Recover files from C drive after losing files from last two years

Discussion in 'backup, imaging & disk mgmt' started by NCP, Mar 18, 2015.

  1. Kurtis Smejkal

    Kurtis Smejkal Registered Member

    Joined:
    Mar 17, 2015
    Posts:
    253
    Location:
    Vancouver, BC
    I wouldn't say it's the users fault, far from, it's just how these things are. I would love for the snapshots to be more readily available, but sometimes that's not exactly easy with how the computer is.

    There are efforts being made to communicate this more clearly, so this isn't falling on deaf ears.
     
  2. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,236
    Location:
    USA
    In my situation (as posted in #23 above) I tried the Scavenger Tool before doing anything other than attempting to boot my PC a few times, so I certainly didn't change/move anything! It simply didn't work.

    However, the most important point I wanted to make was that my urgency had no apparent impact on HDS Support getting back to me. Other than acknowledging my support ticket it was weeks before I received another response from them, only to be told there's nothing that can be done (no reason given). Had pvsurfer not encouraged me to restore my most recent backup when he did, I might have waited for recovery assistance from HDS, which never materialized.

    Rollback Rx is magical until Windows 'steps on it', or some other conflict arises, or.... I guess the only answer are frequent image-backups which up to now has been a rather burdensome task with a RB system.

    Cruise
     
    Last edited: Mar 24, 2015
  3. MerleOne

    MerleOne Registered Member

    Joined:
    Mar 6, 2006
    Posts:
    1,336
    Location:
    France
    Hi,
    I would try a recovery program such as the excellent "R-Studio" from R-TT and see if it finds something (after a full & deep analysis, it can take several hours to complete, but if your files are there, there may be a chance R-Studio finds them).
     
  4. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590

    Only problem with that is that R-Studio looks for windows files. Rollback files aren't.
     
  5. MerleOne

    MerleOne Registered Member

    Joined:
    Mar 6, 2006
    Posts:
    1,336
    Location:
    France
    I don't know, if the file structure is the same then R-Studio can find them, and sort them according to their content (Word files, etc.). But file names will be lost in most cases.
     
  6. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Trouble is that it isn't. Snapshots in Rollback are store in sectors on the drive that the windows file system doesn't know about. Only the Rollback driver/filter knows what's where.
     
  7. MerleOne

    MerleOne Registered Member

    Joined:
    Mar 6, 2006
    Posts:
    1,336
    Location:
    France
    Well that's exactly the beauty of R-Studio and of equivalent tools, they can recover files even when they are not attached to any filesystem. The main issue is that recovery os often partial, you get many corrupt files, and you lose the filenames, but within the lot of recovered files, some are fully usable and you might get lucky.
     
  8. pandlouk

    pandlouk Registered Member

    Joined:
    Jul 15, 2007
    Posts:
    2,976
    Although that is true, with a RollbackRX system it can be tricky.
    All file recovery apps work by
    a) identifying the file tables on the deleted space (and using them to recover the files). This method is better suited to recover fragmented files.
    or
    b) by ignoring the file table altogether and identifying the file headers. This method is better suited to recover unfragmented files.

    With RollbackRX both the above methods work on relatively new RBRX installations. e.g. not so many RBRX snapshots were created/deleted, so both RBRX snapshots and as result the files and the file tables that reside in those snapshots are not fragmented much.
    With old RBRX installations were lots of snapshots were created/deleted/etc., both the snapshots and as a consequence the files, plus the file tables that reside inside them are heavily fragmented.
    RBRX's scavenger cannot load/recover the snapshots because they are heavily fragmented and cannot identify them correctly.
    File recovery apps that relay on (a) file tables, cannot identify them because they are scattered all over the place and as a result cannot recover files.
    File recovery apps that relay on (b) file headers, cannot recover files (except small ones) because they are fragmented. (the file does not need to be heavily fragmented, even 2 fragments are enough to get a corrupted recovered one).

    Bottom-line, the older the RBRX installation is and the more recent the snapshots are (were the important files reside), the less are the probabilities to actually recover anything from the drive/partition...

