Lost a bunch of data, how to take drive image?

Discussion in 'Storage & Backup' started by dantheman65, Apr 29, 2012.

  1. dantheman65

    dantheman65 Member

    Joined:
    Aug 18, 2001
    Messages:
    3,840
    Location:
    Melbourne.
    Hi,

    I did something stupid and restored a past backup that had excluded some important items. I will take my drive to a professional recovery service, but I want to be able to keep using it for a while -> therefore I need to take an image of the drive so they can recover the data from that.

    I use MacOS, what is the best way to take a full HD image (not just a partition) - which format should it be and what software should I use?

    Thanks,
    Dan
     
  2. raX

    raX Member

    Joined:
    Dec 26, 2004
    Messages:
    735
    Imaging apps won't take a low level mirror as far as I know. stop using the drive.
     
  3. Osiris

    Osiris Member

    Joined:
    Aug 22, 2001
    Messages:
    3,724
    This ^ if you want to have a chance at recovery.
     
  4. Recharge

    Recharge Member

    Joined:
    Sep 5, 2001
    Messages:
    11,871
    Location:
    Brisbane
    you will NOT be able to recover deleted data from a disk image, ONLY from the disk it's self, STOP using it or kiss it all bye.

    make an image and then use THAT?

    ugh! I have a headache now.
     
    Last edited: Apr 29, 2012
  5. OP
    OP
    dantheman65

    dantheman65 Member

    Joined:
    Aug 18, 2001
    Messages:
    3,840
    Location:
    Melbourne.
    Cool, will get a new drive. Thanks for that.
     
  6. SLATYE

    SLATYE SLATYE, not SLAYTE

    Joined:
    Nov 11, 2002
    Messages:
    26,858
    Location:
    Canberra
    Depends how you do the image and where the data is. If you use something like dd, you end up with a sector-by-sector copy of everything on the disk, regardless of whether the OS thinks it's data or free space (this is often a pain in the neck, because you end up backing up 500GB+ of "empty space" that compresses very poorly because it's got random data in it). If the data is there (ie "deleted" but not overwritten) then it can be recovered from the image or copied back to the HDD and recovered from that.

    If the data has actually been overwritten then it's pretty much gone anyway. There are often suggestions that with some extremely fancy equipment a company might be able to recover overwritten data, but my understanding is that this is not practical for anything other than the very earliest floppy disks.
     
    Last edited: Apr 29, 2012
  7. rowan194

    rowan194 Member

    Joined:
    Jan 5, 2009
    Messages:
    2,047
    Question... was the backup a collection of files, or a disk image? IE, did it restore file by file, with each file taking a slightly different amount of time, or was it just a steady 1%, 2% kind of thing with no indication of which file it was restoring at that point?

    If it's the latter, image based, there is most likely zero chance of being able to recover newer files, because you have overwritten the entire contents of your HD with the older image of it.

    If it was a file by file recovery - why would it have deleted existing files?
     

Share This Page

Advertisement: