Logical Recovery Techinque

[darkosski]

I got a call today, the guy on the other end of the line said he took his pc to a IT shop and the tech
backed up his my document then formatted the hdd reinstalled windows, quickbooks and some other apps because the drive was corrupted
his hdd is 30GB and has data from 2004.... it now has 6GB of free space. Which i believe means they copied alot of data back to the hard
drive. The owner of the systems say he can not find his quickbooks file and a very important document from his desktop

is there anything i can do to help this guy or is the data over written and gone... it may be a foolish question but im not a guru yet
and i dont want to get this dude hopes up....

I imagine the steps would be...

1 image/clone drive.....

2 run getdataback/r-studion on imaged/cloned drive

any input wud be appreciated....

[Eleg]

Your approach for finding surviving files (or fragments of them) is a sound one. Sadly you can't recover data which is overwritten. Then with only 6Gb free space on the drive, chances of finding any wanted files are slim.

If DR does not work, you might try other ways. E.g ask the IT Shop if they still got the backup. Maybe the tech for some reason didn't restore all files. Or maybe the files are in place already, but the newly installed QuickBooks program needs to be told where to find them.

[pclab]

Yeah, you can do the steps you say, but if the data was overwritten, then goodbye files.
Like someone said here once: Physics teach you that 2 things can't occupy the same space at the same time.

[DrFaustus]

Image Free Space, then run A Scanning util on that, & hope for the best.. chances are slim since the needed data more than likely did not occupy the last 6 gigs of free space,.... but hey you might get lucky.. don't forget to be write protected the whole time. since youi have very little free space to work with, & your chances are slim as it is.

[Bjerringbro]

Ohhh. I always run into this issue. Customers can't find random Quickbooks files in their image.

In this case, unless you're talking about a tiny QB file, it's probably been sliced into about 50 pieces and only 2 pieces remain. You can run GDB, or O&O whatever, get your QB signatures from filext.com, put them in Ontrack ERP etc.

Essentially you want to grab everything that exists on the disk.

I've found that in many situations, the customer just was looking in the wrong place for QB file in their image. Also QB databases can be repaired and rebuilt - That's not the engineer's duty!

[darkosski]

thanks guys for the input, i dint get back anything worth mentioning... so bye bye data....

[Bjerringbro]

I could have sworn I answered this about an hour ago . . . This is common. People look in the wrong places for QB files sometimes. About 80% of the time a customer says a file isn't there, it just wasn't where they thought, or they didn't look hard enough for it, or the name changed. Especially with QB files.

[mattbrad2]

I agree with Bjerringbro. I can't count the times a customer SWORE I didn't copy file X or Y only to find it the following day after they had a chance to calm down and actually search for the file. Quickbooks circa 2004 would have stored the data file in program files\intuit so the data may in fact be gone but definitely search for all QBW and QBB files. Could be a backup (QBB) file somewhere they can use instead of their QBW file.

[labtech]

Suggestion:
When a customer is looking for specific files such as quickbooks, it may be a good idea to inform him/her of the location path of the respective file when shipping the recovered data back to them. This can save a lot of headache and wasted time for both tech and customer.

[warnerr]

Given how full the drive is I agree that the data is likely restored back to the drive -someplace. (and everything overwritten IF it was formated- however as full as it is... I suspect possibly not really formated???? - examine 'c:/Documents and Settings' folder for multiple accounts) . the search function is usefull starting at c: with advanced options set for sub directories ,system files,hidden being included. *.qbw and *.qbb *.qba are good searches to try.