Need help finding deleted files

jozi

I did a massive cleanup today of my drives before re-installing windows and some how managed to deleted a folder with my lightroom catalogue in it even after keeping it in a folder so I wouldnt delete it....

The folder I'm looking for is one called "2013 - 09 -30" and in it there was a folder and file named something like "Current -2".

I tried test disk which lists pretty much ever file I've deleted over the past 2-3yrs on a 2tb drive, which had about 120gigs deleted of it today as well.

Does anyone know of any other software that can scan my drive and list files by new or something so it's easier to find them?

---edit---

It's a 2nd drive this only used for file storage, OS drive os a different one altogether, and I have a 3rd drive to recover the files to so I don't chance overwriting any blocks on the 2tb drive, in case it mathers!

Czarcasm

Easus Data Recovery Wizard

Hasn't let me down yet, and I've had to use it on at least a weekly basis for the last two years, on other people's drives obviously!

But as data recovery programs go, it's one of the best out there. Another one that comes highly recommended is Recuva from Piriform. I've never used it myself, but if their CCleaner program for getting rid of junk files is anything to go by, Recuva should be easy enough to use for even the average PC User

jozi

I just tried Recuva and not had much luck with it unfortunately, see attached image

For the moment I managed to recover a catalogue from about 3months ago. Not sur ehow much I lose but better than starting from scratch!

I might try Easus and a deep scan on recuva to see if I can find a more recent backup that I deleted.

Czarcasm

jozi wrote: »

I just tried Recuva and not had much luck with it unfortunately, see attached image

Sickened!


I know easus has a pretty good recovery rate (depending on how damaged the HD is of course, some people seem to think their laptops are made of rubber!), but would it be worth considering going down the professional data recovery services route? I've had to do this a couple of times in the part for extremely sensitive or valuable data and it's certainly not a cheap alternative, but it's your best hope at recovering the lost data.

jozi

If their overwriten then I don't think any profesional person could help me.

If I use the recovered folder (top of the jpg) I don't lose to much (I really haven't taken much pics lately ) which is better than nothing.

I'll give deep scan and the other package a go tomorrow and see what I get!

And to think I wiped my backup drive so I could start fresh again and backup everything more religiously! Not backed-up since Jan of this year

Czarcasm

jozi wrote: »

If their overwriten then I don't think any profesional person could help me.

Professional data recovery services jozi are able to recover overwritten files from fire and even flood damaged hard drives!

You might try contact this company in the morning and see how much they'll quote you-

http://www.datarecovery.ie/data_recovery_services.html

jozi

It's not really worth it to pay for it to me. I lost a few things but I can re-edit the images again as best as I can.

What I meant though was that if the files were deleted and then new files writing to the drive over writing the sectors that the old file lived in, how can they recover that if the actually sector on the drive is overwritten?

Wonder what they'd charge for recovery.

Czarcasm

jozi wrote: »

It's not really worth it to pay for it to me. I lost a few things but I can re-edit the images again as best as I can.

What I meant though was that if the files were deleted and then new files writing to the drive over writing the sectors that the old file lived in, how can they recover that if the actually sector on the drive is overwritten?

Wonder what they'd charge for recovery.

It's basically the same as if you were to write something on a piece of paper with a really heavy hand, you may have to skip through ten pages underneath before you can't make out what's on the first page.

Data destruction and recovery works on the same principle - some data destruction programs over-write the data up to ten times, but forensic data recovery techniques will still be able to recover the data.

I think the couple of times I used their services I was charged €100 per gigabyte, something like that, but it's been a while now since I've had to use them. Yours seems like a pretty standard recovery though in that they may not have to dismantle the hard drive.

Capt'n Midnight

if it's a recognised file type try http://www.cgsecurity.org/wiki/PhotoRec it's free

it doesn't care about folders or file names , just tell it what file type you are looking for and point at the free space

unlike most other file "recovery" utils it do any more damage , because it saves files to a different drive

if you have too many files deleted it might take forever to ID which file you want

Fysh

Capt'n Midnight wrote: »

if it's a recognised file type try http://www.cgsecurity.org/wiki/PhotoRec it's free

it doesn't care about folders or file names , just tell it what file type you are looking for and point at the free space

unlike most other file "recovery" utils it do any more damage , because it saves files to a different drive

if you have too many files deleted it might take forever to ID which file you want

+1, I've saved people's bacon with PhotoRec before. The only important thing is that if you're running it as a Windows application, make sure you tell it to save recovered files to a different drive.

