannot know that happened in it to tell you, mostly so without having the hard disk in hand. And this is already a case where the money involved will not pay for the desired solution, so better to cut the losses shorter now.
Well, it can still be worth the effort to earn some knowledge, if not money... but thanks anyway.