Lost Data

[arjunmujay]

~snip~
Paranoid people should turn off the Internet while data is being restored, and then remove the OS on which the recovery program was installed.

P.S. Don't forget to restore data to another disk (physical).

That's right, this is one surefire strategy if you use free applications available on the internet.
especially if the developer provides free access, even if it is not limited in terms of usage, it usually includes advertisements.
It is highly recommended to download directly from the software developer to avoid being exposed to malware which could result in your data being copied to third parties.
and when your data can be restored with this free software, immediately back it up to another hard disk or your other storage media.

[Yaqs15]

Oh my goodness  . He literally has made a very costly mistake. I too have come across some recovery technicians however all were online and therefore just like you mentioned I really can't recommend them since they don't guarantee safety of his data. I am not an expert anyways I think technicians have some way they can recover data from a formatted hard drive that is if the specific hard drive meets some certain conditions. I believe we have some nice tech guys on this forum who hopefully would be able to render some help.

I think most hard drive recoveries have to be done physically by the technician. Probably if it turns out so a technician here could guide him through a possible option for the restore process. +1 for you op for trying to assist him. I hope he is able to recover the data he lost.

 Data lose or lost data occurs either intentionally or unintentional. To prevent it from happening, I think the following ways can help if been adopted. which are;
 1.Update your files.
2.Protect your hardware.                         
3.Make sure your employees have knowledge about data leakage.
4.Make your computer clean always.
5.Application of antivirus and anti-malware software.
6.Develop robust security policies for devices and endpoints.
7.Ensure sensitive data is encrypted.
Keep software patches up-to-date.

OP, If your buddy chose the quick format path, odds are decent that most of the data might still be recoverable. But fetching those formatted bits is no sure bet and  whether the recovery sticks depends on how thorough the formatting was and what got written over those sectors in the meantime.  

Hard ware security is essential to prevent data lose. It should not be over looked.
While most data are now stored in the cloud, hardware devices are still necessary to access it. Those data, especially the critical ones that reside on them can be lost when damaged or compromised. Attentions need to be paid to them.  the following precautions need to be taken to avoid such from happening;
1.Anti-theft equipment needs to be installed.
2.Also install circuit breakers.

[348Judah]

By mistake, one of my friends formatted the hard drive partition (His intention was to format a flash-drive) that contains all his private files, including wallet backup files (not seeds), all files containing passwords and security codes that he uses on all platforms. Unfortunately, he does not have a backup copy of all the data except the seed words for his wallets which are hidden in a place that is currently inaccessible (family home in another country).

I think the one that could have been more costlier is when he completely loose access to his wallet private keys and couldn't have any alternative means as backup, but as the case maybe, he could have made a back as well on other devices on those files, or rather seek for the access top redownload some of those files and make recovery of his account or data with the same login details used, if he could manage to remember any.

My question is for the expert members about the most effective way to recover those files or about any reliable program that is available for free, because my friend does not have the ability to purchase paid softwares online.

I don't know if some features can be accessible from the MSDos to recovery such deleted files, there is a way deleted files are found on the recycle bin while some can be recoverable with the use of some certain command, but in this case, it was formatted, and this simply means a complete and total erase from the ROM which i don't think he may have the opportunity of recovering such data files again.

[Cricktor]

As decodx said, it's important to not use the formatted partition to avoid any further write operation by OS or whatever else.

Create a full image backup (bit-by-bit forensic copy) of the storage device. An image copy that only copies used data is completely insufficient after formatting a partition of full drive by error. You need a full sector-by-sector copy regardless of the content of the sectors on the source drive. Your destination drive for the forensic copy must be equal in size or bigger than the source drive.

Your forensic image backup is what enables you to always recreate the status quo before you attempt to recover any data. Any data recovery alters your source maybe to a point where it becomes unusable or even more damaged than before. Do not alter the forensic image backup!

The first recovery software might not be the best. You may have to try another one. Without the forensic image backup you can't restart from the beginning. Remember that!

Giving the recovery task to a professional could be a risk when crypto wallets are to be recovered (unless they have a decent good password or rather a not crackable one). The recovery professional might be tempted to steal your wallet and tell you recovery failed. Then what? Wouldn't be the first reported case...

OK, this isn't helping in this particular situation but I will ask it for other readers anyway: why do people not have backups, seriously? People have valuable data on their devices, sometimes worth a lot of money or personal value. Why don't you perform backups on a regular basis on another storage device to avoid hassle and losses like reported here?

