Fred Langa: Is there any way to recover data from a computer that has been factory reset?

Topic

New Reply

Short answer: Maybe. More great stuff from Fred on his web site.
[See the full post at: Fred Langa: Is there any way to recover data from a computer that has been factory reset?]

3 users thanked author for this post.

Elly, abbodi86, Microfix

Reply | Quote

Replies

The very best advice in that article is in the penultimate paragraph. With so many excellent backup and recovery solutions currently available, most of which are fully capable of backup task automation and overnight scheduling, it’s difficult to understand anyone’s needing to retrieve data from a factory reset storage device. Even in the unlikely event of partial success, the effort and inconvenience involved far exceeds that required to prevent any such necessity. I wouldn’t even consider an update, let alone a complete reset, without at least one full backup image — preferably several — and rescue media that has tested and proven recovery capability on the machine in question.

Too often the latter gets overlooked until disaster strikes even by those who are conscientious about backing up their systems. The wise user always keeps in mind that the whole purpose is recovery, not just the backups themselves. So always back up comprehensively so that you can recover selectively as may be needed.

Asus ROG Maximus XI Code board; Intel i9-9900K CPU; 32 GB DDR4-3600 RAM; Nvidia GTX1080 GPU; 2x512 GB Samsung 970 Pro M.2 NVMe; 2x2 TB Samsung 860 Pro SSDs; Windows 10.1809; Linux Mint 19.1; Terabyte Backup & Recovery

Reply | Quote

Just wondering:

How do you “test and prove” the recovery capability of the recovery media “on the machine in question”, without risking that test itself bricking the machine (if your recovery strategy involves — perhaps multiple — recovery copies, ALL OF THEM BAD.

Just wondering.

HMcF

Reply | Quote

That’s a perfectly valid and understandable concern. The answer depends on how far you want to pursue the proofing process. At a minimum, you’ll want to ensure that the rescue media is actually capable of booting that machine and providing access to all local and/or network locations required for any recovery operations. In addition, having booted successfully to the WinPE or WinRE or Linux rescue environment, most backup and recovery products will allow you to run “verification” processes on their backup images in place. And most will also allow you to mount the image as a virtual drive which can be used for testing in any way you wish, including partial restoration to a different location. The ultimate test within the rescue environment, of course, would be full restoration of the complete backup image to another spare drive.

__
P.S.: Personally, I’m usually content with mounting the image as a virtual drive and playing one of the video files included within that image, but doing that requires a multi-purpose WinPE or WinRE utility build the creation of which is beyond the scope of this subject.  If interested, you can pursue that at sites like TheOven.org among others.

Asus ROG Maximus XI Code board; Intel i9-9900K CPU; 32 GB DDR4-3600 RAM; Nvidia GTX1080 GPU; 2x512 GB Samsung 970 Pro M.2 NVMe; 2x2 TB Samsung 860 Pro SSDs; Windows 10.1809; Linux Mint 19.1; Terabyte Backup & Recovery

Reply | Quote

Anonymous I agree with you. People always talk about “back-ups”. We have friends that have no idea, of backing-up or more importantly RESTORING their data. Some of our friends make clones, others make images, still others do incremental.

The problem is EVERYONE wants to say you need to backup and while this is true, everyone expects that person to “get some backup program”. If someone wants to use a backup program then that is fine if they know how, or someone is going to set it up for them. The average user does not know how.

While having an “image” or “clone” is good, many are then relying on a program to do it for them. I tell my clients they should back-up but stress all they need to do is COPY their important data to a removable drive, a flash drive or a USB external hard drive. Software Programs do not need to be backed-up since they should be on CD or the original EXE file downloaded should had been kept (copied somewhere) and available.

All the average user has to do is copy the data back from their backup media to the hard drive and all is well. This is the simplest method without a proprietary program or encryption or compression which may lead to disaster when a restore is needed.

I had an system Administrator friend that had backups. All was well. One day the CD ROM failed and he replaced it. A year later he needed to restore his data. It would not work. He had multiple CDs of his data but it would not restore. He called the backup manufacturer and was told that when he installed a new CD-ROM drive, the serial number and specs were different, and the “copyright protection” of the backup software was tied to that CD-ROM drive. “Well that drive failed, I replaced it, how do I get my data now?” He could not. There was nothing they could do to help him. Another angry 3rd party back-up customer.

Another friend of mine was using the MS backup program years ago that ran from within windows. I told them you need to know how to do it in DOS or you may get stumped. In the old days I did backups in DOS. Well it did happen and they could not boot the PC. They were lost. They could not restore their data because windows would not run. Again use the most common denominator, copy/paste, and know how to do so in DOS or whatever your “recovery mode” tends to be.

Therefore, I suggest people COPY their data over either manually, or have a friend make a .BAT file (.CMD) or similar for them and run it on a schedule.

