As was foretold, we've added advertisements to the forums! If you have questions, or if you encounter any bugs, please visit this thread: https://forums.penny-arcade.com/discussion/240191/forum-advertisement-faq-and-reports-thread/

Data Recovery

TopweaselTopweasel Registered User regular
edited June 2009 in Help / Advice Forum
I work IT for a company that recently let people go. One of them got wiff of it and proceeded to delete a very large portion of their email. This was recovered using the archiving solution we have. But now there is a worry that important department related files were deleted from their HDD.

So my question is what is a good recovery software for scanning the drive to find deleted files? Anything near free or with a full use trial period would be preferred.

Topweasel on

Posts

  • PeregrineFalconPeregrineFalcon Registered User regular
    edited June 2009
    Linky goodness.

    tl;dr: Turn their system off right the fuck now and slave the drive to another machine.

    On that machine, use one of the freeware recovery programs linked. I'm a big fan of PhotoRec because I like geeky CLI products, scripting, and that fucker has delivered ten times out of ten when I've called on it.

    Make sure to save the restored files to another drive entirely such as the built-in drive of the machine you're using.

    And then have HR kick this guy's ass.

    PeregrineFalcon on
    Looking for a DX:HR OnLive code for my kid brother.
    Can trade TF2 items or whatever else you're interested in. PM me.
  • urahonkyurahonky Registered User regular
    edited June 2009
    Yeah come on. Getting fired sucks, but why burn your bridges by doing something as stupid as that?

    urahonky on
  • PeregrineFalconPeregrineFalcon Registered User regular
    edited June 2009
    urahonky wrote: »
    Yeah come on. Getting fired sucks, but why burn your bridges by doing something as stupid as that?

    Because people are fucking stupid?

    It does mean that if I ever quit, it's an instant two weeks of paid vacation for me though. :D

    PeregrineFalcon on
    Looking for a DX:HR OnLive code for my kid brother.
    Can trade TF2 items or whatever else you're interested in. PM me.
  • TopweaselTopweasel Registered User regular
    edited June 2009
    Linky goodness.

    tl;dr: Turn their system off right the fuck now and slave the drive to another machine.

    On that machine, use one of the freeware recovery programs linked. I'm a big fan of PhotoRec because I like geeky CLI products, scripting, and that fucker has delivered ten times out of ten when I've called on it.

    Make sure to save the restored files to another drive entirely such as the built-in drive of the machine you're using.

    And then have HR kick this guy's ass.

    Don't worry. Actually what I originally did just in case was capture and image of the hard drive (No writes) and imaged it onto another drive so that they could figure out if it was an issue after we found out about the email mess.

    My plan is to use an external enclosure to hook the original drive up to my computer and have the recovery software run from my computer and scan the other drive. Today I received word that the worry was founded and the Boss of the employee wanted me to see if I could recover it. Way back in the day I used to use Ontrack but that costs almost $400 and the trial only allows for a single recovery.

    Topweasel on
  • PeregrineFalconPeregrineFalcon Registered User regular
    edited June 2009
    Imaging software will only grab the files that the allocation table confirmed exist - it won't grab the "deleted" ones.

    If it's critical information, boot from a Linux live CD and mount the drive as read-only.

    If it's really critical information you should be using a write blocker, but you're looking at about $300-$400 for one of those. More for a native SATA mode one.

    PeregrineFalcon on
    Looking for a DX:HR OnLive code for my kid brother.
    Can trade TF2 items or whatever else you're interested in. PM me.
  • TopweaselTopweasel Registered User regular
    edited June 2009
    Imaging software will only grab the files that the allocation table confirmed exist - it won't grab the "deleted" ones.

    If it's critical information, boot from a Linux live CD and mount the drive as read-only.

    If it's really critical information you should be using a write blocker, but you're looking at about $300-$400 for one of those. More for a native SATA mode one.

    Nah its not critical. In fact I doubt I will really find anything "important". Its just mainly that the boss is paranoid because he doesn't know what could be missing. Therefore everything is important even if its not. But its not that this employee was dealing with anything vital that could horribly hurt the the company without it.

    Topweasel on
  • urahonkyurahonky Registered User regular
    edited June 2009
    This is why special projects should always be placed on the network for everyone to work on. And then you use backup tapes to get everything backed up from time to time.

    urahonky on
  • WulfWulf Disciple of Tzeentch The Void... (New Jersey)Registered User regular
    edited June 2009
    Heh, we had an employee delete their info when they were let go. I managed to recover it the day I got the laptop back, and found out that she hadn't been doing a lick of sales work in the last three months before she was dismissed. Everything was personal emails and resumes to other companies. :lol:

    Wulf on
    Everyone needs a little Chaos!
  • ThawmusThawmus +Jackface Registered User regular
    edited June 2009
    This is why you use file servers, with regular backups.

    What would you guys be doing if he had a virus on his workstation, and it ate his hard drive??

