1TB Seagate Expansion Drive - Deleted Data Recovery

[Sheisty]

Background:
I have a 1TB Seagate Expansion drive with around 400GB of data. I have data in various folders, but the data I need recovered (estimated 25GB give or take) was in one folder. I deleted the data about 2 months ago, however since then I've written about 50+GB worth of data to other folders. I've also deleted 30+GB of data during the same time span.

I didn't think I would need the data. I had some hard drive issues (see my other thread) which might be beyond DIY, but as a secondary data recovery option I know most of the data needed was located on this 1TB Expansion Drive as well.

I'm pretty sure some of the data has been overwritten. However, it can't hurt to give folder/data recovery a shot. This drive has no errors and is fully functional thus if I understand correctly its just a matter of restoring the data through software.


Problem:
I don't have another 1TB drive to use as a clone. So I'm going to try to restore just the data I need to another drive without cloning.

I've been reading here about the following software:

Ontrack Easy Recovery
DMDE
O&O Disk Recovery
Winhex Forensic
Access Data UTK
R-Studio
Get Data Back
Recover My Files
NTFSundelete
Fat32 Undelete
Active Undelete


Question:
Should I eliminate any of these programs off my list as viable solutions? Also,

[networks]

Do you have the space to restore the data to a local drive like C:\ I assume this drive is D: or E: you can scan the drive for the missing folder and if found recover just that data to your local drive.

[Sheisty]

Yea I have more than enough space to restore the deleted data I need (if any still exists) on a different hdd. I just didn't have another HDD big enough to clone the entire source HDD. From what I read most people rather work with a clone than the source.

[Alt(R-TT)]

If the drive you want to recover files from is in pretty healthy shape, it's safe to recover data directly from it. Actually, that's nothing more than a normal work for the drive.
People here do cloning because most drives they are working with have some hardware problems. In such cases, cloning is necessary, often mandatory for not to loose the drive entirely.
I also recommend you to perform a raw file search on the drive if you don't find the files from the first attempt. Quite often OS overwrites file records but file data may still remain. This is especially important for Windows and NTFS.

[Sheisty]

Thanks for the explanation.

Quick correction, I said the 1TB drive currently has 400GB of data, it actually has less than 200GB of data.

So far I've used get data back to search for deleted files. I managed to locate some files but most of them were currupted . Which means they were already overwritten.

I'm going to use the second option to scan for deleted files and scan for lost files today. That option said 15+hours Depending on the results, I will use R-Studio, DMDE, & EASEUS.

I'm constantly adding large movie files 700mb to 1.47 GB and an occasional 4.3GB DVD, and deleting large bits of data as well on this 1TB drive. So im sure a lot of the data has been overwritten.

I'm not too clear on data deletion and save protocols. When data is deleted, and the hdd marks it as s,o does that put it inline for the next place for new data to be written? I've read mixed answers.

[networks]

I'm not too clear on data deletion and save protocols. When data is deleted, and the hdd marks it as s,o does that put it inline for the next place for new data to be written? I've read mixed answers.

When file is deleted its space is marked as "available" its up to the OS and HDD when the space gets re-used. How the area is selected is an algorithm and basis much of the time is how many sectors are required to save a file then HDD goes to get "available space" based on request. Based on the large amounts of data you are moving off/on the drive your correct in thinking a portion of the deleted data has already been overwritten. The more time and activity between delete and recovery makes recovery less possible. Win7 runs defrags frequently as well which does same thing moves data and overwrites potentially recoverable data. The fact you found some of the deleted fragments indicates your on the right track however your results are no surprise.

[Vulcan]

@Sheisty:
Regarding when data will be overwritten after deletion: It is completely an OS decision (strictly it's a filesystem decision, and that is part of the OS); I've been involved in this part of OS operation.

Direct-attach / SAN / iSCSI disks don't know or care what filesystem is being used by the host OS - it's all just LBAs to them, and they just write to whichever LBAs the OS (filesystem) tells them to. (Obviously NAS-attach devices are different, since the host OS has no direct block access to disk LBAs in such a device.)

Some comments about one thing you've said:

I just didn't have another HDD big enough to clone the entire source HDD. From what I read most people rather work with a clone than the source.

In addition to what Alt(R-TT) said, doing cloning first has some value even for "logical" recoveries - mainly to avoid consequences of human error, and bad luck. For example, risks when doing what appears to be a logical recovery, directly from the original disk, include examples like these:

- The problem wasn't really just a logical recovery, but this was misdiagnosed and what was occurring was actually the start of a physical problem e.g. Windows unable to shutdown causing chkdsk to be run on next start, and some files become inaccessible. User thinks this is a logical (filesystem) problem and starts recovery direct from that disk. In fact the disk was unable to read some blocks causing Windows to be unable to shutdown, and disk was actually deteriorating, but the problem was not correctly diagnosed. (I'm not saying this applies to you - it's just an example that I've seen - but your disk might start to fail at any time; that's what disks do!.)

or

- You're doing a logical recovery directly from an external disk, but not surprisingly you're nervous or doing the recovery somewhere unusual etc., and accidently knock over the external disk so that it lands on the floor. At that point, you've got a much bigger problem than the original logical recovery, because you're using the original external disk instead of a clone.

or

- You're doing a logical recovery and you use a program which allows you to choose any drive letter to save the recovered files onto. Unfortunately you choose the same drive that you're recovering from, as the place to save recovered files to, thereby overwriting potentially recoverable files in the free space on that disk (I've seen s/w which allows you to do this).

etc. etc.

