Is there any way to find out how old a hdd is?

wow i had helped with something by finding this

Take a look at <Link hidden. Register for free to see this link!> which is free and it's what I'd start out with. It will give you a good idea of what's there, but whether it'll go all the way for you I don't know.

There are other tools we could try afterwards but that's a start. Do be sure you can get your D: drive contents back from that ghost image, you don't want to lose those files as well and it's easy to lose them where you're going.

What with that program?

hmm, sorry, it seems like f the words I typed for my last post didn't apper, it was ment to say "what do I do with that program"

I'm not sure, I've not used it and I don't have a Microsoft system so I can't get it and see what the menus are like. I'd go to Disk Management and, for the time being, take the drive D: letter off the 250GB drive so there's no way anything can be open on it. Then I'd download the TestDisk program and run it, it ought to tell you what it can see structurally on the 250GB partition table. It might offer to make changes, you need to decide whether what it's offering gets you closer to rebuilding your directories or not. Recovering your files depends on finding those directories and putting them into a state where you can copy the files they contain.

Take it a step at a time, don't rush any decisions, come back when you've seen something you're not sure about, there's several people here who can guess whether you're on the right track. If this doesn't get any closer we can pick on another tool but TestDisk is a reasonable start.

Images of steps I have taken:











Thats all i've done so far.

got to here now:

What should I do now?

anyone?

What we've seen is that there's a genuine intact 40GB partition sat there, nothing resembling table corruption and no hint of how it got that way.

Okay, if you want to go for it it's £35 for a download, it looks functionally similar to one I was using last year. Be warned though, it took me 3 days to bring back a guy's crashed filesystem (he had no backups either). What the package will do is surface scan the unallocated space looking for unattached directories, and then follow the links to check that the claimed filetypes are still showing the right signatures. It'll build a visible recovered directory structure and allow you to write the files it finds to a working drive - like your C: drive for instance. It won't write anything to the unallocated space so it's still non-destructive.

<Link hidden. Register for free to see this link!>

There's a demo version you can try before buying, it'll do the scan and tell you what's recoverable. That's worth giving a shot at before parting with the money.

The scan and analysis - when I ran it - was around 40GB an hour but your machine might be quicker than that. You can easily expect just building the list of what it finds to take 5 hours, running it overnight is a sensible compromise.

Ok, I have just downloaded the demo, and will try that, if it can find the stuff, I will think about buying it.

ok, i got to it like this:

Is that as far as it gets with the demo? because from there I can't see what files I will be able to get back, and which ones I won't.

Thanks

seemed like I just needed to wait for it to do something else, because I can look through the folders now, however it hasn't found anything more than anything else I have tried, nearly everything is still saying it's got 0 size. I can provide a print screen to show what I mean if you want.

Is it just looking at your drive D: instead of the unallocated space? I'd expect to have to tell it early on what sectors of the physical drive to try recovering from - sector 80041090 to the end of the disk, in this case.

The alternative is that all (or most, anyway) of your directories were on the physical disk space that's now inside your 40GB drive D: and those are what you're seeing, and they say filesize 0 because whatever cut your partition length left the data for those files outside the partition boundary and just said "that start address is illegal so we'll get rid of it". Not knowing how it happened is a real bind.

If you can get the scan to process just the unallocated space then we'll know, I can't think of anything that will pull back Word documents without the directory information (well, I can but they leave the text in a dreadful mess, sleuthkit and autopsy). Doing that's called Zero Assumption Recovery, there are programs to do it for graphics files (because so many people screwed up their camera memory sticks) but I've never seen one which recognizes Word files. It's why I started out asking if it was photos you'd lost so I could exclude using that.

Yes, thats exactly what it seems to be doing, however I thought I had told it to look at all the drive, I'll try again when I get back from college tomorrow, or rarther today, but I haven't got to bed yet, so it's tomorrow as far as i'm concerned

I have just tried doing that, however it can't seem to be able to find any other part of the drive.