SHIT... File Recovery? V.CrazyJon

I use mozilla thunderbird as a mail client on my home PC. Last night, after having some really goofy stuff happening to my computer, I decided to re-format. I used a mozilla backup utility to backup my Thunderbird emails/account settings/ect aswell as all my firefox bookmarks/settings/ect for an easy re-install (I’ve used it dozens of times without a problem).

well, my main HDD was split into 2 partitions, 100 GB and 80GB… I decided that I didn’t need all that space on the C: drive, so I deleted both and resized C: to about 70GB and used the rest of the space on the D: drive. (did a “quick format” to both BTW)

When I finally re-installed windows and got everything back up and running, I realized that my thunderbird backup file was actually saved to the my documents folder, not to the G: drive where the Firefox backup was and it’s obvously long gone now.

I downloaded a little freeware file restore program, but when I search drive C: or D: it doesn’t give me any kind of listing for any files I can un-delete. Likewise, I tried looking on E: F: and G: for an older backup that I’ve done (I usually re-format once every few months) but no luck with the exception of 2 firefox backups.

Can you reccomend me a way to get this back? Or any software I could use? I have alot of stuff in my email that I really don’t want to loose (moonlighting projects and contacts most importantly). The really shitty part about it is that I have gmail setup to delete emails once they’re downloaded via thunderbird.

fuck
-steve :tdown::tdown::tdown::mad::mad::ohnoes::frowning:

When I finally re-installed windows and got everything back up and running

Once you install over it, its almost guaranteed to be gone. For $20 bucks I can run it through nCase, the FBI forensic problem but a specific file is going to be hard to find after you installed a new operating system and write to the drive.

damnit… I figured I’d get a response like that.

I’m just wondering why it’s not showing any files for the d: drive though. Was it because I deleted the partitions and re-created them? I may take you up on that man. I’ll get back to ya about it.

I’m such a tool…

Dont write anything to a drive. If you deleted the partition ,you might be able to rebuild the drives files.

Once you start to write a file on the drive, you start to lower the chances of saving anything.

[quote=“Dr.Stevil,post:3,topic:32254"”]

damnit… I figured I’d get a response like that.

I’m just wondering why it’s not showing any files for the d: drive though. Was it because I deleted the partitions and re-created them?

I’m such a tool…

[/quote]

Bingo…and Bingo.

[quote=“boxxa,post:4,topic:32254"”]

Dont write anything to a drive. If you deleted the partition ,you might be able to rebuild the drives files.

Once you start to write a file on the drive, you start to lower the chances of saving anything.

[/quote]

thanks man… I’m running this now (TestDisk Download - CGSecurity) in hopes that it’ll find it. If not, I’ll be pm’ing you

thanks again

lol steve, sorry to hear about that

[quote=“Dr.Stevil”"]

I use mozilla thunderbird as a mail client on my home PC. Last night, after having some really goofy stuff happening to my computer, I decided to re-format. I used a mozilla backup utility to backup my Thunderbird emails/account settings/ect aswell as all my firefox bookmarks/settings/ect for an easy re-install (I’ve used it dozens of times without a problem).

well, my main HDD was split into 2 partitions, 100 GB and 80GB… I decided that I didn’t need all that space on the C: drive, so I deleted both and resized C: to about 70GB and used the rest of the space on the D: drive. (did a “quick format” to both BTW)

When I finally re-installed windows and got everything back up and running, I realized that my thunderbird backup file was actually saved to the my documents folder, not to the G: drive where the Firefox backup was and it’s obvously long gone now.

I downloaded a little freeware file restore program, but when I search drive C: or D: it doesn’t give me any kind of listing for any files I can un-delete. Likewise, I tried looking on E: F: and G: for an older backup that I’ve done (I usually re-format once every few months) but no luck with the exception of 2 firefox backups.

Can you reccomend me a way to get this back? Or any software I could use? I have alot of stuff in my email that I really don’t want to loose (moonlighting projects and contacts most importantly). The really shitty part about it is that I have gmail setup to delete emails once they’re downloaded via thunderbird.

fuck
-steve :tdown::tdown::tdown::mad::mad::ohnoes::frowning:

[/quote]

stop now. unplug your drive and pm me. reinstalling windows will not necessarily destroy files.