I don't get it... No backups, no mercy! I know, truth is hard. (I had my share with a failing harddrive and my Bitcoin Core wallet on it; saving data before the drive died and recovery was no fun and took me a long time. It was the last time I had no good backups...)

[Kavelj22]

My question is for the expert members about the most effective way to recover those files or about any reliable program that is available for free, because my friend does not have the ability to purchase paid softwares online.

I have some experience with this because I have faced a similar situation before. Here's what I think based on my experience: The good news is there might still be hope for those files. Quick formatting a partition generally doesn't erase data from the disk, it just designates that space as "free space". The bad news is that if you are not an expert or technically proficient enough, you could do even more damage than the current situation.

Please do not share any suggestion that you are not sure of its effectiveness. It is best to make it based on your own experience/technical knowledge, because some mistakes may be fatal, whether a copy of the data will be stolen or may will be lost forever.

This is why it might be best to leave this job to an expert. To a professional who has a good track record. But if you still want to continue on your own, it's best not to do anything rash. Don't even turn on that computer again to avoid any possibility of further data damage. The key is to avoid writing anything new to the drive. Every write operation can overwrite the lost data permanently.

The first thing I would do is clone the entire drive to a new one. You'll need a spare hard drive with the same or greater capacity. Then, you need to connect both disks to another PC (desktop) and boot it with a specialized live OS version from a CD/DVD or USB flash drive. The last time I did this, I used Hiren's BootCD, which has all the necessary tools for these situations. There are probably some Linux distros that might work as well, but I haven't explored those. Once you clone the disk, you can then proceed with the recovery partition, but on the copy, not the original disk.

I would like to thank you for all the support I felt through your words and for the helpful suggestions that everyone will certainly get help from.

Initially, I will make an image copy of the formatted partition so that the files can be recovered independently and my friend can continue using his laptop at the same time. I may have convinced him to buy a new hard disk, but he still has a lot of data on the rest of the partitions that will require double the effort and time to transfer data to a new disk. With this in mind, I would like to ask you: Is it better to stop using the entire disk, or can he just stop using the formatted partition? Can using applications (Photoshop, Internet browsers...) on the same laptop contribute to more harm as well?

[Z390]

When you delete files from your harddisk they are not entirely gone, there is a chance that you can get them back but there is a catch.

I read comments saying you need a professional, I don't disagree but make sure you stay with them when they are doing their magic, those professionals also need money, if they find informations that can get them free money they will take it and you won't know.

Only to find out that your crypto wallet is empty, or even bank account, be very careful.
If you have idea about computers there is something you can do, actually many people don't know that they can get their files back themselves without the help of a professional, what they don't know is that free softwares don't get your files back or completely back.

Meaning you will lose some and get few back, all you need is a paid software, and you will see the magic difference between a paid software and a free software, I have struggled to get my files back and in the end I paid for a premium windows file recovery software which works perfectly.

Sorry it's been like 5 years in the past since I did it, I can't remember the name of the software anymore.

[Kavelj22]

I'm still waiting for my friend to have time to start working on the issue because I refused to make any attempt without him being present with me. He trusts me but I cannot afford to be honest because of the sensitivity of the data. My friend completely stopped using the computer according to your instructions. But I would like to get an answer from expert members for this question:

Is it better to stop using the entire disk, or can he just stop using the formatted partition? Can using applications (Photoshop, Internet browsers...) on the same laptop contribute to more harm the formated partition as well?

Cheers,

[Cricktor]

If I have a data recovery job to make, I would make as very first step a full forensic copy of the original storage or partition media. This is the baseline to which you always want to be able to return if you mess something up or before you try another recovery tool.
(Full forensic copy means a copy of all sectors irrespective of their content, you don't try to make any filesystem logic assumptions for such a copy; copy all sectors 1:1 from source to a backup destination drive)

Storage devices like harddisks aren't too expensive, so usually one can afford to have a forensic backup copy. If recovery data is more valuable, I'd have two independant forensic copies for redundancy.

You could hide and unmount the partition from the OS. Your basic goal is: no new write to the partition where data must be recovered. Again, I wouldn't want to risk anymore alterations to the partition/drive where data has to be recovered.

First step in my opinion and work ethic: forensic backup copy, period!


