[thingie2]

Images of steps I have taken:











Thats all i've done so far.

[thingie2]

got to here now:

What should I do now?

[thingie2]

anyone?

[spot]

What we've seen is that there's a genuine intact 40GB partition sat there, nothing resembling table corruption and no hint of how it got that way.

Okay, if you want to go for it it's £35 for a download, it looks functionally similar to one I was using last year. Be warned though, it took me 3 days to bring back a guy's crashed filesystem (he had no backups either). What the package will do is surface scan the unallocated space looking for unattached directories, and then follow the links to check that the claimed filetypes are still showing the right signatures. It'll build a visible recovered directory structure and allow you to write the files it finds to a working drive - like your C: drive for instance. It won't write anything to the unallocated space so it's still non-destructive.

http://www.datadoctor.in/data-recove...-software.html

There's a demo version you can try before buying, it'll do the scan and tell you what's recoverable. That's worth giving a shot at before parting with the money.

The scan and analysis - when I ran it - was around 40GB an hour but your machine might be quicker than that. You can easily expect just building the list of what it finds to take 5 hours, running it overnight is a sensible compromise.

[thingie2]

Ok, I have just downloaded the demo, and will try that, if it can find the stuff, I will think about buying it.

[thingie2]

ok, i got to it like this:

Is that as far as it gets with the demo? because from there I can't see what files I will be able to get back, and which ones I won't.

Thanks

[thingie2]

seemed like I just needed to wait for it to do something else, because I can look through the folders now, however it hasn't found anything more than anything else I have tried, nearly everything is still saying it's got 0 size. I can provide a print screen to show what I mean if you want.

[spot]

Is it just looking at your drive D: instead of the unallocated space? I'd expect to have to tell it early on what sectors of the physical drive to try recovering from - sector 80041090 to the end of the disk, in this case.

The alternative is that all (or most, anyway) of your directories were on the physical disk space that's now inside your 40GB drive D: and those are what you're seeing, and they say filesize 0 because whatever cut your partition length left the data for those files outside the partition boundary and just said "that start address is illegal so we'll get rid of it". Not knowing how it happened is a real bind.

If you can get the scan to process just the unallocated space then we'll know, I can't think of anything that will pull back Word documents without the directory information (well, I can but they leave the text in a dreadful mess, sleuthkit and autopsy). Doing that's called Zero Assumption Recovery, there are programs to do it for graphics files (because so many people screwed up their camera memory sticks) but I've never seen one which recognizes Word files. It's why I started out asking if it was photos you'd lost so I could exclude using that.

[thingie2]

Originally Posted by spot

Is it just looking at your drive D: instead of the unallocated space?

Yes, thats exactly what it seems to be doing, however I thought I had told it to look at all the drive, I'll try again when I get back from college tomorrow, or rarther today, but I haven't got to bed yet, so it's tomorrow as far as i'm concerned

[thingie2]

I have just tried doing that, however it can't seem to be able to find any other part of the drive.