[quote=“boxxa,post:2,topic:32254"”]

For $20 bucks I can run it through nCase, the FBI forensic problem but a specific file is going to be hard to find after you installed a new operating system and write to the drive.

[/quote]

first of all. its not the fbi forensic program, its spelled EnCase and i happen to be certified to use it. who are you and why do you have a copy of encase?

[quote=“boxxa,post:2,topic:32254"”]

Once you install over it, its almost guaranteed to be gone.

[/quote]

wrong.

[quote=“Dr.Stevil,post:3,topic:32254"”]

damnit… I figured I’d get a response like that.
I’m just wondering why it’s not showing any files for the d: drive though. Was it because I deleted the partitions and re-created them? I may take you up on that man. I’ll get back to ya about it.

I’m such a tool…

[/quote]

once you change the file system of a physical device you change the MFT, which is where … never mind. ya. you messed with the drive = your files are “lost”… think about it this way. you are in a library, and you take a card out of the card catalogue system… it will be a little hard to find the book, but its still there.

[quote=“boxxa,post:4,topic:32254"”]

Dont write anything to a drive. If you deleted the partition ,you might be able to rebuild the drives files.

Once you start to write a file on the drive, you start to lower the chances of saving anything.

[/quote]

true

[quote=“Dr.Stevil,post:6,topic:32254"”]

thanks man… I’m running this now (TestDisk Download - CGSecurity) in hopes that it’ll find it. If not, I’ll be pm’ing you

thanks again

[/quote]

STOP NOW. if you care about your data. dont run anything on this drive.

eh… it’s my fault. It usually defaults to save it in my documents, not where I did the last backup. I guess I shouldn’t have been doing it half in the bag lol… probably would of caught it

you can run recovery software on the drive, but you will be writing to it. do you have access to a Linux box where you can dd the physical device?

jon… pming now

edit: yes, I have a linux box running ubuntu

You install windows over the wrong sectors where the file was stored, you are going to lose the file and remove any chance of recovering the file. Thats why they use the hard drive adapter that prevents writing ANY data to the drive when running EnCase. If your drive was fragmented and you are writing data all over, it might be there still.

not sure if it helps me any but I still had like 50-something gig’s free on c: (probably not though)

here is a log from the test that ran

Thu Jul 12 09:20:44 2007
Command line: TestDisk

TestDisk 6.7, Data Recovery Utility, June 2007
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Windows version (ext2fs lib: 1.39, ntfs lib: 9:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20070512)
Using locale ‘C’.
filewin32_getfilesize(\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\.\F:) SetFilePointer err Incorrect function.

Warning: can’t get size for \.\F:
file_read(4,1,buffer,625153409(38913/254/63)) lseek err Invalid argument
file_read(5,1,buffer,390716864(24320/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdb - 200 GB / 186 GiB - CHS 24320 255 63, sector size=512
Drive E: - 364 MB / 348 MiB - CHS 87 64 32, sector size=2048

Disk /dev/sdb - 200 GB / 186 GiB
Partition table type: Intel

Analyse Disk /dev/sdb - 200 GB / 186 GiB - CHS 24320 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 10199/1/1
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
1 * HPFS - NTFS 0 1 1 10198 254 63 163846872
2 E extended LBA 10199 0 1 24318 254 63 226837800
5 L HPFS - NTFS 10199 1 1 24318 254 63 226837737
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0

search_part()
Disk /dev/sdb - 200 GB / 186 GiB - CHS 24320 255 63
NTFS at 0/1/1
filesystem size 163846872
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 10240429
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 0 1 1 10198 254 63 163846872
NTFS, 83 GB / 78 GiB
NTFS at 10199/1/1
filesystem size 226837737
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 14177358
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 10199 1 1 24318 254 63 226837737
NTFS, 116 GB / 108 GiB
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results