I know some may disagree and have years of success with their back-up program used. That is fine. If it works -successfully- for you then keep doing it. But the average user basically does not care and does not want to learn. When the computer fails, they pick up the phone and call someone.

Again, use the lowest common denominator, windows “copy/paste” method and copy your data files over to a flash or hard drive.

Reply | Quote

anonymous wrote:

Anonymous I agree with you.

Not sure exactly what you’re agreeing with.  Anonymous (HMcF) was just asking how to test and prove the capabilities of a rescue environment without risking damage to the current setup due to a bad backup which is, of course, always a possibility regardless of the chosen software or methodology.  (An extremely rare occurrence in my own experience, but it has been years since I’ve used optical discs for backups and they were never copy protected when I did.)  If you have similar concerns and aren’t satisfied by my response, I’d be happy to elaborate on any particular issues you may have encountered.

On the other hand, if you just need general help with backup and recovery operations, the best instructions and advice will be found in the knowledge bases and forums for whatever backup and recovery program you use or want to use.  If none of them, then that’s entirely up to you, of course.  A lot can be accomplished as you suggest by carefully planned, organized and optionally scripted copying of your vital user files to one or more safe locations.  I do that myself several times each day, but I also schedule full system backups to run overnight and I find backup and recovery software quite useful in facilitating that process.  Not really any harder to learn to use properly and certainly no greater risk of errors than anything else.  Especially considering Microsoft’s current update frequency, I’d rather not face the prospect of having to re-install everything manually.

Asus ROG Maximus XI Code board; Intel i9-9900K CPU; 32 GB DDR4-3600 RAM; Nvidia GTX1080 GPU; 2x512 GB Samsung 970 Pro M.2 NVMe; 2x2 TB Samsung 860 Pro SSDs; Windows 10.1809; Linux Mint 19.1; Terabyte Backup & Recovery

Reply | Quote

Thank you to everyone who read, and considered, and replied to my (HMcF) original comment.

For my part: my main machine is Win7 Pro and before installing monthly updates I always take a system image copy onto one of several removable HDDs.  My experience with that manufacturer’s “factory restore” OEM DVDs (on other similar but not identical machines) has been encouraging; so I hope that a system restore using the most recent (or the one before) system image might be a useful starting point.

Certainly, I take daily updates of my own files, using xcopy in an administrator CommandPrompt window:

xcopy /e /s /y /d /h /c /exclude:something *.* e:

onto a long series of removable drives.  Daily = a series of SD cards, each with copies dated “today” and “some days ago”;  monthly = two removable HDDs, used alternately, each with a two-monthly series of complete backups (so I have two fairly-recent personal complete backups, and I also have a series of copies dating back several years to answer questions like “when did this file change?”).

The SD cards (FAT32) and the HDDs (NTFS) are apparently fully readable on my future Linux machine (Mint, Cinnamon) and have been exercised there.  So I am confident that my own strategy works for me.  I do accept that this scheme would certainly not work for everybody (smile).

Thanks again for reading, HMcF

Reply | Quote

anonymous wrote:

The SD cards (FAT32) and the HDDs (NTFS) are apparently fully readable on my future Linux machine (Mint, Cinnamon) and have been exercised there.

Let me know how it works out if you ever try it with multiple M.2 NVMe devices. My Mint 19.1 setup can’t seem to decide which one it’s installed on, whether it’s nvme0n1 or nvme1n1. But the partition UUID remains consistent and works okay for boot anyhow.

Asus ROG Maximus XI Code board; Intel i9-9900K CPU; 32 GB DDR4-3600 RAM; Nvidia GTX1080 GPU; 2x512 GB Samsung 970 Pro M.2 NVMe; 2x2 TB Samsung 860 Pro SSDs; Windows 10.1809; Linux Mint 19.1; Terabyte Backup & Recovery

Reply | Quote

Good reference article should it be needed. As @Arvy pointed out

Would this be a good time to mention how having good backups lets you avoid problems like this?

To add to Fred’s quote, consider the options of adding a secondary HDD/SSD (HDD caddy in the DVD bay [if CD/DVD is rarely used convert to an external DVD]) or a large volume small sized USB flash for laptops.
For desktops an additional HDD/SSD or USB flash drive for storing all important user files within certainly helps as well as external backups.

Windows - commercial by definition and now function...

2 users thanked author for this post.

abbodi86, GoneToPlaid

Reply | Quote

BUT, by the way, keep in mind : this is not how to destroy data. For very valuable data one will be surprised how much can (or how little cannot) be rescued.

* _ ... _ *

Reply | Quote

Understood, Fred, but don’t you think perhaps that, faced with the loss of “very valuable data”, amateur poking around by the user with various undelete and unformat tools might not be the most advisable recourse after the fact.  In those circumstances, I think I’d be inclined to take the storage device completely out of service immediately to prevent any further inadvertent overwrites and hand it over to the recovery professionals.

