Completely ghosted hitachi drive. any chances to recover ?

[kaetano]

Hello,

I've got a similar problem to a previous 2004 topic, but instead I have mistakenly cloned two identical drives with Norton Ghost. The 2 drives are exactly, completely, identical 40gb ide Hitachi Deskstar. Obviously I did a disk to disk copy in the wrong direction and ended up with files dated back until 29 july 2005 and with much grief I've lost 5 years of mail in my .pst mail archive. I've tried to recover PST files with Getdataback, R-studio, derescue and so on with no luck. All the PST files that I find have mail that end in the year 2005. I even browsed with an hex editor the entire disk extracting all sectors that belonged to an ms office archive file but same old 2005 stuff.

I'm afraid that I've completely overwritten new data with old one.

Is there any chance to recover my pst files? Or a particular software/hardware that is capable of stripping off from the platters the latest "image" or layer of data to recover previous layers? Thanks,

Kaetano

[poehere]

There is a senior member BlackST here on the forum and he is from Italy. You might want to try contacting him on this one. He is very good in your case and can either offer some suggestions or help you in this recovery of your files if it is possible to do so.

[BlackST]

If you have cloned sector-by-sector , you have overwritten all and there's no chance at all.

If you have made disk from image, then the answer is "maybe".

Assuming it is "maybe", if you want a one-click solution, the answer turns to "forget it". Data reconstruction from fragments "maybe" is needed, but it is a time consuming, human based and with no impiclit guarantee process.
Actually I have done it many many times , had big success rate but there is risk of only "partial" success (that may be sufficient in most case).

About this :

"Or a particular software/hardware that is capable of stripping off from the platters the latest "image" or layer of data to recover previous layers?"

it is sci-fi, even if it was possible with advanced magnetic microscopy or SEM analisys, are you going to spend million $ on it just to get your Outlook files ? At present nobody can do it.

[kaetano]

To better explain how dumb I was: not only I cloned a disk of the same model and geometry, but also with almost identical file and partition structure. The 2 drives were already clones, I regularly use Ghost to make a backup copy. I usually use the partition-to-partition feature but that day I'm pretty sure I've made a disk-to-disk copy. Is this a sector-to-sector copy? I know that Ghost has a specific option for sector-to-sector copy, but I never used it.

So I have 2 disks with 1 NTFS partition and identical number of file and dirs and directory layout. Since the only file modified was "archive.pst" am I right that I have almost overwritten that file? And that if the original archive.pst was bigger - lets say 200MB - and the one overwriting it 150mb, I have 50MB of fragments all around the disk with no reference to where they belong? So the only feeble chance is to search for those fragments and try to glue them piece bye piece, is that what you mean by fragment reconstruction?

thanks for the quick reply.

kaetano

[BlackST]

On GHOST as far as I know on the versions I used, usually a "disk to disk" copy doesn't clone sector by sector (unless you tell Ghost to do so).
I should see the DRIVES (both) to judge.

[kaetano]

Hello,

I only have the "original" drive, the one I've overwritten. The stuff I've lost is mainly work related so I can surely live without it, so it's only for the sake of "knowledge" and also because I have a keen interest in data recovery that I'd like to see what can be done. Surely the stuff is not worth the effort I've already spent. But given this case, the only thing to do is to seek professional advice? Nothing I could do by myself?

[dobrevjetser]

Get a good hex editor and start puzzling


Dobre

[BlackST]

Ah be' allora....

Ah, so then...

[kaetano]

You mean that comparing the two drives is useful? But for what?

ps.
i'v tried with a hex editor, and I was able to reconstruct some pst files but containg even older stuff.

[phishin_ca]

comparing the two is useful to determine exactly what was overwritten. You should be able to find some snippets of the lost text from that. Works for forensic analysis, but I am not sure you are going to find "Exactly" what you are looking for.