For 1 month only, DTI Data Recovery is opening this course up to the public. We are offering only 4 online data recovery courses in 2009. Each course will include our full version data recovery software we sell, but also tools that only our engineers use. You will be able to recover everything from lost emails to deleted pictures, data lost from partition corruption and viruses as well as the following:

• Calculating and fixing a partition record for single and multipe partitions
• Restoring a deleted file by hand in FAT32
• Restoring a deleted file by hand in NTFS
• Determining the drive order of a RAID 5
• Restoring a file system using the backup OS Boot Records (NTFS and FAT32)
• Rebuilding a EXTFS2/3 file system using the super block
• Mounting the XFS file system from a NAS device in Linux
• Recovering JPEG files using a file harvesting technique
• Recovering MP3 files using a file harvesting technique
• Recovering a PST file using file harvesting, unused cluster map and scanpst
• Restoring the MFT from the backup
• Reading the block map for an EXTFS2/3 file system.
• Determining Block size of a RAID 5
• Determining RAID data set for a Simpletech NAS device
• Novell NWFS file system
• Microsoft Access Database file format and recovery
• How to configure a Knoppix disk
• How to configure a Bart PE disk
• Recovering data from a DBX file
• Swapping USB Enclosures

The course is discounted from its original price of $2500.00 to $995.00 and will not be held again this year.

Reserve your class now, before it is too late, only 10 members per class!
Call 866-418-3843 or fill out Online Data Recovery Training Sign Up Form

Learn more about online data recovery training here.

Here is the scenario, a user will plug in an external hard drive and back off all of their important data to that drive in preparation of a format/reload of windows. They then reboot the machine and boot from their Windows cd. They begin by deleting the primary partition on the boot drive and then formatting with NTFS. They go through the entire windows load with out incident. Finally in windows they go to My Computer only to see that the external drive is no longer accessible. I have seen 2 different problems here one is that the drive still has a drive letter but it will throw the error “The drive is not formatted would you like to format it now?”. The second situation is that the drive has no drive letter at all and in Disk Management it will say the drive is unallocated or raw. My recommendation is that you never leave any drive, except the one you are installing windows too, connected to the machine while you are reloading Windows.  Now on to how to fix this problem.

There is a couple of ways to fix the problem, the first one is to get Recover IT All Professional and allow the software to find your files. You can then mark them and move them off. The problem with this option is that it requires a lot of transferring of files, and you may miss some. The other way to do it would be to have DTI Data Recovery remote into your computer and repair the problem remotely. With a hex editor I can put the drive back to the way it was before this happened. This is a nice option and limits the down time to the user. There is no cost to the customer for me to come into the machine and take a look and see if I can recover the drive. If you have any questions about the software or remote service you can reach me at 727-345-9665 ext 236.

If you are restoring Windows because of a hard drive failure, you may need hard drive recovery. Don’t use Windows restore CD’s if your hard drive is clicking, or isn’t seen by the BIOS.

Open Windows Explorer which can be done by right clicking on My Computer and clicking on Explore.

Now selected the drive that the files are missing from and go up to Tools and then Folder Options.

A new window called Folder Options will appear. From here click on the VIEW tab. We need to change two settings in here so that we are sure that we are seeing all the files on the drive. The first option to look for is “Hidden Files and Folders” under here is 2 options one to NOT show them and one to show them make sure you are showing them. The next option (2 under the hidden files one) is “Hide Protected Operating System Files” make sure you UNCHECK this.

Now Click “APPLY TO ALL FOLDERS” and then OK when that is done. Now in the case of my customers what I discovered then was Found001.chk, this meant that chkdsk had been run on the drive and more then likely not to completion. When I right clicked on that directory and went to properties that directory has 30 gigs in it. AH-HA the disappearing data. When I opened the Found001 directory there was sub directories call dir0001, dir0002, etc.. Inside each of these directories was the customers data that had been missing. The customer did not even know chkdsk had run which I find is often the case if the machine reboots when no one is around.

In some cases file are lost due to mechanical problems with the disk. If yours is making noises then it will likely need hard drive recovery. If the hard drive is fine and seen by the BIOS or Windows, we can do remote recovery. Our fast data recovery service Recover It Now starts at under a hundred bucks.