  • HPFS - NTFS 0 1 1 10198 254 63 163846872
    NTFS, 83 GB / 78 GiB
    L HPFS - NTFS 10199 1 1 24318 254 63 226837737
    NTFS, 116 GB / 108 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 10198 254 63 163846872
2 E extended LBA 10199 0 1 24318 254 63 226837800
5 L HPFS - NTFS 10199 1 1 24318 254 63 226837737

search_part()
Disk /dev/sdb - 200 GB / 186 GiB - CHS 24320 255 63
NTFS at 0/1/1
filesystem size 163846872
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 10240429
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 0 1 1 10198 254 63 163846872
NTFS, 83 GB / 78 GiB
NTFS at 10198/254/63
filesystem size 163846872
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 10240429
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 0 1 1 10198 254 63 163846872
NTFS found using backup sector!, 83 GB / 78 GiB
NTFS at 10199/1/1
filesystem size 226837737
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 14177358
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 10199 1 1 24318 254 63 226837737
NTFS, 116 GB / 108 GiB
NTFS at 11472/254/63
filesystem size 184313682
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 11519605
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 0 1 1 11472 254 63 184313682
NTFS found using backup sector!, 94 GB / 87 GiB
NTFS at 11473/1/1
filesystem size 102398247
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 6399890
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 11473 1 1 17846 254 63 102398247
NTFS, 52 GB / 48 GiB
NTFS at 12747/254/63
filesystem size 204796557
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 12799784
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 0 1 1 12747 254 63 204796557
NTFS found using backup sector!, 104 GB / 97 GiB
NTFS at 12748/1/1
filesystem size 185888052
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 11618003
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 12748 1 1 24318 254 63 185888052
NTFS, 95 GB / 88 GiB
NTFS at 24318/254/63
filesystem size 226837737
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 14177358
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 10199 1 1 24318 254 63 226837737
NTFS found using backup sector!, 116 GB / 108 GiB
NTFS at 24319/254/63
filesystem size 71681967
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4480122
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 19858 1 1 24319 254 63 71681967
NTFS found using backup sector!, 36 GB / 34 GiB
get_geometry_from_list_part_aux head=255 nbr=14
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=3
get_geometry_from_list_part_aux head=64 nbr=3
get_geometry_from_list_part_aux head=128 nbr=3
get_geometry_from_list_part_aux head=240 nbr=3
get_geometry_from_list_part_aux head=255 nbr=14

Results
D HPFS - NTFS 0 1 1 10198 254 63 163846872
NTFS, 83 GB / 78 GiB
D HPFS - NTFS 0 1 1 11472 254 63 184313682
NTFS found using backup sector!, 94 GB / 87 GiB
D HPFS - NTFS 0 1 1 12747 254 63 204796557
NTFS found using backup sector!, 104 GB / 97 GiB
D HPFS - NTFS 10199 1 1 24318 254 63 226837737
NTFS, 116 GB / 108 GiB
D HPFS - NTFS 11473 1 1 17846 254 63 102398247
NTFS, 52 GB / 48 GiB
D HPFS - NTFS 12748 1 1 24318 254 63 185888052
NTFS, 95 GB / 88 GiB
D HPFS - NTFS 19858 1 1 24319 254 63 71681967
NTFS found using backup sector!, 36 GB / 34 GiB

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting…
write_all_log_i386: starting…
No extended partition
Disk /dev/sda - 320 GB / 298 GiB
Partition table type: Intel

TestDisk exited normally.

[quote=“Locutus,post:8,topic:32254"”]

words to the effect of I’ll help ya

[/quote]

:tup: to that isht.

first of all. its not the fbi forensic program, its spelled EnCase and i happen to be certified to use it. who are you and why do you have a copy of encase?

Any program is available if you know where to look, ANY!

step away from the pc steve

[quote=“boxxa,post:12,topic:32254"”]

You install windows over the wrong sectors where the file was stored, you are going to lose the file and remove any chance of recovering the file. Thats why they use the hard drive adapter that prevents writing ANY data to the drive when running EnCase. If your drive was fragmented and you are writing data all over, it might be there still.

[/quote]

lol

ok i have 4 min to waste b4 i have to get some work done.

technically correct, but windows will install the same every time on a drive unless the drive has bad sectors. anddd the file will still be there unless he overwrote it. – which if he just did the install, hes most likely fine.

no offence, but what is your background?

[quote=“BuickGN,post:15,topic:32254"”]

Any program is available if you know where to look, ANY!

[/quote]

true. v4 leaked but they licence it with hasp dongles, so its near impossible to crack.

[quote=“Dr.Stevil,post:13,topic:32254"”]

Snip.

[/quote]

You have powered that drive off and unplugged by now. Right?

well… no, not yet… I’m at work.

actually… n/m… doing it now via logmein