Whoops - need data recovery help

[Dave Gundry]

Is there any way to recover data/files from a different computer's hard drive that were deleted (sent to recycle bin) on that computer?

My old laptop screen died or the video card is FUBAR'd, so I built a desktop. I backed up the files, but was messing around with swapping drives too much and repartioned all of them, except the original laptop drive. I had cleaned all the personal data/files from the laptop hard drive so I could sell it/bring it in to be fixed. To further complicate matters, the laptop drive was partioned with personal data on the D drive and OS on the C.

I can't get my girlfriends laptop (same model) to boot with my drive, but I can access the drive using a external USB enclosure hooked up to my desktop.

Any help is appreciated

[Rob Boudrie]

The windows NTFS file system "walks" the disk which means that new files are created in formerly unused space, and the old files tend to remain in place for quite some time (but some of the file name is trashed - I think the first couple of characters). This causes all sorts of havoc when dealing with thinly provisioned virtual drives (the weenies on this list will understand), and makes life hell for miscreants who thought they had delete the kiddie porn or plans to kill off their spouse, but can be a real datasaver for people in your situation.

The first rule, is DON'T SCREW WITH THAT DRIVE. The more you write to it, the more you risk rendering data unrecoverable. Your best first step is to make a forensic copy using a tool like Ghost or Acronis.

There are numerous commercial tools that are designed to "undelete" files deleted from an NTFS file system (and, in this case, I mean "deleted", not "in the recycle bin" in which case your job would be easy).

A quick web search turned up a few:

http://ntfsundelete.com/

http://www.winundelete.com/?rid=google&kid=wu0901

http://www.diskinternals.com/

If the files are still in the recycle bin, you will need to locate it on your drive (try Z:\Recycler where "Z" is the letter you mounted the drive as). You will need to configure the file system explorer to show hidden files, or use the "dir /a" command from the command window to see if any files are there. The names will be different, and the original names are stored in the hidden file INFO2 within the recycle bin.

A bit of googling will yield more details.

ps: If you really want to clean all personal data before bringing a PC in to be fixed

#1: Delete it all

#2: Empty the recycle bin

#3: Run a utility to wipe the free space. I recommend "sdelete" from the Microsoft Sysinternals suite:

http://technet.microsoft.com/en-us/sysinte...s/bb842062.aspx