Windows Blue Screen of Death

If you have turned your PC on and received this message the problem can be solved with the following steps. However, before beginning, it is very important to note that the cause of the problem may be the hard drive itself. As with any type of do it yourself recovery this could cause permanent unrecoverable damage to the hard drive and or the data that exist on the hard drive. Like most hard drive recovery processes, physical disk repair isn’t necessary if the hard drive is seen by the BIOS. If your hard drive is recognized by the BIOS, but you get the blue screen of death these steps will help you restore Windows. Be careful and backup if you can! That said, lets continue.

If you have your hard drive manufacturers diagnostic tools, please read the documentation carefully and test the drive to make sure it is functioning properly. If you do not have the manufacturers diagnostic tools you can go to their respective websites to download them. It is important to read the documentation as these tools may perform data destructive tests and procedures to your hard drive. It is also a good idea to try and recover some of the data by making your boot drive a slave drive under another Windows system for hard drive recovery. Please see our previous post “How to slave a hard drive“. Ok, lets proceed with the restoration and hard drive recovery.

Windows Command Prompt

Time for the XP Recovery Console.

You are going to need to get your XP Installation Disk.

You will also need to make sure you can boot from your XP installation Disk. Insert you installation disk in your cd/dvd drive and make sure you see the option press any key to boot from cd: If so, do so and you’re good to go. If you do not see that option you will need to enter your system setup (BIOS) and change the boot order. When your computer boots you should see press delete, F10 or some key function to enter your systems setup. You will usually find the boot order under advanced settings once you are in the setup console. Simply select boot order and choose CD as your first boot device. You may change the boot order back to the original settings after this exercise in hard drive recovery.

When you boot to your Install CD it will take a minute to load all the drivers, then it will provide two options-Setup or Recovery Console; “press r” for the recovery console. It will than ask you which Windows install you want to repair, most users will only have one so just input 1 and press enter. You should now have entered the recovery console of your Windows XP CD.

What you are about to do is basically a minor System Restore via the Recovery Console. We are going to use an older version of the currently curr The text in red will be what you should type and the black text will what the system outputs. READY, SET, GO.

C:\Windows>CD C:\system~1\_resto~1

C:\system~1\_resto~1\>dir

After you enter the DIR command and hit enter you will get a list of folders like rp1, rp2, rp3, rp4, etc.. The “rp” part of the folder name indicates it’s a Restore Point.

What we want to do is use the 2nd or 3^rdhighest numbered folder in that list. For example, if it listed rp1 through rp53 you’ll want the rp52 folder. We will use rp52 to outline the rest of the procedure.

Now, we will use the following commands..

C:\system~1\_resto~1>cd rp52

C:\system~1\_resto~1\rp52>cd snapshot

C:\system~1\_resto~1\rp52\snapshot>copy _registry_machine_system c:\windows\system32\config\system

Overwrite system [y,n]: y

1 file copied

C:\system~1\_resto~1\rp23\snapshot>exit

Remove the installation disk .

Those are the steps to restore Windows after getting The Blue Screen Of Death. If you need help give us a call at 866-418-3843 or visit hard drive recovery.

In theory, this sounds like a great marketing idea having the ability to sell external USB and Fire Wire hard drives to three different operating systems. In theory. In practice, it presents some unique problems. As an example; a real life example, I have in my posession a Western Digital My Book that was formatted originally as a FAT32. However, this particular My Book was used for video editing and storage for a documentary on a Mac. For whatever reason this particular client decided to format the drive. In speaking with the client, this was not the intention. That being said, the drive was formatted using an EFI format that destroyed huge chunks of the FAT as well as destroying the OS Boot record, and the back-up OS Boot Record. In addition, the Master Boot Record had odd data for the partition starting points, and file system type on the external hard drive.

Now, with the MBR in the wind, both the OS boot records destroyed, and the beginning markers of both FATS gone, has does one reconstruct the original configuration of the FAT32 file system? In the next installment I will illustrate how Microsoft leaves little remnants of the file system all across the drive, and how these remnants can be used to recover the file system.