If I had data to recover that's worth the effort, this would be my work setup:
1. forensic copy on two independant backup drives verified by cryptographic hashes to be a 1:1 representation of baseline source drive.
1.1. one forensic copy is never touched and serves as emergency backup in case other forensic copy gets messed up accidently
1.2. no write operations on forensic image copy
2. make work copy on another storage media from forensic image copy
3. try recovery on work copy
4. goto step 2 if other recovery tools need to be used on fresh baseline or work copy gets messed up
(source drive can be returned to owner if needed (for a laptop of owner e.g.) or serves as work drive as long as it is intact and can stay at me)

[nakamura12]

Files are not lost when you format your PC, they're still in the hard disk but they cannot be accessed by the operating system. There are many free recovery tools are online, but I do not know how effective they are and I cannot recommend one for you. Also, you should reconsider paying for one instead of downloading it for free because you do not know the authenticity of the application whether it's infected with malware.

You forgot to include that if you use the computer or laptop then there's a chance that the file will be lost if it is overwritten with new file. If OP's friend decided to use a software to recover lost files then I won't recommend using the laptop to avoid what I just explained. What decodx posted is what I would do after cloning which there's a chance to recover important files from the hard disk that OP's friend accidentally formatted.

[arjunmujay]

Files are not lost when you format your PC, they're still in the hard disk but they cannot be accessed by the operating system. There are many free recovery tools are online, but I do not know how effective they are and I cannot recommend one for you. Also, you should reconsider paying for one instead of downloading it for free because you do not know the authenticity of the application whether it's infected with malware.

You forgot to include that if you use the computer or laptop then there's a chance that the file will be lost if it is overwritten with new file. If OP's friend decided to use a software to recover lost files then I won't recommend using the laptop to avoid what I just explained. What decodx posted is what I would do after cloning which there's a chance to recover important files from the hard disk that OP's friend accidentally formatted.

Yes, that's right, I've encountered cases like this with my friends. When the hard disk he owned was accidentally formatted and my friend tried to save data on the hard disk, all the data could not be restored easily.
Instead of trying to see if the hard disk still works by saving a new file on the hard disk, it turns out it can overwrite files that have been formatted. Until now I still can't recover the formatted files.

A few tips for everything possible, when your hard disk is accidentally formatted, don't immediately overwrite it with new files. It's better if you immediately take it to a technician to restore the formatted files.

[erep]

Files are not lost when you format your PC, they're still in the hard disk but they cannot be accessed by the operating system. There are many free recovery tools are online, but I do not know how effective they are and I cannot recommend one for you. Also, you should reconsider paying for one instead of downloading it for free because you do not know the authenticity of the application whether it's infected with malware.

You forgot to include that if you use the computer or laptop then there's a chance that the file will be lost if it is overwritten with new file. If OP's friend decided to use a software to recover lost files then I won't recommend using the laptop to avoid what I just explained. What decodx posted is what I would do after cloning which there's a chance to recover important files from the hard disk that OP's friend accidentally formatted.

I once recovered several files that had been deleted from a laptop using a free application, it is possible to recover 60% of the data that has been deleted if you immediately recover it using a file recovery application, but the recovery file will not overwrite files that are still on the laptop unless you restore those files. in the same folder and the file name is also the same, we can determine for ourselves which folder will recover the files. I tried using the window operating system and a file recovery tool application but I don't know on Linux, it's possible that they can recover files using certain coding commands without using the application.

[nakamura12]

I once recovered several files that had been deleted from a laptop using a free application, it is possible to recover 60% of the data that has been deleted if you immediately recover it using a file recovery application, but the recovery file will not overwrite files that are still on the laptop unless you restore those files. in the same folder and the file name is also the same, we can determine for ourselves which folder will recover the files. I tried using the window operating system and a file recovery tool application but I don't know on Linux, it's possible that they can recover files using certain coding commands without using the application.

That's only possible when you recover the files right away but if what explanation above about when the files are overwritten by new ones then it is possible that you will no longer be able to recover the files. When a file is deleted it doesn't mean it is deleted because there's a record left that there's a file like that stored in the hard disk until it is replaced (overwritten by new files) which makes it really deleted. As explained, not using the hard disk will keep the record of the files that is stored before in the hard disk before it was formatted then it is possible to recover that's why it's better not to overwrite it with new files.