PDA

View Full Version : Recovery from GoBack Corruption!


Nancy
15th November 2007, 17:51
Hello,

First my recovery story and then some questions.

I found Zar yesterday while researching forensics software at work (I work at a college in the computer science department) and was using my personal drive for testing. The drive in question is 80gig data drive that was corrupted two years ago when Norton GoBack corrupted the operating system drive and the data drive. I had just reinstalled the operating system on the 200gig drive and the 80gig was for storage and backup (I know - it should have been the other way around)

While reinstalling Norton Utilities, because I had just had a HD failure with the system (new, under warranty) I elected to install GoBack to prevent a HD failure from happening again. Within two weeks and right after a Norton GoBack live update, GoBack corrupted everything - including the data drive. I reinstalled everything on the 200gig drive and left this drive alone until I could find something or someone who could recover all of my pictures and documents (which I had on both drives - they were backed up but both the main drive and the backup drive corrupted with Norton GoBack :( )

Yesterday I found Zar at work and tried it out on my drive. It found my files and the test recovery went well so I took the drive home and waited until after 10PM my time (for the night special) in order to purchase Zar for myself and immediately began the recovery process again. I am pleasantly surprised it found and recovered most of my pictures and documents after Norton GoBAck had corrupted the drive. (The drive is recognizable under disk management but could not be accessed and had no drive letter assigned to it)

Now this is the interesting part --- most of the directories (folders) were not recovered and the files were placed in 'lost files' folders (directories) and many other items - including operating system files which were left on the drive after I paid CompUSA to recover the files a couple of weeks before Norton GoBack corrupted the drives (this was before I started worked in the computer field - and why the main drive was the big drive) and many of the files are duplicated several times. An 80gig HD with less than 35gig of data recovered (with Zar) to be about 160gig of data (mostly duplicates and mostly garbage --- .dll files and the like that were recovered off the main drive after the HD failure) After recovering with Zar, looking in the folders (directories) many files were recovered several times - and some of the programs / data were blown apart - meaning all the flash (.swf) files from microsoft are in one folder (Win XP tutorials, etc.) and several copies. I'm thinking it was Norton GoBAck that did all of this corruption (this was not a system disk so it is no big deal the files recovered the way they did - the drive was used to recover the system a few weeks previously and had not yet been cleaned up)

I am VERY impressed that most (if not all - directory structures were not recovered and files were placed in different folders / directories) of my pictures and documents have been saved. I was willing to pay $100. or more to recover the pictures (from what I can tell, the pictures I most wanted recovered were recovered) and I found documents / files I forgot I had on the drive.

I am VERY impressed with Zar and I reccomend it if you need to recover data. It sure saved mine!

I would like to know if the directory structure was corrupted by GoBack or if this is how Zar recovers files? I was so sure all was lost I was not about to pay $$$ for software if the data was unrecoverable - when I saw Zar recovered my pictures perfectly in the trial run, I was sold on buying it to recover the entire drive.

Also - while waiting until the nightly sale started, I checked a thumb drive to recover pictures just to see if Zar could find anything - it recovered pictures I had formatted over, loaned the thumb drive out (and it was used), reformatted, and added files to it --- I am THOROUGHLY impressed! (I had the pictures saved - I just wanted to make sure I was buying a useful product)

Thanks again! Without Zar, I may have never gotten my pictures back!

Nancy


Oh - FYI -- the pictures recovered from the corrupted drive were taken with a 3.2 MP camera and the ones recovered from the thumb drive were taken with a 10.1 MP camera

Alexey V. Gubin
16th November 2007, 17:39
I just tried to write something quick in reply, but that turned out nearly impossible. Questions about this, "ZAR recovers more files than the drive capacity is", are somewhat common nowadays.

In short: This is a feature, not a bug. Actually, an inevitable side effect when you try to recover as much as possible - lot of garbage gets carried along.
There are ways to reduce this effect, mentioned several times on the forum, like
1. Make sure "Filtering" is enabled in "Advanced Configuration"/"Common filesystem analysis".
2. Make sure you select "Only recover current files" when prompted for a recovery mode (refer to http://www.z-a-recovery.com/man-tab-tasktype.htm)

"Complete Edition, The" of this will probably be available late tomorrow, since the topic is actually quite complex.