Related Resources:

hard drive recovery

external usb firewire hard drive data recovery

This first area I am going to cover is the partition area of the hard drive. It is also sometime referred to as the MBR (master boot record) which can be confusing because it is NOT the boot sector. It is also often called the partition table. For the purpose of this article I will call it the partition sector. The Partition sector is what handles the “logical” drives in “physical” drive. So that is to say just because you have a C and D drive does not mean you have 2 hard drives. It more then likely means you have one physical hard drive with two logical drives contained inside of it.

EXAMPLE: Take a piece of Tupperware and 2 apples. We will consider the Tupperware the “PHYSICAL” hard drive. Now take the 2 apples and put them in the Tupperware and close it up. The 2 Apples inside are the “LOGICAL” drives or the partitions.

You can see how many physical hard drives you have under the Disk Management Utility. Also in this utility you can see how many logical drives are contained in each physical hard drive.

NOTE: You can get to Disk Management by right clicking on “My Computer” and going to manage. From there you will see Disk Management please see screen grab below.

When the partition sector of a hard drive is wrong or gone you can usually still see it in Windows Explorer with a drive letter assigned to it. Unfortunately when you click the drive you will get an error like “the drive is not formatted would you like to format it now?”. This is a problem that can in most cases be easily fixed if I were to remote in to the computer. Follow the link for more information on Remote Logical Hard Drive Recovery and how we can remote into your computer and recover your data.

Now, the cool part about the partition sector is that it has a back up in a different area of the hard drive for recovery. So if it is just an issue of a deleted partition, or some kind of very nasty virus, recovery of the partition becomes very simple with the use of free utilities like our Free Partition Repair Software. In the event on of the free utilities did not work to recover the partition there could be a deeper issue with the hard drive in which case a sector editor may need to be called upon to diagnose and fix the problem. Below is some pictures of a healthy partition in sector editing software.

This is what I see when I go to sector 0 in WinHex as you can see there is even “Invalid partition table. Error loading operating system. Missing Operating system.” Now we know where we get those errors from. If the partition is intact but one of the other system areas is not then it will revert back to one of these errors depending on which area seems to be having the problem.

Now I apply a template to the partition sector so that I can look at it “decoded”. In here we see that the partition sector says I have only 1 partition on the drive (this is correct). In the one partition it is not active (this is correct since it is an external USB drive). The start head, start sector, and start cylinder will read 1,1,0 in MOST cases. The Partition Type Indicator tells us what kind of partition we have, in my case 07 which means NTFS. If You have0b in there is means you have a FAT32 partition, which we are seeing a lot of on the external USB/FireWire drives. Next you have the end head, end sector, end cylinder and again in MOST cases it is going to be 254,63,1023. The next field is Sectors proceeding partition, this means how many sectors is it until this partition starts. You will sometimes hear this referred to as the logical off set. Again in MOST cases this is going to be 63, which means that if we go to sector 63 we should find the “boot sector” (I will go over the boot sector at a later date). Sectors in Partition is the last thing in the list, and it is exactly what it says, the total sectors in that partition. Now how do we figure out if that number is correct? You can go to the blog I wrote Building Partition Record with Recover It All.

For more information about hard drive recovery or our freeware data recovery.

Welcome back to my series of articles that pertain to Spyware, Malware, and Viruses and what you may not know about them. In my first article, I gave you and overview and some information on the history of these 3 nasty applications or bots that infect most computers at some time or another. There is a TON of information availible on these subjects on the Internet, so if there is anything more specific that you are curious about or that you didn’t understand from this article you can usually go to http://www.google.com and you can reference it there. In this article, I am going to be discussing what Viruses and Spyware are, and how you locate them on your PC.

