Nightmare scenario - lost data from primary & backup! Please help with suggestions!

[mooo]

My whole body was shaking when I realized what I had done...I may have now lost 10 years worth of files and data due to my stupidity and a bizarre sequence of events.

Please help by suggesting my best course of action and best data recovery software to try!

Here is the short story and situation:

I have one disk (WD 120GB) with all my data and a WinXP Pro install, This disk went through a defrag process with Norton Speed Disk that was stopped midway - stopped cleanly, but then Windows crashed a short time later (possibly due to a bad memory module). I put the disk through many chkdsk runs resulting in many chkdsk errors found; finally chkdsk gave up saying that the volume had unrecoverable errors. Following this, I did a fixmbr and fixboot on the disk using the WinXP CD Repair option. This disk also possbily got formatted by the WinXP install procedure of using the Quick NTFS Format option.

I have another disk (Maxtor 160GB) which has a bit older data, which also got inadvertently subjected to the WinXP install procedure of using the Quick NTFS format option. This disk had my slightly older data along with a corrupt WinXP installation from long ago.

What are my best options to recover my data? Please provide your suggestions and thoughts! Any suggestions/experience will be welcome.

I have come across the following programs to recover data. Has anyone had good or bad experiences with them? Can anyone suggest the best one of these or any other recovery program?
recovermyfiles.com
Runtime Software runtime.org/gdb.htm


_______________________________________________

Here is the long story with a sequence of events.

I bought a new DDRAM module - Corsair XMS 1GB, to match the 512MB Corsair module that I already had.

Installed the memory module, passed POST check, and booted into Windows without a problem. After about 10 minutes of normal usage, I concluded that the module was working fine! This may have been my most stupid moment! What happened to my skills in putting memory modules through night-long Prime95 tests before belieiving it to be good?!

Decided to get my system to work even better by defragmenting the drive and optimizing the files using Norton Speed Disk. I have always been very careful and conservative in the past with defrag programs, always allowing them to complete and not attempting to pause or stop them. This time I was lured by the Stop Optimization button on Speed Disk, and decided to use it in order to allow my wife to use her account on the computer for a bit. Speed Disk stopped without complaining and also closed without any issues. I was thoroughly impressed!

My wife logged into her account, and was in the middle of a Skype session when the audio went out. I closed Skype and restared it only to get a whole bunch of "access violation" messages. This should have triggered my brain into suspecting the memory module, but in my foolishness, I decided that the best thing to do would be to restart Windows. Windows did not startup. It got to the WinXP logo screen and BSDed with a recommendation to run chkdsk on the next boot.

I assumed that this would be a good course to take, since the last file that Speed Disk was optimizing was probably left hanging, and chkdsk could correct it. So I ran chkdsk on the next boot up in Safe Mode with Command Prompt. Chkdsk informed me that it could not run immediately, and would do so at the next restart. I restarted and it did run. It found a _whole bunch_ of errors, got past checking files and got to checking indexes and then simply hung.

I tried resetting the system and running chkdsk again only to get a hang or a BSD. Same result with using chkdsk from the WinXP CD Reair option.

I could possibly still recover data from a old Maxtor 160GB drive that I had with somewhat dated data. This disk had a corrupt WinXP install along with all my data from a few months ago. It was from this disk that I had recovered from my previous WinXP crash. The files were accessible but Windows was corrupt on this disk. I had about 50 GB of unpartitioned space on this 160GB disk, so I decided to try and format this and install WinXP into it. While attempting to run the WinXP install, and formatting this unpartitioned space, I selected the unpartitioned space shown under F: and chose to format it with the Quick NTFS option. When it started partitioning however, WinXP showed me that it was formatting the C: drive - my primary WD 120GB drive that had just crashed! Very weird. In retrospect I think this was related somehow to WinXP's inability to recognize disks larger than 137GB. I was pretty sure I had selected the upartitioned space, and yet it was reformatting my primary drive on C:! Or at least it was saying so.

I decided that the next best thing to do would be to break my Raid 1 mirrored Maxtor 300GB set and use one of it temporarily to install WinXP and get a bootable system. If I did that, I could then recover data from my Maxtor 160GB though the data was from a few months ago. To be careful, unplugged the power from all other drives but one Maxtor 600 GB. By this time my mind was numb and my eyes were not looking at the screen properly, and I was getting pressed for time, as I had to catch a flight in a couple of hours. Instead of the 300GB I had connected the 160GB. They look so similar on the POST screen that stays up for just a second, and I didn't notice this blunder. Without noticing it, I went ahead into the WinXP Install procedure, and formatted the drive. I used the Quick NTFS format option, and when the format began I saw my blunder as it informed me the progress of formatting my 160GB drive - the drive from which I was hoping to restore my data! I was banging my head against the wall for 2 minutes upon realizing this. I had just lost the backup copy of 10 years worth of files and data! My body was literally shaking for 15 minutes before I could compose myself into thinking about what to do next.

