Thailand Expats

TanMan · #1 12-04-2008, 14:17

So, last month in Bangkok, I caught a nasty virus (computer that is). As a quick patch, I had to switch from Internet Explorer (where the virus came in from) to Mozilla Firefox to browse the web and get e-mails. No problem.

After arriving in Phuket, my on-line poker software locked up as I was downloading a software update and my wifi connection broke midway through. After reconnecting, I couldn't launch the poker software, nor uninstall it, nor re-install over the old software.

OK, now two problems... so off to the Jungceylon IT Center (3rd floor). They had to replace my hard drive, and re-install Windows XP, but they also said that they could only re-install about 80% of my data files because some of the files were "corrupt". By the way, this work was outsourced to a company in PhuketTown.

Well, in one of the data folders (let's call it KCORP), I had 6 sub-folders, and when I got the computer back with the new hard drive, there were only 5 there. Of course the missing subfolder (let's call it Financial Statements) is the most important in that lot. 90% of the files in this sub-folder I can do without, and there are only about 10 Excel spreadsheets that I am interested in recovering. I'm guessing that this ENTIRE sub-folder was not re-installed because there were 2 or 3 "corrupt" files in there (most likely files that had IE hyperlinks embedded, and which I really don't need.

Is it possible to recover the 10 or so Excel spreadsheets from the old hard drive still? Ideally, I'd like to go to some place with the old hard drive and a thumb drive and just transfer the files over to the thumb, and then back onto the laptop. So, I don't even know if this is possible, and if so where to go. Help anyone?

Pad Mc · #2 12-04-2008, 16:00

Try to get hold of Gollum (Simon). He might have a look at it for you.

steve w · #3 12-04-2008, 16:20

Download Recuva 1.12.291 - FileHippo.com this might help

LivinLOS · #4 12-04-2008, 16:51

First big question is.. Did they remove the hard disc and leave it alone ?? Eg install a new one and give you back the old one as a spare ?? If so you have a shot at recovery.

Or did they try to recover files first, save them and then re-install windows ?? Because if they went that way (which I fear to be the case) the new windows install will have reformatted and overwritten your data and the chances of a recovery will be slim to none.

SirDougless · #5 12-04-2008, 16:53

Yes, it is possible to get the info from your HD, even if the files have been deleted or the HD formated. Any 'forensic' IT guy can do it. You may not get the info back in the format you want (ie Excel) but it is retrievable. Do not use the HD as you may overwrite the data on it that you want.

LivinLOS · #6 12-04-2008, 17:05

You can often recover from a format.. But its very rare to recover from being overwritten.. Thats what secure data erase progs do, not only delete the file but go over the data space with random data.

If the data was left in open space theres a possibility the data hasnt been wiped / over written but the process becomes much much more complex.

Case like this always fit a new drive and keep the old one without modification.

banger_chris · #7 12-04-2008, 17:18

check your pm.

cheers,

Chris

TanMan · #8 12-04-2008, 18:15

Quote:

Originally Posted by LivinLOS

First big question is.. Did they remove the hard disc and leave it alone ?? Eg install a new one and give you back the old one as a spare ?? If so you have a shot at recovery.

The answer is "yes". I have the old hard drive and a 1 gig thumb drive in the computer bag. I'd like to just go "somewhere" in Patong or Phuket Town and transfer over about 10 important Excel files to the thumb.

How they got 80% of the old hard drive data onto the new drive I'm not sure nor do I know the criteria they used, but I suspect that they didn't want to reload an entire sub-folder because a few files in that sub were corrupt. The files I need are just ordinary Excel files with no hyperlinks, so they are probably not corrupt.

Maybe the question should be, is there such a thing as "removed hard disk data reader with transfer capabilities?"

LivinLOS · #9 12-04-2008, 19:29

OK good.. 2 options.. Firstly get a 2.5 inch desktop adapter (or a USB drive enclosure) and run some recovery tools on it.. You may get lucky..

Failing that theres a guy who runs Phuket data wizards who does this kind of drive recovery.. I actually felt a bit done over by him so A) make sure you get an explicit price agreed in advance (I got a dont worry its cheap and no recovery no pay.. Then a shock at the end) and also B ) verify the data is recovered before payment (mine wasnt and he then ignored my emails and all contact !!)..

hof · #10 13-04-2008, 14:07

Quote:

Originally Posted by steve w

Download Recuva 1.12.291 - FileHippo.com this might help

thanks thanks thanks, you have save my day
dont ask my how, but i have lost 2784 photos for the last 4 year, now i have tkem again on my pc.

briofoz · #11 13-04-2008, 17:54

I used "Recover My Files" prog. Worked great for me, it managed to recover everything. Available at mininova.org, if you use Bit Torrent.

TanMan · #12 14-04-2008, 17:06

OK, so I took LivinLOS's advice in post #9. Not being that great with computer diagnostics, etc. and thinking the costs would end up around the same, I took Option 2 to start.

Went to Phuket Data Wizards website and sent an e-mail (basically I copied and pasted my OP). Prompt reply with a 2-4K quote, which I thought was a little high. I met Greg over on Chalong circle this PM. Apparantly, their office is near Wat Chalong. I gave him the old hard drive and an empty thumb drive for him to put the recovered files on.

I figure I will bargain the price once the work has been done, and I know how much data he was able to recover.

Conclusion tomorrow...

steve w · #13 14-04-2008, 18:26

Quote:

Originally Posted by hof

thanks thanks thanks, you have save my day
dont ask my how, but i have lost 2784 photos for the last 4 year, now i have tkem again on my pc.

glad to have been of help.

TanMan · #14 16-04-2008, 19:25

So, 3,000 baht lighter, but 50 important files heavier, I'm sorted. Thanks for the advice LivinLOS.

Gregory came to Patong and hand delivered the thumb drive and old hard drive. Apparantly there was physical damage to the drive as well as a virus. Maybe I pounded the keyboard over a bad beat playing poker... I don't know for sure, but the saga is over.

I would certainly recommend Phuket Data Wizards for recovering data files.

GameSpy · #15 16-04-2008, 20:00

I work in a computer shop and had one customers wife delete all his files and photos, then she formatted his drive 3 times. I used Easy recovery professional. I did a raw recovery and got back every one of the files and photos and most of the data from the former user of the pc.

I only use this program as i found its one of the best out there. Worth a try if You delete or format your HDD`s.

LivinLOS · #16 16-04-2008, 20:14

Remember a fast format does very little, merely switches the label for the file space to available not overwriting the file..

A full format or secure erase writes over the data..From that position in my experience your very unlikely to get data back with normal tools.. Real digital forensics departments have specialist equipment to attempt to read residual memory effects I think.

cotambear · #17 17-04-2008, 05:07

congrats on your recovery. for free data backup (for future mishaps) try Online Backup, Data Backup & Remote Backup Solutions from Mozy.com – Welcome

jimholio · #18 24-04-2008, 17:34

Further i would like to add that if you are playing Poker online you should really keep your computer safe, have seen many "Poker monitor" viruses out lately.

You dont want your opponents to know what cards you have when playing do you?

1 of the viruses or whatever you may call it, would keep taking screenshots of whatever you have on screen and send it to the remote computer..

Keyloggers even worse since they can get your actual login/password for the poker sites.