The first thing that you have to understand is how these malicious applications get onto your systems. Studies show that the number one way to catch a virus or to obtain Spyware on your system is through P2P (Peer to Peer) file sharing applications like Napster, Limewire, Bit Torrent, and any other program of that variety. You may think you are downloading a harmless MP3 file, or you may think you are getting the latest MPEG for free, but the fact is that over 40% of all files that are transferred through P2P programs are actually viruses or Spyware and key loggers that are camouflaged as the file you are looking for. Remember this ONE rule about the Internet, if you only remember ONE thing from this article, and that is there is NO SUCH THING as FREE on the P2P applications. No matter how perfect or scamless the situation may seem, if it is FREE and on the P2P programs than you can guarantee that there are strings attached. So try to stay as far away from P2P programs and applications as you can, because no matter how hard you try and no matter how much protection your system has, you are bound to override your protection to view a file that you shouldn’t because of infection, and you will sooner or later end up destroying your system.

I’m sure as you are reading this article you are thinking that you are probably secure, and that you have Antivirus and Antispyware software on your system, so none of this applies to you. But remember this, those programs are only good if you do updates to their data files at least once a day, and they can only stop what you tell it to stop. So if you try and access a website that you THINK is safe, and your Antivirus software tries to tell you it is not, and you bypass your antivirus software and access the site anyway, then you may have just let a Trojan or key logger onto your system and your Antivirus software can now do nothing about it. Understand that protection software is only as good as it owner. It also only takes ONE piece of Spyware or Malware to get onto your system to corrupt your Antivirus or Antispyware programs so that they cannot detect future attacks against your system. The first thing a virus or piece of spyware does, is look for the services and applications that run your Antivirus software, and disable them, or even worse, cloak themselves so that your antivirus software thinks everything is running smoothly when in all reality, your system is being destroyed one piece at a time. A lot of viruses and Trojans will disguise themselves as system services and then they become nearly impossible even by a trained professional to remove from your PC without formatting the computer. There are so many different variations of spyware, Trojans, key loggers, malware, and backdoors that can attack your system, that you have to be on the lookout for strange occurrences at ALL times when surfing the Internet.

Your best bet for protection is to follow the steps in my next article and try to stick to the rule of Internet thumb, and that is if you don’t know the website or file your are downloading and cannot verify its integrity, then DON’T go to that site or download that file. It is a very simple rule, but end users seem to forget it a lot, I myself am included in that statement.

So check back later this week for my last installment of, “Spyware and Malware protection and removal and what you MAY not know!”, which will explain how to understand, locate, and eliminate spyware, malware, and viruses.

Data Recovery

I have had the luxury of being in some sort of IT Industry in one way or another for the last 17 years of my life. I have worked in fields from standard PSTN Telecom, to basic PC building and repair, to Corporate Network Design and Infrastructure Integration, down to Web Design and Programming. I would say that over the years I have seen MANY drastic transitions in technology, some greater than others. I watched as I saw a standard telephone line connected to one personal computer at a time sending messages and files through a BBS (Bulletin Board System), develop into the large scale high speed data network we use now known as the Internet. One thing that has ALWAYS held true in the communications and data networking industry is that there is always someone out there trying to make a quick scamming buck or to take down systems of the masses by playing on the end users lack of knowledge on how to protect and secure their computers. Since the early days of BBSing, I remember even in the late 80’s and early 90’s, there were Trojan viruses and infections that were in place for NO other reason but to annoy and destroy file systems. Anyone who remembers Wildcat and Oblivion BBS’s and was ever struck by the Michelangelo or Jerusalem viruses knows exactly what I’m talking about.

Since the inception or communications, there has always been the need to secure and prevent hackers, warez freaks, and script kiddies from getting into your computers. The only thing I have seen change over the years, is that it is no longer just a 12 year old kid slurping down mellow yellow until 4 am that is hacking your system and corrupting your files, or even worse, stealing your personal information. Now it has become a multibillion dollar BIG BUSINESS for companies which I won’t mention in this article to install Spyware, Malware, and Scamware onto your system so they can collect information about your personal life, your personal preferences, your web surfing habits, and even your credit card and social security number so they can store your information into a database and sell your information off to the highest bidder.

Now please understand, I am not a conspiracy theory type of guy, and I don’t think that big brother is trying to get me, but I am a realist and I know for a FACT that EVERYONE that is reading this article has at some point in time in one way, shape, or form has had a virus, a Trojan, some Spyware, or Malware on their system. So that is not a conspiracy, it is the plain and cold hard truth. We as a community of Internet surfers and knowledge seekers have to be able to protect ourselves and our family’s against the unwanted bots, programs, and software that is being installed onto our systems and is invading our privacy without knowledge. So my next few articles are going to explain a few ways on how to spot the malicious software and viruses on your system, and a few of the best tools to protect and guarantee your computers and family’s safety from these devious applications.

