data recovery

[indecks]

OK, got a question about data recovery. I've got a nifty little prog called Recuva that has saved my data in a the past, but thats after deletion.

What about if the data has been MOVED. Like, I have a thumb drive with some files on it, and I move (not copy, move) them to my main HDD. Then in a moment of stupidity I think "ok the one on my hdd is a copy, so lets delete it."

A few days go by and I realize I never moved/copied it back to the thumb drive. Will data recovery still work if the data wasn't deleted, but moved?

[Ivo]

OK, got a question about data recovery. I've got a nifty little prog called Recuva that has saved my data in a the past, but thats after deletion.

What about if the data has been MOVED. Like, I have a thumb drive with some files on it, and I move (not copy, move) them to my main HDD. Then in a moment of stupidity I think "ok the one on my hdd is a copy, so lets delete it."

A few days go by and I realize I never moved/copied it back to the thumb drive. Will data recovery still work if the data wasn't deleted, but moved?

Recuva is pretty decent from the times I used it. Is there no chance you can recover it on your hard drive? Moving should count as "deleting" as far as the file system is concerned. Run Recuva on the flash drive location and see if the file is still there (if you haven't put anything else in the flash drive since then, chances are good).

Ivo.

[indecks]

Thanks for the info Ivo, but unfortunately, it's not working. It's really weird. There is a folder in the flash drive called data which is where data is constantly added to, or overwritten, modified, etc, then a folder that i created called backup that was literally that - backups that were never modified.

The files I didnt want to lose were in backup, and in fact I even accidentally/stupidly deleted them a long time ago, which I how I found out about Recuva. It found them again and boom, I was back in business.

But this time, on a standard scan (even on the flash drive) Recuva doesn't find anything. Zero files. Then upon a deep scan, finds nothing! Though what's odd is that it shows '3 files found' while it's running the deep scan, but it doesn't present them once it's finished. It's almost as if the flash drive is 'new' and has never had anything written to it. SOMETHING should be recoverable if it's ever had anything written to it.

Its been a month or two since I did anything with this drive/data, so I think one of two things happened:

1. I moved the files instead of copying, then deleted the ones I moved (thus no backup/copy).

2. something is wrong with the flash drive and it died - which is odd, because it can still keep data and i can still explore it. I moved some files onto it this morning to test, and they're still there after removing the drive from my system, etc. So the drive is working.

3. maybe it's a combination of the two. I moved the files, deleted them, and then the drive was somehow reset/flashed/ESD'ed, etc.

Unfortunately I dont think I'll be able to recover them from my main hdd because my recycle bin is constantly being overwritten, emptied, etc because I do a lot of downloading. This is just *really* weird.

[Niode]

You deleted the files you moved FROM your USB stick, therefore just recover the files on the HDD that your moved the files TO. Problem solved.

[indecks]

You deleted the files you moved FROM your USB stick, therefore just recover the files on the HDD that your moved the files TO. Problem solved.

Unfortunately that won't work. The last time I used the drive in general was maybe a month or two ago, and I deleted them from the "TO" computer. Since then the Recycle Bin has been emptied several times, TONS of downloads have come in, etc so Recuva didn't find it there either. I'm trying another program called Stellar Phoenix, and so far, no luck.

I think it's safe to say the data is gone.

[Niode]

Ah. In that case, most likely. These recovery programs work because an operating system simply deletes the file(s) from the file table and flags the area as available space, the next time data needs to be written to disc it will write to any available space, overwriting any pre-existing 'deleted' data, this is much faster than just simply deleting the data from the disc every time. Therefore, a program that simply reads the data on the disc ignoring the filetable will be able to find said data IF it's still complete and not been overwritten.

Lesson learned. Back up important data. Always. CDrs are cheap and you can automate this process on most (if not all) modern operating systems.

[indecks]

Lesson learned. Back up important data. Always. CDrs are cheap and you can automate this process on most (if not all) modern operating systems.

but that WAS the backup! lol!

It's a very strange occurrence. It sits in a spot that won't be found unless it's by someone in the know, ie me, the wife, etc. When I went to check on it the other day, the backup folder was gone, but the data folder was there - although empty.

It's like it selectively deleted the backup folder, the data in the data folder, but not the data folder itself. wtf?

I asked the wife if she went and used it and accidentally deleted it, and of course the answer was no. She's definitely telling the truth, and even if she DID delete it, it should have been found by one of the deep scans I did, y'know?

It's almost as if someone physically replaced the drive with an exact duplicate, but no one knows where it is except for me and the ol' lady. I guess I just need to keep a backup of a backup, ha!

[Hobie-wan]

even if she DID delete it, it should have been found by one of the deep scans I did, y'know

Since then the Recycle Bin has been emptied several times, TONS of downloads have come in

The more the disc has been in use, the more chance stuff is gone. If you delete a file, go to lunch while your PC sits doing nothing, then realize you need the file when you come back, it is likely to all still be there. Depending on how much free space your HD has, even just launching some games or applications can clobber removed files when the swap file gets changed around to accommodate those programs. If you've been downloading a bunch of stuff, you're pretty much guaranteed to have clobbered pieces of the files and rendering them unusable, especially if your HD is fragmented. If you're doing a lot of downloading and deleting, your HD is probably fragmented.

[fastbilly1]

Even though more data has been written over it, it is possible to recover - but is very tricky and complicated. My favorite easy access data recovery is Zero Access Recovery, shortened to ZAR: http://www.z-a-recovery.com/

It can typically can find something thats been written over a time or two, but past that its time to fire up knoppix.

[indecks]

So what about moved files?

Because I know - I'm absolutely sure- that the 'backup' folder was never overwritten. It was like a zero state file. The fist edition, whatever, it was never overwritten or deleted. well, maybe deleted, but never modified. I always made a copy of that original file to make adjustments, etc.

But at some point, I must have moved it, rather than deleted it - will recovery software find moved files, as opposed to deleted ones?