My buddy had his Time Capsule wiped...

[cdstelly]

It's a sad story, (please read the full version on his reddit if you have a minute:
http://www.reddit.com/r/AskReddit/comments/kw5w8/why_would_a_hacker_do_this_my_heart_hurts/)
but my good buddy had his Time Capsule hacked into and wiped about two days ago. He really, really needs his pictures back. He's already written a ton of music back to the capsule before he realized his pictures were gone.

Any possible advice? I'm trying to surprise him with good news when I go to his place..

Many, many thanks,
C. Stelly

[cdstelly]

Found out that the wipe occurred twice, the first time only music was deleted. Then he put music back on, and then EVERYTHING was wiped, which is when he lost his pictures. He hasn't written anything to the drive since the wipe.

[drc]

So, no new data has been written to the drive since the data you are looking for was lost?

[cdstelly]

So, no new data has been written to the drive since the data you are looking for was lost?

Correct!

[labtech]

Then there is hope to recover something.

[northwind]

Agreed. Give it to a pro in your area and they will most probably recover most of the files.

I read in that link you provided above, and if i understand correctly, your friend actually witnessed his files disappear out of the blue?
If that is so, then whoever did this, actually deleted the files and didn't wipe the disk using any fancy technique (like DOD etc).

If that is true, and no new files have been copied to the disk after deletion, chances are on your side. Most of the files will be recovered.

Good luck!

[rmy]

For pictures, run a linux liveCD and try photorec.
Be really carreful to NOT WRITE WHAT WAS RECOVERED ON THE SAME DISK.

Good Chance.

EDIT : Photorec also runs under windows/OsX, but with automount disabled or read/only mount of your disk under gnu/linux, you are safe and don't take the risk of writing on it again before recovery done.

And BTW : Congratulations, and happiness in advance.

[cdstelly]

Agreed. Give it to a pro in your area and they will most probably recover most of the files.

Thanks! Going out today to find one for a reasonable price.

Photorec also runs under windows/OsX, but with automount disabled or read/only mount of your disk under gnu/linux, you are safe and don't take the risk of writing on it again before recovery done.

Wonderful news!! Thanks!

If anyone knows of a reputable recoverer in the Lafayette/Baton Rouge/New Orleans area of Louisiana, USA, please let me know!

Thanks guys.

[drc]

I have spoken with pcrecovery a few times. I think they should be up to the task and seem to be right in your neck of the woods.

[rmy]

cdstelly, if you can't find someone near you offering service at affordable price, contact me via Private Message. If you have a quite good internet connection, another hard disk for recovery and 1h to make config, I should be able to do that remotely connected to your computer. It's a boring mission, but I really can understand what you are living because I've done the same before I mary. BUt I was'nt able to recover pics before the day. That's one of the reasons why I'm now involved in DR.

[Touchclarity]

He's already written a ton of music back to the capsule before he realized his pictures were gone.

I think chances of success are slim...