So check back later this week for my next installment of, “Spyware and Malware protection and removal and what you MAY not know!”, which will explain how to understand, locate, and eliminate spyware, malware, and viruses.

In my last windows explorer tutorial I explained how to open Windows Explorer, now I will start showing some of the functions people need to know. A lot of time a file we are looking for just doesn’t seem to be where we think it should be. This may be attributed to the fact that the file is hidden. In order to unhide these files here are the steps.

1. Open windows explorer (please see my other tutorial)

2. Click on “My Computer” in the left hand window.

3. Select one of your hard drives. In this case I have selected the “C” drive.

4. Now go up top to “Tools” and select “Folder Options”

5. Now click on the “View” tab along the top and you should see “Folder Views” and “Advanced Settings”

6. Scroll through the advanced settings until you come across something that says “Hidden Files And Folders” and under it should be radial buttons to allow you to select “Show Hidden Files” (see picture below)

7. Now just click the OK button. You may get a warning from Windows that this could be dangerous, because now you will have access to system files. If you think this is bad idea because you may delete them then I recommend that you don’t unhide these files.

That is all there is to it. In the next Windows Explorer tutorial I will go over how to see all of your USB mass storage devices this way.

Click on Start then Accessories and then two from the bottom is Windows Explorer. Click on it and you will then be given the following program.

Windows Explorer defaults to the “My Documents” Directory. As you can see all the files and folders you have in your My Documents folder are now displayed.

Below that is “My Computer” clicking the plus sign next to it will now display any mass storage devices Windows sees connected to the machine (i.e. your C drive and CD-Rom drive). From here you can also see your Control Panel, Mobile Devices, as well as Shared Documents and your My Documents folder again. We go further into the Control Panel and Shared Documents in a later blog, for now we are just trying to see what we are able to look at in Windows Explorer. You will notice you also have access to your Recycle Bin and any folders that reside on your desktop. (Note: You now have full access to your files, if you delete from here it will be sent to the Recycle Bin.)

To Be Continued…

So, step by step this is what you need to do.

1.    Click Start

2.    After the start menu pops open you will need to click on the control panel option. (See the screen grab below for the location)

3.    Now when you click on the control panel you will be presented with one of 2 different screens. With either screen you are going to want to click on Add or Remove Programs. (see images below)

4.    When you choose this option a new window will open that might take several minutes to fully populate depending on how much software you have installed.

5.    Once all of your software is listed you can scroll the list in order to find any software you no longer need.  Once you select the software you will be given the option to remove it.

(NOTE  you may have a button that says CHANGE/REMOVE this is essence the same thing as remove only button)
6.    Most software will ask you if you are sure you want to remove it. (NOTE: Most software programs also delete any saved data associated with them when you remove the files.)

7.    The next phase you will see the machine deleting the files, and then you will be back where you can select other programs you wish to remove.

At this point in time, I can honestly say that Microsoft has been very forth coming on expressing their known issues with certain applications or games since the release of Vista a few months back. They have explained that the issues that legacy applications being installed can cause are issues such as primary functions not working in the installed application or in other applications that share the same core operating system files that may now have been over written by the legacy applications installations, they also state that legacy applications may also cause system instability.

One of the main Windows application compatibility issues is with the Microsoft UAC (User Access Control). The UAC has been causing issues with applications that do NOT have an installer program packaged with them. The new desktop security feature, UAC, basically simplifies desktop security so that the end user does not have to have a Security Degree to ensure that they are protected from malicious operating system attacks or exploits.

Windows Vista Application Compatibility, Or Lack There Of!

By design, and most practical usage, the UAC seems to be a good idea and is definitely the right step for Microsoft to take to move into the market for better desktop security. The UAC works as this, there is a 4 tiered system that will stop ALL system usage and make the end user allow or disallow an application or service that is attempting to install and use resources that MAY be vital to continue successfully running the operating system.