It can be time-consuming to sort the recovered files, since it discards filesystem data like file name, but it's definitely worth trying.

jozi

I thought Photorec was for images only? That was why I used testdisc.

It's not images I lost, it's the data storing the edits I did to them that have been lost.

Czarcasm: didn't know it worked like that. I'll prob try a few more software packages, if anything I just lose a few sets in edits for images it's not really worth the money recovering the data.

Fysh

jozi wrote: »

I thought Photorec was for images only? That was why I used testdisc.

It's not images I lost, it's the data storing the edits I did to them that have been lost.

Czarcasm: didn't know it worked like that. I'll prob try a few more software packages, if anything I just lose a few sets in edits for images it's not really worth the money recovering the data.

PhotoRec can deal with lots of file types. If your file format isn't covered, you can add your own file signatures before running it.

Capt'n Midnight

If you have a copy of the files before the edit you can look at ones that are of a similar size or slightly bigger


The whole point of photorec is to scrape files off the disk when all filenames and folders are gone

jozi

I'm doing a deep search with recuva, if it comes up with nothing I'll leave it as is. I've only lost edits for 5 sets of images, I have some jpg's of the edits and for the others I can do them again if I really want to.

Called that place also, 45e consultation fee to diagnose what they can do which goes towards the recovery fee if I go ahead with it. It's not worth it, as above I can re-do the editing.

I'll also have a better backup system in place from now on And see if there's a way to edit that the image contains the editing info rather than the catalogue data holding it.

Capt'n Midnight

any chance there's an autosave or backup somewhere

back in the old days everything made a backup copy , some apps like Autocad and openoffice save the backup copies in a different folder

or did you email it to anyone (handy way of backing up)

if there is no confidential info then look at dropbox etc.

jozi

Nothing other than a weekly backup option which I sometime cancel but I can't find them either, the most recent being the one thats 3 months old. Their quite large folders, 300+mb for the most recent one.

Plan was to get it all setup again and change my work flow a little.
Current catalogue on my main storage drive with a copy on the second drive.
Backups saved to the 2nd drive with a copy on my main drive.
I've also got all the raw images in 2 locations.

I have a 3rd removable drive but that might be a bit over kill to also use as a backup solution?

Was just me f-in up really, I deleted everything related to lightroom catalogues and copied the 2x that I wanted to keep. At some point I must have deleted them though

I can also export my images to a different format that contains all the info that normally lives in the catalogue.

unkel

jozi wrote: »

I've also got all the raw images in 2 locations.

Good. Maybe put a third copy on the cloud somewhere?

jozi wrote: »

Was just me f-in up really, I deleted everything related to lightroom catalogues and copied the 2x that I wanted to keep. At some point I must have deleted them though

Been there, done that. Murphy's Law I'm afraid

unkel

Czarcasm wrote: »

Professional data recovery services jozi are able to recover overwritten files

How can they recover overwritten files?

jozi

unkel wrote: »

Good. Maybe put a third copy on the cloud somewhere?

I might start using my dropbox for jpg copies. Raw files are just to big, I'm looking at folders ranging from a couple gb to 10+gb.

2x copies besides the originals should keep me safe for a bit I hope.

Czarcasm

unkel wrote: »

How can they recover overwritten files?

I've often recovered overwritten files? I use easus data recovery wizard myself and it's able to recover whole partitions that have been overwritten? I'm not really sure I understand what you mean tbh unkel, unless you mean a hard drive that's been zeroed out or several overwrite passes or something?

jozi wrote: »

I might start using my dropbox for jpg copies. Raw files are just to big, I'm looking at folders ranging from a couple gb to 10+gb.

2x copies besides the originals should keep me safe for a bit I hope.

Actually have you considered RAID storage jozi? It'll make copies of your hard drives so even if one goes out, the data can be spanned across the other drives automatically?

Capt'n Midnight

Czarcasm wrote: »

I've often recovered overwritten files?

