Typical questions on hard drive data recovery

Q A disk has been securely formatted, can the data be recovered

A No. Years ago, there were many storied about having to overwrite a disk 20 times to ensure that data could not be recovered. This always assumed that heads moved very slightly, and not all the bits were fully erased each time it was written. Also, early on, a high capacity disk was a 5” disk drive with a 10MB capacity.  Today, a typical 2.5” laptop drive, will store 40-60GB, 4-6000 times the capacity. The density per square inch is enormous and the scope for out of track data remaining is minute. What I never understood about ‘it must be deleted say 8 times’, was how it would be possible to restore the data from over write 5, rather than overwrite 6. Members of government might try and scare on into believing this type of data recovery,  but CnW remains exceptionally skeptical about recovering a single sector that has been overwritten.

 www.nber.org/sys-admin/overwritten-data-guttman.html confirms CnW’s views.

Another problem with recovering data from an overwritten disk is finding where to look.  The task is possible on a good disk, where all sectors can be read, though all indexes may be corrupted. With no precise details of where a file may be stored, it is best described as impossible.

A disk that has been quick formatted, ie new directory, allocation tables, CnW Recovery software will help considerably

Q Many recovery programs will not recover deleted FAT32 files, Does CnW Recovery recover deleted FAT32 files correctly

A Yes, the program has additional features to reconstruct the missing pointers that the deletion process removes.  Known files types are then recovered correctly.  many recovery programs try and fix a disk with deleted files- CnW Recovery consider that this is a very dangerous approach, and so only recover files to another drive.

Q Can encrypted files be recovered

A The quick answer is yes, because an encrypted file is a normal file with a flag set.  The problem is then, can it be decoded.  Here the answer is whether there is an encryption certificate for the original drive. Without the encryption certificate the only hope will be if it is possible to extract certain files, such as the SAM file, system file and probably the keys stored in microsoft\crypto\rsa and then a third part product may be able to assist. Be warned, that just having he password does not mean that data decoding will be possible.

Q The boot sector has been deleted.  Can data be recovered

A Yes, CnW Recovery software will analyse the disk and reconstruct the boot sector

Q Should chkdsk /f  be used on a corrupted disk

A The quick answer is no, not until a complete, sector by sector image has been made.  It is very difficult to know why a disk has failed and sometimes chkdsk may correct a disk, but other times it may not help, but then make recovery harder.  CnW Recovery software has more recovery tools than chkdsk and will normally work when chkdsk does not.  Once a disk image has been made, then running chkdsk /f may recover the disk in the knowledge that there is a backup if it fails.

Q The drive was being repartitioned and the process failed.  Can the files be recovered

A Yes, though the process is complex as many pointers will be pointing to the wrong location