The 4 tiers are based on a color code that ranges from Grey, to Blue, to Orange and then to Red. The colors are to identify the severity or Microsoft’s lack of knowledge of the application being installed. If the application comes up Red, it does not necessarily mean it’s bad, it just means that the application may not be signed by Microsoft’s Software Signature, and is attempting to access some pretty important core system files.

The colored screens are basically letting the user know that something is about to change that may cause Windows to become unstable, corrupt or inoperable. This is only bad if the application being installed is NOT a desired application that the user wants. Now understand that when you first get your new Vista operating system, and you are installing all of your applications, you may see this warning a lot, but you will not have to KEEP approving this warning for any application more than once if you have accepted it with the current user already.

Certain programs use multiple executables to function, so you may have to accept the UAC multiple times for one application at first, but once all executables have been approved, you should not see the UAC for that application again. Now, were the problem lies with the UAC for applications that do NOT have an installer package, is that they are looked at by the Operating System as a NEW program every time they are executed. Which means the UAC may not allow them to run because of the lack of administrative or user privileges. Now if you are having issues running an application of this type, there seems to be a simple fix for it, you can simply Right-Click the executable and choose the option to Run as Administrator and the application should then run with full functionality.

I have yet to see many other workarounds, but if there are any, I would appreciate it if users would post a comment to assist myself and other users reading this blog. Microsoft had been VERY open about the applications that would not run on Windows XP SP2, and had published list of these applications for end users to be aware of, and to communicate to the software designers the issues so that the applications would then become SP2 compatible. Microsoft has not currently published any list of known apps that do not work, but they have come out with a Vista Application Compatibility Update. You can access this update at this location: MS KB Article 929427.

This update improves support in Windows Vista for the following applications:

I will be putting together the most comprehensive list of the Works, and Doesn’t Work software on the market that I can come up with in my next article. If any readers can post any information on any application that they have had success / failure with for us that would be great. Also, if you can maybe go into depths as to why you are positive of the success / failure rate then that would be very helpful , so that maybe we can all try and put our heads together for possible workarounds to get you’re purchased applications running. Until then, take care, and please post if you have any questions.

Good Luck,

Richard Correa, MCP, MCSA, MCSE, MCDBA
Senior Network Engineer / Lead Web Developer
DTIData DTI Networks
Office :: 727.345.9665 ext.206
rcorrea@dtidata.com

http://www.dtidata.com
http://www.dtinetworking.com

It isn’t enough to have a plan but you must TEST that plan.

About a month ago I was doing a refinance on my house and the mortgage broker was one I have used a few times for different things. When we were discussing what I was doing for a living, she was very interested because she had just lost a ton of data to a bad hard drive.

When the hard disk went down, she called her IT guy of course, and he went to the backup. The backup was bad, and subsequently she had a lot of work to re-enter. I explained to her, that although I was a little appalled that the IT person had not had the forethought to at least test the backups he was making, that it is common practice. I got with some people at the office here, and the general school of thought was that she should implement a disaster recovery “fire drill”. Now I am sure you’re wondering what exactly what that is, so I will explain.

Disaster Recovery Plans Test Your Backup Solution

Let’s say every 3-4 months, she comes in, and calls her IT guy and has him come out. Once he gets there she says to him “Now I want you to pretend my server hard drives have crashed and I want you to get me my data. I don’t have a ton of money to give to a data recovery company!” She has now put the IT person in the position of having to prove that the back ups are viable, also she will get an accurate count on how long it will take to get back up and running. If he is unable to produce her data, and the backup is bad, then they know they have problems with the disaster recovery plan. They can then tweak it to be more efficient and produce a better result.

I can not stress enough how important it is to have a data recovery plan and test that backup plan. If you do this you will be left with little down times and little to no data loss.

Before we get into WinFS, I wanted to ensure everyone that DART, the most powerful data recovery software on the Internet, does and will work on ALL versions of Vista. If you need Vista partition recovery or file recovery download DART here. We fully support DART  call Toll Free 1-866-438-6932 or direct 1-727-345-9665. Extended Software Support: 8 AM to 11 PM EST 7 days a week!

