Retrieve files from deleted partition

[computerfox]

Hello everyone,

I'm losing my mind with this current situation and was wondering if anyone could shed some light on this subject.

i have a computer that had a virus. the documents were either hidden or completely deleted so i deleted the partiton and reinstalled windows 7. i ran paretologic and it did find the files, but when i tried to open them, they were corrupted. any ideas?

I am currently running 3 scans just to make sure-paretologic, getdataback, and active partition recovery. Do you think any of these would help? Can you suggest any other programs, hopefully one that doesn't take a billion years to finish.

Any suggestions would help me greatly.

[Rabbit]

You could try prodiscover basic or forensics tool kit. They both have free/trial versions you can use.

[computerfox]

Would there be any other programs? I want to make sure that I'm not just installing all types of scanners because I really would like to get this done.

[computerfox]

okay, i know for a fact that i can at least get the files back with paretologic. the problem is that they are all corrupted. is there anything that can be done to fix the corruption?

[Rabbit]

That depends on the corruption. If the data is fragmented, you could try data carving to retrieve all the file fragments. If the file header is corrupted, you could recreate it by researching what the file header should look like. If the file data is corrupted, there's not much you can do.

[computerfox]

Thanks for the response. It doesn't really say, nor can I tell which one it is. What I do know is that MS Word tells me that it can't access it and it also shows the document either completely blank or in symbols. Which type of corruption is this? Could the corruption be due to the virus or simply because I deleted the partition?

[computerfox]

I must figure something out because (this may shock you) I'm trying to open up my old shop after getting laid off from my old job and this is a brand new client of mine. If wort comes to worse and I am forced to refund him, I have no problem doing that, but I'm very nervous that he might end up suing me, especially since I have no insurance and well, let's just say I'm just starting out with the business.

[computerfox]

The thing is that before I went on to delete the whole partition, I didn't see the files and I strongly believe that I checked to see if they were only hidden by right click and making sure [Hidden] was unchecked, which foolishly I believe that the files were done for to begin with, but I'm almost certain that I'm wrong and if I try explaining to the client that it's because of the virus, he will still try to sue me.

[Rabbit]

It's impossible to tell what the corruption is without examining the file byte by byte. The easiest to confirm or disaffirm is whether or not the file header is corrupt. I would look up the file header for your version of Word and check that against the file header of the corrupt file. If you're lucky, that's all you have to do. The next easiest is whether the file was fragmented. I believe the trial version of forensics tool kit has a data carving tool. You can start with that, but data carving is not 100%. And if it's not those two, you're probably SOL. There's not much you can do to recreate the file because it would be extremely time consuming for you to examine the entire file byte by byte to find the error. And even to do so would require a lot of technical knowledge about the file format.

[computerfox]

How would I check the header file? Would I just check the properties of the document?

[Rabbit]

By looking at the first few bytes of the file in a hex editor and comparing it to a known value.

[prettsons]

Hello computerfox,

After reading full issue, I want to suggest three points:

1.As you said that you deleted the partition & reinstalled windows. In this case, you cannot recover data from C drive. All others drives data can be recover.

2.As you asked data recovery program, I want to suggest you Stellar Phoenix. Stellar coded a program to recover deleted partition. Stellar wouldn’t charge hefty fees for data preview but instead provides affordable data recovery software. I used this software & recover my deleted partitions. You can find all the information about the software on official site.

3.Use different partition to save recovered data with partition recovery software.

[Muhammad Adnan]

Hello fox!
it depends on your formating type. If you formate the drive quickly then you are unable to recover it. If not then you can recover your data from any drive.

[omerbutt]

hi,
you can use Easy Recovery , i can provide you with the link if you like , its a registered software with key , you can go for a try with it , it is a reliable and effective one butt the problem is that you have over written the drive after formatting it.
regards,
omer aslam

[stephen22]

Hi computerfox,

Since you have deleted the existing partition, in order to get back the lost files, first you need to recover partition which you have deleted. In case if the files are corrupted before deleting partition, then you will get only the corrupted files even after recovery. Try with some efficient partition recovery software and check once. If you still get the corrupted files then use some respected file repair software and get your files in healthy condition.

One of the advanced windows partition recovery software which i recently used is here:
http://www.remosoftware.com/remo-recover-windows.exe

[abhijeet1]

Hey there are numbers of professional who help you to get your lost data. Just consult any of the professional guy who are expertise in hardware part.

[Nehal Drago]

Hey! u can use Recuva,
wit it u can retrive all your deleted files from the cluster...

[computerfox]

oh gosh.... i just checked my inbox and saw this thread :shivers:

just to let everyone know that i couldn't get the data back, but he did not take legal action. thanks everyone for your help.

suggestions:

1) don't ever reimage a machine right off the bat. do scans first
2) if you MUST do a reimage make sure you clone/ghost/backup all important data
3) if you do not see any data, set it up as an external and see the raw files
4) if all else fails, it's best to give it back and advice to use a service that is efficient. data recovery services tend to cost thousands of dollars, but some do have flat rate fees.