Hard drive recovery

A buddy of mine accidentally deleted 2TB worth of stuff. Unfortunately, though I understand how file recovery works, I don't have any experience with actually recovering files.

Does anyone have experience with recovering files?

Here's the detail:

- Secondary hard drive, no OS installed.
- 2TB worth of data
- mostly >5GB MKV files. From what he says, he cannot recover anything greater than 4GB.

Any recommendations?

 

32 views and 0 insights lol

 

Does he have a Mac? Sounds like it could be something to do with the FAT32 limitation..

 

Nah, he's on Windows. You're right, I should have asked him if his partition is FAT32 or NTFS lol. But assuming it's FAT32, wouldn't that mean he wouldn't have been able to write >4GB files to it in the first place?

 

how do you "accidently" delete 2tb of stuff? did he do this through command line or can he not read prompts? lol

 

I'm not sure man, I think he might have mistakenly thought he had a copy somewhere, and proceeded to delete. A common mistake I'm sure.

 

you could try http://www.cgsecurity.org/wiki/TestDisk take a bit of time to scan through the drive but it works.
I am guessing Previous versions isnt enabled on that drive..

 

You say he is not able to recover anything greater than 4gb, so my first thought would be the recovery destination is a fat32 drive and not NTFS.

I worked in our forensic department for a few months, data recovery is not as complicated as it seems but do require some very expensive software for some harder to retrieve scenarios. Your friend's scenario should be fairly easy to recover as long as he didn't write over the partition that stored the data.

 

there are a few apps he can get, Pandora Recovery , eSupport UndeletePlus .... assuming he didn't use the hard drive to put other data on it overwriting the files from the partition.

 

Thanks all. I figured this would be something fairly easy to recover, but having no experience with this area, I thought I'd ask for opinions to make sure.

 

When something in a HDD is deleted its not actually deleted. Yeah its weird, because things are written into the HDD so its burnt in. Thats why when you throw a HDD away make sure you destroy it, not just dump it. I'm not sure how you'd get it back but like, i know there are ways, obv the more you want back the more $$$ it costs. Those guys have top notch softwares to retrieve info. It really depends on how important those files are.......like the Edison Chen photos....

 

He could have downloaded the file in parts. No clue. GL on the recovery. Its gonna take awhile...

 

Yea I understand how deletion works.

A hard drive stores data by indexing the locations of where the data is stored. A file is divided into parts that are stored in different locations on the hard drive and is indexed for retrieval. When files are deleted, the particular pointer to the indexed file is marked as writtable, in other words "deleted".

Perhaps. Thanks. Will keep this thread posted.

 

Nice, I appreciate the recommendations. Thanks!

 

For work I use EnCase.

 

regular format from windows or SHIFT + DEL? regular format u can still recover,but the recovered files might be partially corrupt, probably faster to re-download
SHIFT + DEL, you are out of luck