As I retrospect, I am not sure as to whether the problems were caused by the bad memory module or by Norton Speed Disk. Perhaps it was a combination of the two. I am not even 100% sure that the memory module is really bad. Very poor show on my part in not testing hardware out before trusting it; even worse of a show in not backing data up before attempting a defrag using software that I had never used before; and inexcusable stupidity in stopping the defrag process midway, without ever having verified before that it is okay to do so.

I am dearly hoping that one of the data recovery programs can restore some of my data for me. Any thoughts, ideas and advice on the best data recovery programs/procedures would me much, much appreciated!

I write this long post so that at the very least my story will lodge in the minds of some readers, and will cause them to be cautious when they do dangerous things like I did. The single most valuable lesson from this was to not embark upon such things when you are pressed for time. Never, never let the clock make you adopt a hurried attitude - this inevitably results in serious errors in judgement.

[cloasters]

Welcome to AOA Forums, mooo. I wish we "met" in more felicitous circumstances!

Using anything Norton is prohibited in my book and any "Quick" format is also. Hopefully someone will suggest a good HDD recovery program. If that won't work most of the data on the drive will probably be recovered by a professional outfit. AFAIK, there's an outfit in Florida that'll get most of the data from the drive, for about $600.

[Strongwolf]

Do not write anything on the disk until you recover your data. I had Search and Recover 3 from Iolo but haven't use it yet. Sorry.

[Gizmo]

I'm no data recovery expert, but I've managed to recover a few drives (even in failed RAID arrays). I have to say that I suspect your best bet at this point is to send it to a data recovery house along with a detailed explanation of what happened.

The drive that has been repartitioned and formatted is basically toast unless you want to spend some serious bucks, IMO (we are talking into the thousands of dollars). The drive that you did the quick format on can probably still get most of your raw data, but restoring the file structure will likely be very difficult. Again, your best bet (IMO) is to send it to a data recovery outfit, and the folks Cloasters mentions can probably handle that for the $600 figure.

Again, I'm not a data recovery expert, and the last time I had need of such services was about 8 years ago, so things have probably changed a lot since then.

[Toro]

if its just a quick format, its probably only removed the file pointers, and hasn't actually erased anything... your files will remain there (although you won't know they are there cos they have no pointers), until you write over them. There are programs out there that can recover from this, but it takes a long time, and even then it may not get files back in good condition. Data recovery is a pricey business if you want to take it further than that. I know here in the UK it can be £2k, but I haven't done extensive (or any, other than listening to passing comments) research into this.

[Áedán]

The long format option effectively writes over each sector on the disk. The only way you can recover data from it is by sending it off to a professional lab.

The drive that has been quick formatted might be in a better state. However, the first rule of any type of recovery using just software is to NOT USE THE ORIGINAL DISK! That means you need to work on a copy of the disk (Linux DD can do this happily for example). Intelligent copiers will not work, as they'll assume the filesystem that's on the disk is valid. (Encase will work really well, but is stupidly expensive for what you want)

Then you can run a recovery program like "RecoverMyFiles" on the copy of the disk. It'll take a very long time, as basically it works by scanning each sector on the disk to see if there's any kind of file allocation structure there. Note that some tools work best on FAT, and others on NTFS. Which file system was on the older disk?

[mooo]

Thanks everyone, for the suggestions. I didn't realize that the recovery programs would/could write to the disk, and I should first copy the entire disk before trying anything.

Given the cost of the a recovery shop vs. a spare drive + recovery software, I think I will try recovering using software first.

Originally Posted by Áedán

Note that some tools work best on FAT, and others on NTFS. Which file system was on the older disk?

It is NTFS. Both drives are NTFS.

I find this marketing claim from GetDataBack (Runtime Software) to be tempting to believe:

Get everything back-

Advanced algorithms will make sure that all directories and sub directories are put together as they were, and that long file names are reconstructed correctly.

[Samuknow]

I use a program called file scavenger and it has managed to recover data after a format. recovered most of the date after a repartition once also. It is a mere 40 bucks or so. Once you write to the drive it becomes more difficult to recover the data.

[dolanenwindrift]

Ok first I must echo the sentiment of DON'T USE NORTON! I would strongly suggest you get yourself a copy of Spinrite 6.0 - available at www.grc.com - as it has excellent capability at recovering data from ALL types of partitions. It isn't cheap, but WELL worth the money.