Ooops...A little bit of data loss

loudbagel

loudbagel

Pre-takeoff checklist
Joined
Jan 16, 2011
Messages
102
Display Name
Display name:
Hummingbird Saltalamacchia
Friend was running outlook on an old fujitsu tablet pc, had tons of emails stored in folders that were pretty important.

I needed to clean out the PC so I backed everything up onto an HP simple save drive then wiped the computer.

Now we are trying to restore the outlook data on to a brand new dell laptop, after importing the only backed up files I could find all that is showing is the default folders and about 1000 deleted emails?

I have two .pst files one called outlook1 the other called archive

What am I missing? Did I lose the data? Is this guy going to kill me?:yikes:
 
Did you scan the drive for all *.pst files before making the backup?

-Rich
 
Have you looked in the hidden folders? I"m not on an XP machine right now, but it's hidden away about 10 directories deep. Look in C:\Users\(user name)\AppData\Local\Microsoft\Outlook\

Should be an outlook.pst file and probably quite a few MB in size (over 100 probably)

If not, you done screwed the pooch.
 
Depending on what was in those folders you may not have a friend anymore. :(

On the flip side, I guess he missed the memo that last weekend was World Backup Day and doesn't have any. So he must not have valued the data that much. ;)
 
First, open both of those files with outlook, he may have aggressively auto-archived his mail and they may be in the archive.pst file, you hope.

Second, you did back up the ENTIRE disk, right? Then you should be able to go digging through the backup and find any other .pst files.

If you didn't back up the ENTIRE disk before you wiped it... well I hope your friend is the forgiving type.
 
TMetzinger said:
If you didn't back up the ENTIRE disk before you wiped it... well I hope your friend is the forgiving type.
Click to expand...
Ruh-roh Loudbagel.

Oh well. Do you own a plane? You might want to get your will in order now... you can leave all aviation things to your friends on POA. :yesnod:
 
In general, it's usually not a good idea to wipe a drive until you're absolutely sure that everything important has been saved. Destroying data is easy. Getting it back, not so much.

I used to tell clients to take their old computer (or at least the hard drive) and lock it up somewhere for a few months, and then call me for disposal once they were absolutely certain they weren't missing anything important. Some older, specialized, proprietary apps in particular store their data in unexpected places; and if the tech isn't familiar with those apps, he or she may not think of looking there. Only once they were certain that they had everything they needed would I wipe the drive, reinstall some OS on it, and donate the computer.

In your case, if in fact you goofed and didn't back up all the .pst files, then we can hope that you made an additional mistake and didn't really "wipe" the drive. If all you did was an ordinary format, then the files most likely can be recovered. If you did a true wipe... well, then I'm afraid the files are gone.

If all you did was an ordinary format, however, then there are any number of utilities that have an excellent chance of recovering the data.

-Rich
 
I have learned the painful lesson of verifying backups are useable and complete, immediately after you make them.
 
My aircraft co-owner runs a computer shop. The vast majority of the time when the do a "clean-up", they upsell a new drive. They're cheap. Even after the flooding price jump.

The tech installs new drive and fresh OS on it, puts the old drive in an external enclosure and uses a bench machine to clean naughty things off of the old drive, and then migrates data and reinstalls applications on the newly installed disk.

The old disk and enclosure (usually USB) are handed back to the owner along with a laptop that has a newer bigger drive, everything reinstalled cleanly, and if anything was missed, it's still on the old disk.

Much safer way to reinstall than wiping their drive. And once the owner is comfortable that everything is there on the freshly loaded laptop, they wipe the USB drive and have a new place for backups and other stuff.
 
I always use something like Acronis True Image to take a partition-level backup, verify it (right on, Dave), and only then do I do nasty things to the drive itself. Doing this has saved my clients and I hundreds of times.

When I do forensics, the same thing applies. The seized computer or disk is imaged, then put back into evidence storage. The image itself is copied, and then we start work on the data. This is usually read-only work, but sometimes you might have to boot off the image which will alter data. The key thing on that kind of work is to always document every step you take, and to always be able to roll back for every step you take. This is why real forensics takes a lot longer than it does on NCIS. In the extreme, a forensics tech might have to re-do one or all of his steps in front of a jury or a judge. Fortunately there are good tools for this now that snapshot the image at every step. Of course, if you start with a 300 GB hard disk you may have 6 terabytes of image snapshots by the time you're done, and they all have to be retained until the case is closed. That was a fun trip down memory lane, now I remember why I don't do forensics except as a consult anymore.
 
I'll do nasty things to my own machines. I have to live with the consequences.

I won't mess with friend's machines without verified backups.

Too many "opportunities for excellence in data destruction" as we jokingly call it at work.
 
How i "wiped" the drive was by inserting the factory disk and setting it back to its factory new state...is this the type of thing where I could save the data?
 
If you didn't run some program that would write some pattern to the drive to be sure it was unrecoverable then the data is still likely to be there. You'll need some software to be able to sort it out.
 
I don't know if I would have insisted on a verified, full hard drive backup in this case -- and I'm about as much of a backup fanatic as you'll ever want to meet.

But it seems to me that this wasn't a repair job. My take from OP's description is that it was a routine migration from an old (but working) computer to a new one. I didn't always make full backups on those jobs, either. The documents, settings, favorites, and so forth, yes. But the whole drive? If I had no intention of doing anything to the old drive other than copying data from it, I might or might not insist upon it, depending on the circumstances and the client.

Most of the time, I backed up and copied all of the known data that the user wanted transferred, and then advised them to lock up the retired computer (or its hard drive) until they were certain that everything they needed had been transferred. Many times, I got called back when they remembered some oddball file that had been stashed in an even odder place.

I think the OP's error here was not the absence of a full backup, but rather being too hasty to wipe the drive. That (if done properly) is an irreversible action, and should only be done once it is absolutely certain that all needed data has been transferred.

-Rich
 
loudbagel said:
How i "wiped" the drive was by inserting the factory disk and setting it back to its factory new state...is this the type of thing where I could save the data?
Click to expand...

Maybe. It depends on whether the restore disk put data over your user's files. It probably formatted the drive prior to copying the OS back to it, so as far as the restore disk was concerned, the whole drive was formatted free space.

Best thing to do at this time is, first of all, don't turn on the computer; and secondly, find a data recovery specialist (or any decent tech who's done this sort of thing before) to scan the drive for the files. It doesn't matter that the drive was formatted. The only thing that matters is whether the files were overwritten in the OS reinstall process.

-Rich
 
If it's of any comfort, usually I was able to get back most of the data from accidental OS reinstalls, and one in a while, I was able to recover all of it. Again, the only thing that matters is whether the restore disk copied something over the place where your user's files resided. If not, they're recoverable. If so, then they're not.

Because a new install uses so much less of the hard drive than the old system did, your odds are actually not bad.

-Rich
 
You must log in or register to reply here.
Back
Top