Asus ROG Maximus XI Code board; Intel i9-9900K CPU; 32 GB DDR4-3600 RAM; Nvidia GTX1080 GPU; 2x512 GB Samsung 970 Pro M.2 NVMe; 2x2 TB Samsung 860 Pro SSDs; Windows 10.1809; Linux Mint 19.1; Terabyte Backup & Recovery

1 user thanked author for this post.

Fred

Reply | Quote

Yes! You are so right!

Step 1 is always make an 1:1 image (sector by sector) when the disk is only attached or mounted by an other computer.

* _ ... _ *

1 user thanked author for this post.

Arvy

Reply | Quote

Microfix wrote:

…To add to Fred’s quote, consider the options of adding a secondary HDD/SSD (HDD caddy in the DVD bay [if CD/DVD is rarely used convert to an external DVD]) or a large volume small sized USB flash for laptops…

A replacement HDD caddy which installs in a laptop’s CD/DVD bay actually is a rather good idea for laptops. The beauty of this is that the connection for the HDD caddy which replaces the original CD/DVD is pure SATA, versus USB for any external backup drive for the laptop. I should have done this a few years ago for my travel laptop since I have never used the laptop’s DVD drive.

Reply | Quote

Microfix wrote:

Good reference article should it be needed. As @arvy pointed out

Would this be a good time to mention how having good backups lets you avoid problems like this?

To add to Fred’s quote, consider the options of adding a secondary HDD/SSD (HDD caddy in the DVD bay [if CD/DVD is rarely used convert to an external DVD]) or a large volume small sized USB flash for laptops. For desktops an additional HDD/SSD or USB flash drive for storing all important user files within certainly helps as well as external backups.

As an addendum to this, make certain that when you use an external USB drive that you aren’t artificially limiting your access to your data through some mess involving built-in backup routines, or hardware specific to the drive itself.

I have several old Maxtor external drives that are only good for paperweights at the moment, because the never-ending march of OS progress has rendered the little USB interface component in those drives inoperable.  They just don’t work on anything past WinXP, and Maxtor isn’t around anymore to update their driver files.  Fortunately, those old drives tended to just be an external casing for a standard SATA drive, so I probably have a good chance of getting the data off of them by removing the casing, and mounting the drive normally.

As a rule, when I buy a new backup drive, I empty it of any included utilities or backup schedulers, and simply drag and drop copy/paste the files I need to backup.  If something is really important to me, I back it up as a data cd/dvd.

Crossing my fingers now that those formats don’t become completely obsolete any time soon.

Reply | Quote

Excellent advice.  In fact, I take it a step further in refusing to buy any of the major drive makers’ own external drive and enclosure combos for the very reason that you mention.  They all want to include their own gimmicks that all too often prove incompatible with more straightforward later usage.  So I just select and buy regular SATA HDDs or SSDs and the appropriate enclosure with the required connectivity separately.  A few now have USB 3.1 gen 2 connectivity, but still limited to 6 GB/s by the SATA translation.  Don’t believe the 10 GB/s adverts.

Asus ROG Maximus XI Code board; Intel i9-9900K CPU; 32 GB DDR4-3600 RAM; Nvidia GTX1080 GPU; 2x512 GB Samsung 970 Pro M.2 NVMe; 2x2 TB Samsung 860 Pro SSDs; Windows 10.1809; Linux Mint 19.1; Terabyte Backup & Recovery

Reply | Quote

Hmmm, I guess it’s something to consider if you’re selling an old computer and don’t want old data recovered as well.

Reply | Quote

anonymous wrote:

Just wondering: How do you “test and prove” the recovery capability of the recovery media “on the machine in question”, without risking that test itself bricking the machine. HMcF

The easiest way is a 2 step process.

1. Test the backup: open the backup program and “mount” the backup image. Browse to a file that you don’t care about. Restore it and confirm the file is correct.
2. Test booting to recovery media: create recovery media via your backup program. Boot the media.

If you can do both of those things then your restore will work on that machine.

cheers, Paul

Reply | Quote

The problem with the term Factory Reset is that it is totally vague and obscure as to what kind of data deletion has taken place.

People assume that a Factory Reset is a total wipe of all user data and a restoration of the manufacturer data as to how it was when you first turned on the device. This is almost never the case!

User data is the most valuable data there is to any company around and few are willing to part with it even if that data resides on the users device and not in their own cloud. So often after a factory reset you can still find traces of user data or even the full data list still somewhere on the device.

Even if a truly invasive form of deletion was done. Like a full format or partition deletion then the medium that was holding the data might still be able to let you retrieve some or all user data. A Hard Disk can be inspected with unformat or undelete tools. Tools that read the raw data of sectors are also available. Only with a Trim enabled SSD can you get into a situation where the recovery of user data is impossible.

W10&11 x64 Pro&Home

Reply | Quote