Recovering Files After Factory Reset?

Hey All,
A family member was having some browser issues, my cousin was going to take a look at it and ended up trying to restore back to a previously know good configuration, which was never originally set up, causing it to restore the system to factory settings ( I have no idea why they tried that) nothing was backed up before hand so all the data was gone. I retrieved what little I could via Recuva. Is there anything else I could try outside of professional data recovery?
Windows 7 Professional 64-bit.

Thank you,

Spock96

 

If there's a Windows.old folder the following will hopefully help.
https://www.howtogeek.com/130558/ho...-from-the-windows.old-folder-after-upgrading/

 

The Windows.Old folder is not there.
Thank you both for your input.

 

I experimented a little while ago with partition wizard, and managed to recover partitions back to the original setup on a laptop.
It takes a bit of careful use of the partition recovery part of Partition Wizard, as you need to remove a partition to roll back.
I you create recovery discs first from the laptop, then it could be worth the try.Partition recovery
http://www.minitool.com/partition-manager/partition-wizard-home.html

"Help users recover lost partition quickly:
Recover partition which is lost due to personal mistake, software error, virus attack, and other factors.
Support recovering partitions with different kinds of file systems like FAT and NTFS"


You have to decide which partition to roll back.
If it has a C, and D, AND A RECOVERY PARTITION, the you choose the C partition (usually the largest, but not necessarily) as the D partition is sometimes used as a data partition. The recovery partition is sometimes in this partition, so ensure a recovery set of discs is made of the factory setup.

https://www.partitionwizard.com/help/partition-recovery.html
I directed you to their site so that you can read up as much as possible before attempting it- otherwise you can download it from majorgeeks.
As I said, I have experimented with it, with some success, but read the partion recovery page before trying- they do a data recovery tool too, but I have not , personally used it.

 

If you consider that the original factory setup only covered the first 20-30 gb on the drive, then you could be lucky and the data you want may show up by doing the recovery partition with Partition recovery in partition wizard.

 

Hi,

The partition wizard experiments I'd recommend strongly against. First of all it's useless in this scenario and secondly it violates the rule of not writing to a disk you want to recover data from.

Professional data recovery can't do a lot more than what you can do with data recovery yourself in this case.

 

UPI, Please note that Spock96 asked if there was any way OTHER THAN PROFESIONAL DATA RECOVERY- which can be Very expensive

 

Partition Wizard writes nothing. It merely resets the partition table to an earlier state, of which there may be several, so as baklogic says, care is needed in selecting the partitions you want to recover. The OP has nothing at all to lose by trying it.

 

But it didn't really matter anyway, if after a factory reset Recuva got what it could, nothing else free will recover any more.

 

That's to assume that a factory reset resets every disk sector to its factory state. I've seen several systems with plenty of evidence that that is not the case.

 

Unless the owner changed the partitions from the factory state then it is still irrelevant. And my understanding of Recuva is that it scans every part of the drive itself - that's what Recuva says!

 

A factory reset may itself change the partition start and end points. There is nothing at all to lose by trying partition wizard, though I would not be too hopeful of recovering anything of the user's files though he could expect some surprises at what may actually be revealed.

 

Yes. And I just wanted to add that professional data recovery doesn't add real value in cases like these anyway.

 

There is zero chance. I edited my first partition table manually 20 years ago. 1000's of partition recoveries later I have a pretty good idea when it does, and when it doesn't make sense to edit partition tables.

A factory reset typically sets up the system exactly that way it was originally setup. When I worked for PowerQuest (no loner exists acquired by Symantec) we sold software to OEMs that did exactly that. It's just a scripted image restore. With modern Windows setups it can also be a scripted Windows install. Point is, that the system was setup using the same script the first time as well.

Even if partition boundaries were slightly altered, the restore over writes large portions of the 'old' file system.

So file recovery software is the only hope left. Recuva is kind of a poor choice here as it will assume file system parameters as it finds them. So, in the case of slightly altered file system parameters, it will get it all wrong. Recuva may however still recover data by falling back to RAW recovery: rather than relying on file system structures, it scans for typical file characteristics (magic numbers) which can help it finding JPGs, PDFs and such. Drawback of RAW recovery that filenames and directory structure can not be recovered and that the software had to know the specific file type format.

An alternative for doing a RAW recovery could be Photorec (maybe it supports more file types). And also more advanced file recovery software may be able to recover intact files including filename etc. that Recuva could not.

 

What can possibly be gained by not even trying PW? It's not as if it is difficult or time consuming, and I've often been taken by surprise at what I have found when exploring previous disk partitions. I used to use PowerQuest's Drive Image - got me hooked on the whole disk management issue.

 

Ah, Drive Image, it brings back so many good memories. That and PartitionMagic did exactly that same thing for me. And actually, FUBARs as a result PartitionMagic's doing was what got me into editing partition tables and eventually into writing my own (then DOS based) partition recovery software.

Anyway this is all a bit OT. I think there's a difference in trying that on your own system and recommending it to someone in a community forum like this. The safest approach is always to not write to the disk containing the lost data. I can think of, and have seen enough scenarios where only modifying a partition table is actually risky, specially when a disk was already altered after original partitions were lost.

