A weird idea for file recovery.

[aimeeandbeatles]

Okay, so I've been thinking about file recovery, and how files are difficult or impossible to recover if overwritten. And then I heard about "sandboxes" and got an idea...

So, let's say we have a hard drive which was accidentally wiped. Non-partitioned. What if we isolated the part that needs recovering into a "sandbox", so it can't be overwritten?

It probably not possible, because how would we know where the missing files were, physically, on the HD?

Or perhaps do it in reverse -- isolate the recovery program into a sandbox. But then it might not be able to get the files.

What are your thoughts on this idea? Is it stupid, or does it make sense?

Most likely stupid.

 

[Genocidicbunny]

Why not just run the recovery program from a different HDD or removable media? Thats what all recovery programs reccomend, so while creating a vault for the deleted data ( such that the areas of the HDD for recovery are inaccessable for write) would make things a tad easier, its not really necessary.

 

[aimeeandbeatles]

Yeah, but I only have one HDD and my USB ports are broken. LOL.

 

[Till]

You could designate an area of the hard drive specifically for recovery programmes. This space would have to be accessed over a different interface, which recovery programmes would have to implement.
This would require all programmes in question being updates, an agreement between harddrive manufactores, more complex HD firmware, and wouldn't work with existing drives.
A lot of downsides, especially considered that booting a live cd with the recovery software is much easier, perfectly save, and works with all drives.

I do love sandboxes, though - especially sandboxie.

 

[aimeeandbeatles]

Yeah, you can use a Knoppix CD to recover files if you haven't overwritten anything yet.

 

[Speedo]

Most professional-level file recovery programs will already require you to write any recovered files to a seperate location (I forget if the one I use requires a different physical drive or merely another partition).

 

[lndm]

If you knew where the file was you could simply partition around it, however it is prudent to stop all use of the drive as soon as you know ther are files to recover (even to the point of switching off at the power point to make sure the OS doesn't keep writing during shutdown).

With regards to a non-partitioned drive, all drives are partitioned....single virtual drive or not.

With regards to the drive being wiped, it depends whether it was the partition that was wiped, the file system that was wiped or the data area that was wiped.

With regards to the program running in a sandbox, this is as simple as booting from a recovery CD, as has been suggested. As long as the drive in question is not part of the active system and is not used by the active system, and during recovery procedures, asks you to confirm all writes to said drive, then there's your sandbox.

 

[Cutlass]

Not all drives are partitioned. They don't come that way. And once I lost the partitions I had made because somehow Windows corrupted the file that described the partitions.

 

[Turner]

Yeah, usually they are. Even Windows will create a small (about 8mb) partition when installing to a single drive. You could use GPartEd to see the partitions. I always wondered exactly what this was for. I figured it was some kind of cache on the very inside tracks.

 

[Zelig]

Not all drives are partitioned. They don't come that way. And once I lost the partitions I had made because somehow Windows corrupted the file that described the partitions.

Pretty sure he was just referring to the fact that even an "unpartitioned drive" is a single large partition.

I'm not a fan of partitioning for data organization. With my RAID 0 arrays, I get to drastically cut down on the number of drive letters I deal with.

 

[Speedo]

IMO multiple partitions are generally best avoided. They don't really do squat to protect your data, and they artificially increase seek times for the disk.

 

[Genocidicbunny]

Well, I find it helpful to create a separate partition for your OS/Programs, in case the OS becomes corrupted and you need to format. But besides that, extra partitions just make things a lot more complicated.

 

[Speedo]

Well, I find it helpful to create a separate partition for your OS/Programs, in case the OS becomes corrupted and you need to format. But besides that, extra partitions just make things a lot more complicated.

Even that isn't worth the trouble IMO because it's such a pain to go back and rebuild all the registry settings that most programs need. A better option is to use Ghost, Acronis or something similar and make an image of a clean OS install with your primary programs set up and ready to go.

 

[lndm]

As I think Zelig was explaining. I was saying that you cannot create a single drive without putting a partition around it. That's the rules.

 

[Genocidicbunny]

Even that isn't worth the trouble IMO because it's such a pain to go back and rebuild all the registry settings that most programs need. A better option is to use Ghost, Acronis or something similar and make an image of a clean OS install with your primary programs set up and ready to go.

My programs go onto that partition too.

Stuff like documents, movies, etc go on a separate partition.

 

[Cutlass]

Pretty sure he was just referring to the fact that even an "unpartitioned drive" is a single large partition.

I'm not a fan of partitioning for data organization. With my RAID 0 arrays, I get to drastically cut down on the number of drive letters I deal with.

No, a partition has a very specific meaning. i tried RAID, but the setup for it died and left me without it

 

[lndm]

FWIW, the original purpose of partitioning as it was created for the IBM systems, was to allow multiple operating systems on a machine with one physical drive.

 

[Zelig]

No, a partition has a very specific meaning. i tried RAID, but the setup for it died and left me without it

What? I know what a partition is, we were just saying you can't put any data on an unpartitioned drive.

 

[rick.flair]

If you wiped your hard disk through any data wipe software, then it is not possible to recover your data. But if it has been deleted or formatted then the data can be recovered by data recovery software. You can try Stellar Phoenix Windows Data Recovery to recover your lost files. I have used this software last year when I deleted my data accidentally. It is easy to use software. You can try the demo version first to see whether your data is recoverable or not. If you are able to view your data then you can get the full version of the software to save your data.