    Panagiotis
     
  9. NCP

    NCP Registered Member

    Joined:
    Mar 18, 2015
    Posts:
    22
    You know how I got into this mess? I moved a few background image files from Linux (HDD 2) onto my C drive (HDD 1) in the same desktop. I've done this same thing on a Dell Mini 10 laptop with a SSD that's partitioned with Windows and Linux Mint with no problems whatsoever. I do not have RBRX on that laptop but didn't know that was a factor in terms of file transfers between two drives (whether virtual partitions or HDDs).

    As TheRollbackFrog states in Post #5, I was probably cooked at that point, but had no idea since I never had a problem doing this before. In my opinion, when I perform a simple operation like that and a program that's supposed to restore my computer does the opposite and leads to the loss of data and snapshots, I have a hard time trusting that product or company again.

    Apparently, whatever RBRX does with snapshots and Windows files and MBR (and all the other intricate ways it works within Windows) is known to blow up in certain circumstances according to what I gather on the forums, not just here but across the internet. If it's not possible to redesign RBRX so these disasters can be avoided, then at least it would be nice to have some warnings about what instances could cause this kind of devastation. I suspect, however, that would be bad for business.

    I appreciate Kurtis' concern and response. I also got a quick response from HDS tech but all they could do was offer the scavenger tool which by most accounts doesn't work. I absolutely blame myself for not having backed up data in so long and for not using a newer edition of RBRX. I don't think I ever fully blamed HDS and admitted my fault earlier. I also must assign blame to HDS for being aware of problems users encounter that can lead to disaster and either not redesigning their product or not providing adequate warning.

    Back to data recovery:

    I cloned the affected NFTS Win7 HDD onto a portable external Touro drive and am scanning the clone with recovery programs. I've not touched, mounted, or activated the original drive. I'm booting into my 2nd Linux drive instead.
    I ran photorec from within Linux and got a ton of fragmented .mp3 files and unreadable .doc files with photorec. The original mp3's were 20, 30, 40 MB in length. Most of the recovered fragments were 4 kb, a few were bigger.
    When I ran a trial of GetDataBack on a live CD, I also got a lot of the same, especially unreadable .doc files, but according to directory tree info, the files were all dated April 2013 or earlier. Nothing was dated between then and now.

    Given Panagiotis' excellent explanation above, it sounds likely to me that there is a lot of fragmentation of the files as well as difficulty accessing and compiling the fragments due to MFT fragmentation or corruption. I'm just learning this stuff so correct me if I'm wrong. Even with 400 GB of missing data sitting in unallocated space of a 1TB drive (now occupied by 200 GB Windows installation and data with baseline RBRX snapshot state), If this is all fragmented and original files cannot be recovered without adequate MFT references, it's as if the data doesn't exist, correct? I want to be reasonably sure this is the case before I totally give up, backup data on the Windows drive as is, uninstall RBRX, rebuild with missing programs etc. and continue life as usual.

    I will try R-Studio for kicks.
     
  10. Keatah

    Keatah Registered Member

    Joined:
    Jan 13, 2011
    Posts:
    1,029
    It wouldn't be difficult, not in the slightest, to pop up a red warning dialog box that says a system should be backed up prior to installation. And then go into further detail introducing the sector-by-sector concept, imaging, and discrete individual copies of important files. Basically the importance of backups.

    These notifications could be updated instantly for all RBRX installers from this point forward. And there should be a clear concise warning on the web page. This isn't rocket science.

    Will they do it? No. Bad for business. And business & profit are more important than the safety and security of your computing environment. Can HDS prove me wrong and do the right thing by making such warnings easily visible?
     
  11. NCP

    NCP Registered Member

    Joined:
    Mar 18, 2015
    Posts:
    22
    I'm scanning my cloned disk with R-Studio on live CD. There are large areas color-coded "unrecognized." Does that mean there's no data there or is it just unallocated space? What parameters would I use to scan just the unallocated space and how can I know if the data is fragmented or not?