 

UPI, It sounds like you have a lot of experience with this sort of thing,-
First making a recovery disc set from the factory recovery Partition- means normal recovery to what they have at present is sorted.
Whatever is tried, unless they want to pay, nothing else needs to be lost. Partition Wizard do a data recovery, too
Spock96 has recovered some of those with recuva- the rest have simply lost their link, in my logical way of looking at things.
Linux cd used to help find "missing" files- I have not used that for years -
https://www.powerdatarecovery.com/power-data-recovery.html This is partition wizards tool for data recovery - This will tell you if files are still recoverable, then its the operatives choice to purchase the tool to get them, or, to try the free version of minitool partition wizard, and roll back the partition, or, anything else .
In all cases , if little or nothing has been written before trying to roll back, or, recover partitions,other than factory restore- there is always a chance that things can be recovered- as they have not been overwritten-like I said, after the first 30/40gb , or, so.
That is why we never pass on a pc/laptop without removing and physically destroying hard drive, if you have any sensitive data on it
Yes, it worked for me, and I gather several others, so, in my humble opinion, worth a try.

 

I'd use an imaging program myself rather than a factory recovery partition but you are absolutely right - there is no need to put any of the current data at risk so no reason at all not to experiment with PW partition recovery. It's a pity the OP appears to have abandoned this thread - it may well have produced some surprises.

 

I was surprised with what I managed to do with the free version of Partition Wizard
Something worth keeping in a kit, I think, for data recovery -gonna think about it, and have a look to see if there is a write-up on it.
As we all know forensic IT, has been about a long time, and my reason for always trying something different to keep these 75 year old grey cells working.

https://www.amazon.co.uk/gp/search/...w-price=34&high-price=35&tag=engelmsoftw0b-21

 

I'm gonna iterate and expand a little .. Only problem I have doing this, that this is not the answer to OP problem ..

1. First rule in data recovery is do not change anything on the original disk. OP already overwrote a large portion of his data. Safest approach is using software that is read-only. My understanding is that PartitionWizard isn't and using it is therefor a bad idea. IF you're serious about that data. The modern Windows OS chkdsk is not like chkdsk in Windows XP. Repairs today can be done more or less automatic and online (self healing), and this for example may have consequences when the newly 'recovered' volume is detected as more writes and repairs written to the disk can be a result of this.
   
   IF PartitionWizard can restore access to the lost data, then so can file recovery tools. Partition recovery is relative simple, also for read-only file recovery software. Just like PartitionWizard, all you need to do is find the start of the partition. From there you only need to follow a chain of file system structures pointing to the files (in case of NTFS, boot record > MFT > Files).
   
   https://cdn-images-1.medium.com/max/800/1*SVpEnAjnZ0zXKfOcxqAZrQ.png
   
   
   The tool he used, Recuva can't do partition recovery, it is essentially an undeleter. More capable software should not have any problem finding a partition that PartitionWizard can also find. So, why not use the safer approach I wonder.
   
   I have trouble following if you propose to clone the disk first .. Because that would of course change things. As long as you have the original disk, you can experiment with the clone.
   
   
2. Data recovery advice is often based on personal experience (even if you recovered data 10 times already) and hearsay. Your advice may or may not apply to the issue described by OP. In my opinion you should not ask OP to experiment unless you're 100% certain of what you suggest will work.
   
   Also keep in mind that how you intend your advice and how it is interpreted are different things. I once asked a guy in my own forum, because it was unclear how he lost his data, if he formatted his disk. Next reply: I now did, what do you want me to do next .. I never meant for him to format the drive of course.

 

I don't understand why you are making such heavy weather of this. Just image the disk on a sector by sector basis and you are then free to explore using whatever recovery tools you wish. The image can be restored at any time, or you could clone it as you say yourself.

 

Initial advice which included PartitionWizard did not include suggestion to clone the original disk first. So, there's that. And for the rest, if you still don't get it after my last explanation then there's not much point in me trying again. Boils down to using PartitionWizard in a situation like that is utterly useless and it will achieve nothing that good read-only file recovery software can't accomplish without putting existing data at risk. And I don't understand what's so difficult to understand about that.

 

Pay attention! From #5, the first post to talk about using Partition Wizard
"I you create recovery discs first from the laptop, then it could be worth the try.Partition recovery"
http://www.minitool.com/partition-manager/partition-wizard-home.html

 

Okay, sorry then I missed that. My apologies.

 

It was still the first actual advice though, none in earlier posts.

 

It's all pointless anyway, with the OP long gone. Pity.

 

It's not pointless to the 1000s who only come here to read about problems they may also have.

 

Well, at least this thread adds a bit for those finding themselves in a similar position ,and UPI input can give them alternative ideas, but I am sure it does not help anyone when the pot is stirred too much ,and as Spock96 has not returned, perhaps this thread should be closed, unless someone has tried Partition Wizard in the way I suggested, - or, can give any more useful information to Spock96,to help him recover without any cost ass he requested.

 

There are 1000s of threads where the OP never comes back, sometimes even before the issue is resolved. I see no pot stirred here, technically, but sometimes it actually helps. That's just the way it is here and elsewhere.

 

Mini tool is great.