    Thawmus on
    Twitch: Thawmus83
  • TopweaselTopweasel Registered User regular
    edited June 2009
    urahonky wrote: »
    This is why special projects should always be placed on the network for everyone to work on. And then you use backup tapes to get everything backed up from time to time.

    We have policies for this but no real enforcement of it. This more of a situation where do to the amount of people being let go no one knew who was going outside like 4 guys. So now you have people picking up tasks they had little previous work with. So its not so much as that there is definite important information on there, its that we already know she was destructive with work related information and they want to make sure that if important information was deleted we try to retrieve it.

    Topweasel on
  • TopweaselTopweasel Registered User regular
    edited June 2009
    Thawmus wrote: »
    This is why you use file servers, with regular backups.

    What would you guys be doing if he had a virus on his workstation, and it ate his hard drive??

    Our general policy is all work is saved either within their personal network storage or our File server. That doesn't mean that people listen. We also have policies that you shouldn't store personal information on your computer, but as of now I am waiting for an email from HR on a list of personal contacts so I can search their mailbox for emails relating to them. This is so I can back them up and give them to HR so that HR can give the backup to an employee that was laid off.

    Topweasel on
  • ThawmusThawmus +Jackface Registered User regular
    edited June 2009
    Topweasel wrote: »
    Thawmus wrote: »
    This is why you use file servers, with regular backups.

    What would you guys be doing if he had a virus on his workstation, and it ate his hard drive??

    Our general policy is all work is saved either within their personal network storage or our File server. That doesn't mean that people listen. We also have policies that you shouldn't store personal information on your computer, but as of now I am waiting for an email from HR on a list of personal contacts so I can search their mailbox for emails relating to them. This is so I can back them up and give them to HR so that HR can give the backup to an employee that was laid off.

    People listening will always be a problem. That's why you put them in a position where it doesn't matter if they listen or not. Lock down their computers either via registry settings, group policy, 3rd party software, or a combination of those. Then all they get is the netwok storage option. There's a GP template that'll let you redirect everyone's "My Documents" folder to another location as well. I typically redirect it to their home directory, on the file server, as that's easy syntax.

    I realize this isn't going to help with your current situation, but taking these steps will keep it from happening again, and make your boss happy that you're taking proactive action. Maybe. Depends on your boss, I know...

    Thawmus on
    Twitch: Thawmus83
  • TopweaselTopweasel Registered User regular
    edited June 2009
    Thawmus wrote: »
    Topweasel wrote: »
    Thawmus wrote: »
    This is why you use file servers, with regular backups.

    What would you guys be doing if he had a virus on his workstation, and it ate his hard drive??

    Our general policy is all work is saved either within their personal network storage or our File server. That doesn't mean that people listen. We also have policies that you shouldn't store personal information on your computer, but as of now I am waiting for an email from HR on a list of personal contacts so I can search their mailbox for emails relating to them. This is so I can back them up and give them to HR so that HR can give the backup to an employee that was laid off.

    People listening will always be a problem. That's why you put them in a position where it doesn't matter if they listen or not. Lock down their computers either via registry settings, group policy, 3rd party software, or a combination of those. Then all they get is the netwok storage option. There's a GP template that'll let you redirect everyone's "My Documents" folder to another location as well. I typically redirect it to their home directory, on the file server, as that's easy syntax.

    I realize this isn't going to help with your current situation, but taking these steps will keep it from happening again, and make your boss happy that you're taking proactive action. Maybe. Depends on your boss, I know...
    Yeah..... Well.... I and our admin staff has brought these up several times. The problem is, it is damn near impossible to get this stuff through. Heck as it stands everyone has Admin rights to their computers, everyone. Even one smart move would generate enough backlash to burn the company to the ground, doing what should be done would probably end up with our IT staff being burned as witches.

    Topweasel on
  • GrimReaperGrimReaper Registered User regular
    edited June 2009
    I highly recommend GetDataback. There are two versions, one for NTFS and one for FAT drives.

    It's the best file recovery software I've ever used. Downside is that it is commercial. However, it isn't outrageously expensive. (and likely I doubt you need the FAT version)

    GrimReaper on
    PSN | Steam
    ---
    I've got a spare copy of Portal, if anyone wants it message me.
  • PeregrineFalconPeregrineFalcon Registered User regular
    edited June 2009
    Topweasel wrote: »
    Yeah..... Well.... I and our admin staff has brought these up several times. The problem is, it is damn near impossible to get this stuff through. Heck as it stands everyone has Admin rights to their computers, everyone. Even one smart move would generate enough backlash to burn the company to the ground, doing what should be done would probably end up with our IT staff being burned as witches.

    Ouch. I feel for you.

    About all you can do in that case is make objections, have them noted in writing, that way if someone does decide to pull a digital "set the building on fire" it's not on your ass.

    PeregrineFalcon on
    Looking for a DX:HR OnLive code for my kid brother.
    Can trade TF2 items or whatever else you're interested in. PM me.
Sign In or Register to comment.