    I think I'll call it quits after this.
     
  12. pandlouk

    pandlouk Registered Member

    Joined:
    Jul 15, 2007
    Posts:
    2,976
    It means that either that has not finished scanning them or that it did not identify any files in those areas neither with the the file headers recognition nor with the file tables results.

    If your cloned disk has a partition select the partition and scan it. If it is displayed as unallocated space select the entire drive.
    In the scan settings use NTFS in the files systems and enable the box "extra search for known file types". Also enable the option save to file and point it to save the scan results on another disk or a usb flash disk (so that you won't have to perform the scan again if something goes wrong e.g. power outage or if you want to try several of the recovery results). You must let it to complete the scan of the entire surface to allow it to search for any mft it can find.

    ps. If you need help afterwards post a screenshot/photo of the scan result.

    Panagiotis
     
    Last edited: Mar 28, 2015
  13. NCP

    NCP Registered Member

    Joined:
    Mar 18, 2015
    Posts:
    22
    After scanning the entire windows partition of the cloned drive, I got a ton of files, as I did with Photorec and GetDataBack. I was most interested in the "Extra Found Files" which I suspect were carved out of the unallocated space.

    My problem is that most cannot be previewed for me to see that they are usable and intact.
    When I try to preview vast majority (ie. jpg, mp3, doc, pdf files) I get a "damaged or file format not supported" dialog box but I know those formats are supported. Here and there an old jpg photo would open in preview.

    Should I then conclude that most of the files are too fragmented/damaged to recover successfully? I'm not sure what other program to use and I don't want to spend $80 to recover two or three photos and that's it.

    I'm still trying to grasp how exactly RBRX got me to this point with how it works. Oh well.........
     
  14. MerleOne

    MerleOne Registered Member

    Joined:
    Mar 6, 2006
    Posts:
    1,336
    Location:
    France
    Sorry to hear that, it does mean that files were not successfully recovered. I have read somewhere here @ Wilders that HorizonDataSys proposes a recovery tool, usable from a bootable CD, file scavenger or something like that, did you try it ? Apart from that, I can recommend 2 other nice file recovery tools : Easeus' one, also PowerDataRecovery from Minitool, it is frequently proposed as free on Windowsdeal.com/Topsoftbargain.com/etc. Also there is Active@FileRecovery Pro from Lsoft but IMHO, R-Studio is the best so if you can't recover your file with it, I doubt you will get better results, except maybe with HDS special tool.
     
  15. TheRollbackFrog

    TheRollbackFrog Imaging Specialist

    Joined:
    Mar 1, 2011
    Posts:
    4,943
    Location:
    The Pond - USA
    MO, he's tried 'em all <sigh...>...
     
  16. pandlouk

    pandlouk Registered Member

    Joined:
    Jul 15, 2007
    Posts:
    2,976
    From the extra files you won't recover much (same as photorec).
    You should be more interested in the virtual partitions that it discovered, review their file/folder structure and see if the files that you are interested exist in any of the partitions.

    Panagiotis
     
  17. Keatah

    Keatah Registered Member

    Joined:
    Jan 13, 2011
    Posts:
    1,029
    @NCP You can ask HDS about getting the correct Scavenger version for your version of RBRX.

    In simple terms, the file system that you (and data recovery software) would be using to access the disk not totally aware of where things are located. And very likely there's a lot of fragmentation too. A natural thing. You need a recovery program that can find the file headers (most do) and then be able to look for the next piece based on what the data is like in the next fragment (very few do).

    Sort of like unmixing a phone book from a technical manual from a fantasy novel. All three will have distinct flavors and writing style and you can tell them apart very easily. Well you need a program that can do that for Jpegs.
    http://photo-recovery.info/recover-more-photos/
    http://digital-assembly.com/technology/whitepapers/
    I think it's only 20 bucks, but I recall years ago it being around $100.00, all hail competition for lower prices!!

    Try it and see what happens. The trial and test proof should be free.