OK the sales portion of this post is out of the way, lets move onto Vista’s file system the way it is now, and how it will change down the road. When looking at NTFS (New Technology File System) it is apparent that it is a major upgrade over FAT (File Allocation Table). The question is what will be the benefit of WinFS? At this time Windows file systems “see” what is called metadata. This gives the Operating System the ability to know more about a specific piece of data. An example is
“5551212″ is data, “Michael’s phone number:555-1212″ is metadata. It understands what the number is as well as how you might use it.

NTFS, while powerful, is nothing to the future power of WinFS (Windows Future System) which is based on relational databases to manage your data and storage of files. When the dev version came out last year it caught a lot of people by surprise since Microsoft had announced that WinFS wouldn’t be part of Longhorn (Vista’s codename). Our data recovery engineers and programmers are very impressed with the results.

Since we recover databases that get corrupt all the time, we have to have guys that are on top of the game. Our Exchange server recovery techs don’t have time to dig deep into SQL and visa verse. The one thing they both agree on is the new Vista and future upgrades to WinFS will be worth the money and time. This says a lot since most of them are open source guys to begin with. They treat Windows as a necessary evil at best.

As time goes on we will be keeping everyone up to date on Vista and the issues revolving around it.

The most popular of these seem to be Dell’s PC Restore by Symantec and HP Compaq’s PC system recovery. Let me take a moment to explain how these restores work. When your hard drive is installed at the factory and the operating system loaded, a very small semi invisible partition area is created at the beginning of the drive. This small partition usually uses about 2 gig of your drive and is used to store a compressed image of your machine as it was when it left the manufacturer. In other words, it takes a snapshot of how all the software was loaded and stores that in the tiny partition. If something happens to your operating systems and you can no longer get into Windows, you employ this partition.

In your documentation there is an explanation of how to get into you recover partition or diagnostic partition and is usually done by hitting F10 when you boot up. At this point you will be asked to make sure you have your data backed up and then you will be asked if you would like to restore your machine. If at the time you’re doing this you happen to be speaking with the manufactures technical support people they advise you to click yes and continue the restore procedure. Now, the party is over and from this point forward your data has become highly compromised, if not totally destroyed. Understand that the tech support at the manufacturer only cares about getting the PC back up and running and feel no responsibility to your data. This is an important point that must be clearly understood. They don’t care about your data or if you need hard drive recovery.

Ok so now you have run the system restore, you boot in to windows and low and behold all of your data is gone. Your operating system and applications have been restored to the original state and your data now resides in the Twilight Zone. The following are the steps you will need to take in order to try and recover some of your data files (ie .jpg, .doc, .mp3) for hard drive recovery.

Dell Compaq and HP System Restore feature and how to recover your data files.

1. Move the hard disk to another computer either via USB chassis or by slaving it to another PC. Please see DTI’s blog if you don’t know How To Slave A Hard Drive.
2. Purchase a piece of file carving or file harvester software for a raw file recovery. The piece of software that we sell that does this kind of data recovery is Fast File Finder the link will take you to the download page where you can download the demo. Like all of DTI Data Recovery’s software, it will show you your data before you buy it! We have a long list of file types that we can recover and hopefully yours will be on it. Data Recovery Software like this normally recovers many different types of data file formats.
3. Run a scan of the hard drive and see what files Fast File Finder locates.
4. Save the files to a different hard drive because you do not want to put any data on the hard drive you are trying to recover from. Let me say that again, do not save the data to the physical drive you are trying to recover data from.
5. Lastly, go through all the files that the raw file finder has recovered for you and see if your data is there.

If you had not defragged your drive in more then 2 weeks before the system restore a lot of the files will be corrupted due to file fragmentation. You can see DTI’s blog on how to set up a scheduled defrag so that in the event that this happens again you will be prepared. You will also notice you have lost all your directory structure and file names. It is unfortunate, but because you have a perfectly good working file system at this point, and all of the old information in the Master File Table, Partition Sector, and Master Boot Record have all been over written this is the only option. The best way to avoid hard drive recovery all together is to back up often!