Best course of action when you lose data and have no backup?

Discussion in 'backup, imaging & disk mgmt' started by Keatah, Sep 5, 2013.

Thread Status:
Not open for further replies.
  1. Keatah

    Keatah Registered Member

    Joined:
    Jan 13, 2011
    Posts:
    853
    This situation doesn't apply to many of us here, we're all backed up and secure against disaster. But consider:

    What's the first thing one should do when they think (or know for a fact) that they've lost irreplaceable critical data? And have no backup..! Whether it be personal information or business information, whether it be user error, accidental delete, hardware failure.. the question is all the same.

    Now typically I tend to observe that people do the following:

    1- They do what the o/s tells them, sometimes that includes reformatting the disk that they're trying to recover!

    2- They blindly use some of the built-into-the-OS tools, like chkdisk. They do this because they were instructed by internet forums or people that sound knowledgeable but are not.

    3- They start using all kinds of DIY data recovery programs and then when those don't work they go back to the publisher of said programs and post a list of cringe & crawl-under-the-desk mistakes on their support forums. In my direct observation this is a "blind leading the blind" scenario. This happens mostly on free program's forums. People go there and come away more confused and in worse shape for having indiscriminately tried the offered solutions. These forums sometimes instill a false confidence in the hapless user. And this false confidence tends to make the user more adventurous and willing to take more risks. Ultimately this ends up in Destroy-It-Yourself.

    4- Call data pro-data recovery establishments and get shocked at the $1,500 bill. They then proceed to save up over the next months till they have enough to pay.

    5- Give up on it, lost cause, move along..

    6- Begin the long process of recreating what was lost.

    The internet is full of advice on how to effect recovery operations, but short on diagnostic material. Just how is one to know what tools and procedures to use? It is this imbalance that gets people into trouble more than anything else.
     
  2. gbhall

    gbhall Registered Member

    Joined:
    Jun 17, 2013
    Posts:
    51
    Location:
    Birmingham, England
    Excellent post. Made me both smile and wince. Big topic though.....
     
  3. MarcP

    MarcP Registered Member

    Joined:
    Jun 9, 2009
    Posts:
    708
    We had a major flooding event here earlier in the summer (southern Alberta). Some data loss events can't be recovered from if you don't have a proper backup strategy (cloud backup in this case).
     
  4. manolito

    manolito Registered Member

    Joined:
    Apr 23, 2013
    Posts:
    341
    There are many possible reasons why the data were lost, and there are at least as many ways to maybe get the data back. But there always is ONE ETERNAL RULE:

    Do not write to the drive at all. Boot from a live operating system without write access to the drive and make a dumb sector by sector backup to another HDD.

    From this point on you only work with the backup. You should make an assessment how valuable these data are early on. How much are you willing to pay to a professional data recovery service? How much time do you want to invest by trying different recovery software products? Sometimes it makes sense to just start from scratch and make sure this won't happen again.



    Cheers
    manolito
     
  5. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,013
    Location:
    on my zx10-r
    if you do loose data similar to manolito said DO NOT TOUCH THE DRIVE!!!!! leave it be until you are ready to attempt to recover the data. unless the drive is physically damaged in most cases the data can be recovered unless you used a tool like a shredder to delete it and even then many times i have been able to still recover data. but once the areas of the drive where you had the data that was deleted has been defraged or written over you stand little chance of getting any of that data back.

    what i do is dont boot to the drive at all i will take the drive and install it into another machine with a working drive for the os and then use the drive you are trying to recover data from as a second drive and i run it through a almost set list of programs i have found to work very well.

    i have had to recover data for many doctors, engineers and lawyers etc where someone accidentally deleted stuff. its one of the things we are known for in my area and get calls about this often which with all the backup and imaging tools today and with data that important it makes you wonder why people do not back there data up especially in those type of fields. we have even had the local paper call us to recover one of their drives one time. its just so surprising to me!! we only use either local or off site backups but i do not use cloud backups at my own business'. call me old fashioned but im still not trusting enough with full cloud storage yet.
     
  6. guest

    guest Guest

    What I did when my computer was totally screwed up years ago. Even until now I'm not sure if I have all of what I used to have. :(
     
  7. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,516
    Disk image, recover deleted files, maybe try chkdsk, professional service if that important, and rebuild the rest.
     
  8. Aryeh Goretsky

    Aryeh Goretsky Security Expert

    Joined:
    Apr 4, 2006
    Posts:
    54
    Location:
    United States
    Hello,

    I always prefer to take the "do no harm" approach. Recommend the person contact a professional data recovery service, or failing that, perform a sector-by-sector imaging and work on that to recovery lost data.

    Then, set up a backup process for them to ensure it doesn't happen again.

    Regards,

    Aryeh Goretsky
     
  9. ams963

    ams963 Registered Member

    Joined:
    May 3, 2011
    Posts:
    5,965
    Location:
    Parallel Universe
    Sit and cry?......:argh: :argh: :D
     
  10. 0strodamus

    0strodamus Registered Member

    Joined:
    Aug 23, 2009
    Posts:
    1,047
    Location:
    United Surveillance States
    Whether it's me or someone else, I typically laugh and say "That's why you should back up your data you idiot!". Then I break out the tissues. :D
     
  11. legacy

    legacy Registered Member

    Joined:
    Sep 21, 2011
    Posts:
    87
    Well having been in a similar situation, normally i would say

    "Get the kettle on, its gonna be a long night, A big panic!!!"

    :D
     
  12. roger_m

    roger_m Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    5,254
    I've had good success at cloning damaged hard drives, with the result being that the clone will be bootable and working fine, even when the Windows won't boot or has issues on the original drive. Of course, you can't expect this.

    I've had problems a number of times in the past due to failing hard drives, or badly corrupted Windows installs, and due to not having a backup I've had to do a clean install of Windows. The issue for me has not usually been data loss, but the fact that I have to start from scratch with Windows which really annoy me, as I prefer to never ever do a clean install.

    These days I do occasionally make images of system to be used in case of hard drive failure. Any other issues or infections I experience I always fix, rather than restoring from an image.
     
  13. Keatah

    Keatah Registered Member

    Joined:
    Jan 13, 2011
    Posts:
    853
    I'd rather "Nuke it from Orbit, It's the only way to be sure.." when it comes to virus and malware. Not that I get frequent infections or anything. Last time my system inadvertently contracted something was back in 2008.

    With all the variants and packages out there, I'd rather just restore from image. This gives me 100% perfect results without the need for time-intensive research.
     
  14. roger_m

    roger_m Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    5,254
    If I clean a system and there are no obvious signs of any infection remaining, I consider the system to be clean.
     
Loading...
Thread Status:
Not open for further replies.