    Something else to consider, the latest version of RBRX does encryption I think. If that's the case you're screwed then.
     
  18. MerleOne

    MerleOne Registered Member

    Joined:
    Mar 6, 2006
    Posts:
    1,336
    Location:
    France
    Well, Smartcarving from d-a.com is around $2000... Seems nice though.
     
  19. NCP

    NCP Registered Member

    Joined:
    Mar 18, 2015
    Posts:
    22
    I tried three scavenger tools including the one for my version of RBRX. They just don't work.

    I scanned only the logical C partition that I cloned off the affected hdd. I'll try scanning the original hdd in its entirety as pandlouk suggested, and look at any recovered partitions besides the windows one.

    I can't seem to preview files and don't know if it's because the files are corrupted or the live cd of R-Studio doesn't support opening pdfs, mp3s and the like. If I try the R-Studio Linux version and scan from within the Linux hdd, maybe I can preview such files? If I could preview and see they're intact, I would know if it's worth paying $80 for R-Studio to save them to disk.

    At any rate, this is my last shot at it. I really appreciate everyone's help. I will backup regularly from now on. I already have TeraByte's IFD/IFL/IFW but I might also consider Macrium Reflect v6 as TheRollbackFrog suggested. I see Panagiotis uses it too so it must be good. :cool:
     
  20. TheRollbackFrog

    TheRollbackFrog Imaging Specialist

    Joined:
    Mar 1, 2011
    Posts:
    4,943
    Location:
    The Pond - USA
    Morning NCP! There are many good backup programs that use imaging and the two above are excellent. I only suggested Macrium Reflect v6 if you want to continue to be a "snapshot" user. It's new Rapid Data Restore is excellent at that function, albeit it takes a bit longer to put the snapshots in place then using Rollback (but I can wait...)... and Macrium has always been an excellent imaging/backup tool with a great reputation.

    I have been using MRv6 for snapshotting ever since it arrived on the scene about a month ago. It is superior to AX64's Time Machine, IMHO, which I have been playing with since I stopped using Rollback RX v10.x a while back. At the moment, MRv6 has proven its metal as a snapshot provider and has always proved it as an imager.
     
  21. pvsurfer

    pvsurfer Registered Member

    Joined:
    Sep 1, 2004
    Posts:
    1,616
    Location:
    USA
    As long as you are using RBrx for snapshots there is no reason to buy MR6, as the Terabyte Trio is just as capable as MR6 for making image backups. That said, be sure to learn how to make successful image backups of a RBrx system!

    pv
     
  22. TheRollbackFrog

    TheRollbackFrog Imaging Specialist

    Joined:
    Mar 1, 2011
    Posts:
    4,943
    Location:
    The Pond - USA
    ...or (an alternative to PV's suggestion), TRIAL MRv6 and its Rapid Data Restore (on a non-RBrx system of course). If it fits your snapshot (speed) AND backup requirements, dump the app that destroyed you and move on to something a lot more stable and fully supported.

    ...or, wait even longer for something successful to emerge from AX64.

    -...or, ...or, ...or
     
  23. pvsurfer

    pvsurfer Registered Member

    Joined:
    Sep 1, 2004
    Posts:
    1,616
    Location:
    USA
    I'm curious Froggie, would you provide typical 'snapshot' timings (backup & restore) that you've been experiencing with MR6?

    Imho, that's like 'jumping from the frying pan into the fire'! :rolleyes:
     
    Last edited: Mar 31, 2015
  24. TheRollbackFrog

    TheRollbackFrog Imaging Specialist

    Joined:
    Mar 1, 2011
    Posts:
    4,943
    Location:
    The Pond - USA
    Well... OK! :argh:
     
  25. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590

    There was a new build of MR v6 this morning. All I can say is wow. On my setup: 129gb of data imaging to 2nd internal drive

    Full image time 14.5 minutes, incremental image averages 1 to 1.1 minutes

    Full Restore about 17 minutes. RDR restore: Last build 6 minutes, this build 30 seconds, yep you read correctly 30 seconds.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.