PeaTea87 said:
My home pc crashed the other day and now the Hard Drive has reset back to the factory setting, which means every thing I had is now gone. Now I don?t really care how it happened but I was wondering if there is some program on the net I can download to get it back or should I just take the thing to a tech etc.
Thanks.
Some PCs from big OEMs have a "feature" that splits the hard drive into two partitions, with the second, smaller (often hidden) partition containing a drive image of the drive as delivered. In case of an unrecoverable error, it simply clears the main partition, which has the OS as well as all programs and all user files, and writes the original drive image, including registry and file allocation table. All the programs originally provided with the computer are there, but all your data are gone. Does this sound like what happened to you?
If this is the case, you may still be able to recover your data. The drive image should have been re-written into the exact same drive locations as the original data, so none of your data should necessarily have been over-written initially. Whether anything remains of your data depends on the technique of the format or clearing. No one really does low level formats any more - permanent markers are embedded into the drive media - but some high level formats actually write to, then read from, each byte of the drive to verify that each byte is still good; if it fails, the format writes around it and the bad byte is simply deleted from your available space. If that type of format was done, only a specialist can recover your data. Expect to pay thousands and get back only scattered fractions of your original data; this requires taking the drive apart and reading residual magnetic charge with extremely sensitive equipment.
There are two possibilities beyond a complete, disk-wiping, deep high level format. First is that the machine simply rewrote the registry, file allocation table, and the original drive image space. In that case, something like recuva may recover much of your data if it is done quickly. The files are there (less the first character of the file name) in a cohesive form to be recovered until they are overwritten by new data or programs, and should be easily usable when recovered. A program for recovering deleted files will scan for jump commands, then work backward to the first blank space. It will then give you all the file's name except for the first character, which you supply, and your file is restored. If done immediately your chances of recovering the file are excellent, but every program ran, every start-up cycle, every Internet session lowers your chances.
Second is that the machine did a quick format. In that case your file names and the files' cohesiveness are gone, but the actual stored charge (1 or 0) may still be there. A sophisticated program may be able to recover it, but probably in chunks you'd have to re-assemble. A program like Norton Utilities can search out chunks of data and can do very well on DOS and ASCII text documents, but do less well on modern compiled formats such as used for music, video, office documents, etc.
Your first step is to stop using the crashed computer immediately. By phone or using another computer, contact your PC manufacturer's tech support and tell him exactly what happened and what you want. He or she should be able to explain what kind of process occurred and your chances of data recovery. Once you have that, you can decide how much your data is worth. One step you could try is Norton Utilities; I think you can boot from the CD for recovery. But I've not used it in years so I can't say for sure.
OPTIONAL TECHIE STUFF
Your basic problem stems from how files are stored. If there is room, each file is stored as one continuous chunk of data. However, usually programs reserve blocks of hard drive space for temporary data while running. When the program is terminated, some of the data is saved, but most of it is no longer needed and its hard drive space released. The next program ran or file saved takes up this released space, but now it's no longer continuous; parts of the continuous block of data were saved. When a datum (a file or a block of temporary data generated by a program) is saved on the hard drive, it goes to the first available block of drive space and this address is recorded in the file allocation table. When space within that block of data runs out, the system searches for the next available block of space. The last couple of bytes in the first block written is a jump command to the address of the second block. The remaining data is then written to the second block. If that block is too small for all the remaining data, the process repeats. Thus the drive gets fragmented, with new files being split into more and more pieces. De-fragmentation software reverses this process and attempts to make files continuous.