No you haven't.

Not unless you have some kit that is at least a generation ahead of the drive you are looking at you won't be able to read between the tracks. And even then you'd need clean rooms and even then it's only where the heads weren't fully lined up. And even then it's only in theory. It's like looking at a very blurry photograph of footprints in the snow on a busy path.

Actually have you considered RAID storage jozi? It'll make copies of your hard drives so even if one goes out, the data can be spanned across the other drives automatically?

Software mirroring is good.
And tbh you might as well use it instead of fake raid.

Raid 0 , which people use, gets it's name from the number of files you can recover if a drive fails.

Raid 5 is grand if you have spare servers on hand and you don't use drives from the same batch and you swap out failed drives pdq and nothing bad happens during a rebuild, otherwise you are completely screwed if the controller dies.

RAID is only needed for speed or for massive data storage. It's not cheaper by the time you get real server drives and real controllers

Fysh

To be fair, there are some extremely advance (and expensive!) data recovery techniques that use something like AFM analysis of drive platters coupled with sophisticated algorithms for magnetic memory hysteresis patterns on drive platters (which I think need to be calibrated per drive model, if not per individual drive) which can recover overwritten data.

But that's serious business, though, and way beyond what we're discussing here.

Also, since RAID has been brought up, I will remind everyone that Rule #0 of RAID is "RAID is not backup!". It has different purposes and different strengths and weaknesses.

RAID 1 is passably alright if your fear is of losing a disk, but you need a system with a hardware RAID controller for it to be really worthwhile (yes, you can do OS-based software RAID, but IMO it's not worth doing). But since it's solving a different problem (absolute dependence on the OS configuration on primary drive) it's precisely useless in this context, though, because a good RAID1 setup will very quickly mirror the file deletion operation and save you nothing.

Personally, my advice is to set up a new backup strategy using as many of the folloowing as possible:

• encrypted file upload to cloud-based service (whether free or paid-for; encryption minimises chances of unwanted data slurpage - eg AES256-encrypted spanned 7z files), on a daily or weekly schedule
• data/file copy to external hard drive, on a daily or weekly schedule
• OS system image backup to separate external hard drive, on a daily or weekly schedule
• Copy data files and system images to secondary PC/NAS/local server, on a daily or weekly schedule
• Copy all files (data and system images) to offsite disk storage (eg NAS, large external drive), on a monthly or quarterly schedule

How many of those you want to use (and the expenses incurred accordingly) will be determined by how much time and money you want to spend preventing data loss - which has to be evaluated against the impact of said data loss. If you were dealing with business-critical systems and data, I'd be encouraging you to aim for all of them - but if it's personal, choose whatever seems the best fit for your requirements.

Capt'n Midnight

Fysh wrote: »

To be fair, there are some extremely advance ...
But that's serious business, though, and way beyond what we're discussing here.

It's a fairly safe rule of thumb that the newest drives use heads that are at the cutting edge of what's commercially available.

RAID 1 is passably alright if your fear is of losing a disk, but you need a system with a hardware RAID controller for it to be really worthwhile (yes, you can do OS-based software RAID, but IMO it's not worth doing)

I'd argue that it's worth doing because, it's cheap and cheerful. But more because you can read the disks in any computer, and could probably have a running system again with just a repair install.

110% on RAID only existing to protect you from HDD failure. If you want speed something like SSD might be more suitable. ( but not in this case given the file sizes )


If you have one of the business versions of windows you can use EFS to encrypt files before you send them to dropbox etc.


For ease of disaster recovery keep your OS on a different drive or partition to your data. That way you are more likely to be in a position to restore data using the working system drive or doing a system repair/restore without having to worry about the data.


As always it's a trade off between the time/resources spent backing up and the time/resources taken to redo the files.

jozi

Photography is just a hobby for me, there's no financial gain in it for me and the way things are I just need to make do with what I have.

The best I can do is use the 2x spare drives as backups and look into using dropbox (for jpg's as there just to much data to upload RAW image files).

In the future maybe I'll get some sort of RAID setup but for now I got to make do with what I have.

I tried a deep scan yesterday (took hrs) and trying it again today with a different program, if I can't recover anything then though luck I'll have to start over with the last few sets.