There are several other such risks that I could point out. The overall summary is simply that while doing a logical recovery direct from an original disk can be done and might work fine, there are still some risks in doing so - that's because you're working with your only copy of that potentially recoverable data. It's up to you whether those risks are worth taking, considering the value of the data, the cost of a new disk to hold the clone, your perceived chances of human error and liklihood of the original disk failing during the recovery process etc.

[Sheisty]

Points well taken, thanks for the added insight.

[Alt(R-TT)]

I'm going to use the second option to scan for deleted files and scan for lost files today. That option said 15+hours

No shock. Large disk scans DO require a lot of time. So, get some patience.

Depending on the results, I will use R-Studio, DMDE, & EASEUS.

If you've got some questions about R-Studio, feel free to ask me. I'm from the developing team, so I can answer them.
Once more about disk cloning. From what you're telling us, your disk has neither hardware, nor logical problems, you just want to recover some files that have been properly, but mistakenly, deleted. So, it's in a pretty good shape. And drives fall during cloning, too.
And good luck in recovery.

[Vulcan]

@Alt(R-TT):

Once more about disk cloning. From what you're telling us, your disk has neither hardware, nor logical problems

In my experience, we can't be sure that all customers will correctly know the current status of their disks - or are all your customers also experts at correctly diagnosing their disk problems?

And drives fall during cloning, too.

That's very true, of course - nothing in life is risk-free; drives can also fall / fail during the extended time required to run logical recovery scans using software like R-Studio, EASUS, Get Data Back etc. etc. and such scans typically take longer than making a clone. Then multiply that scan time, by the number of recovery programs which the user decides to try...

I'm not saying that cloning is always required where physical problems are not suspected - but as I explained in my previous comment, cloning first or not is a choice for the end user, based on their risk vs. cost assessment (and I've simply explained some risks which the OP and other users may not have considered, but which I've seen). That must be why your product has cloning functionality in it - to allow a customer to have that choice of having a backup of their data or not.

[Sheisty]

*sidebar* This drive was never a problem. I intentionally deleted something after the data was moved somewhere else intentionally. Unfortunately a couple months later the drive where the data was moved failed.

I've found a bunch of files but they are all nearly corrupted as I initially expected. My question now is if the initial short time scan finds a file and its corrupt, the longer scan and search will just find the same file correct. Its not like it will find a duplicate or misnamed version of the file that might work right?

To add insult to injury I think a couple of automatic defrags with perfectdisk were run on the drive Since i deleted the data.

[Vulcan]

*sidebar* This drive was never a problem. I intentionally deleted something after the data was moved somewhere else intentionally. Unfortunately a couple months later the drive where the data was moved failed.

Understood. That does not change the comments I gave earlier.

I've found a bunch of files but they are all nearly corrupted as I initially expected. My question now is if the initial short time scan finds a file and its corrupt, the longer scan and search will just find the same file correct.

Not necessarily.

Its not like it will find a duplicate or misnamed version of the file that might work right?

The longer scan techniques can sometimes be successful where short scans are not, due to the different algorithms used by each, except that in your case...

To add insult to injury I think a couple of automatic defrags with perfectdisk were run on the drive Since i deleted the data.

... unfortunately IMHO those defrags after deleting the data, and subsequent saving of new data, are likely to be a disaster for successful undeletion but never say never...

[Bjerringbro]

Most undoubtedly, your data is threshed. Although some still may remain.
You'll have to scan the whole disk surface and sort by date.

And while this list is up: Here's my two cents.

Ontrack Easy Recovery - Bug/crash ridden. Fails on building tree during large recoveries.
O&O Disk Recovery - Solid. But can't search by sector range.
Winhex Forensic - obviously invaluable to a technician. Pros: Too complicated for nwbs to use.
R-Studio - meh. used it a couple of times.
Get Data Back - gold standard for basic NTFS/FAT disks.
Active File Recovery - can search by sector range. missing some RAW types. can do RAIDS.

[CraigL]

To the OP, good luck, but after everything you have described I think you will be very lucky to get anything meaningful back especially as you appear to be working with video etc...

@Bjerrinbro: Im interested in your views on software, it seems very much like a "Which linux distribution should I choose?" kinda question, whilst you seem to be indifferent about R-Studio and almost recommend GDB, I feel the opposite on this, but do agree entirely with Winhex!

Need to get myself involved in the forums again... For those who recognise my name, please note I am no longer associated with the company I was previously with.

[Sheisty]

I found a few things untouched. Of course they were not as important as what I really wanted to salvage. The more important files were either corrupt or lost

I'm still looking for somebody to mail my failed primary drive to for a diagnosis. Original problem found here. That has all the data that I'm looking for on it. This expansion drive was a old backup drive.

[Sheisty]

Moreover, DMDE found the majority of my files but they were all corrupt. It was found in old recycler data with file names, file size all intact but data was un-viewable (pictures mostly), I noticed some video data was still enact though.