Salvaging Data From External Hard Drive 1

[danielh68]

Hi,

A few months ago, a consultant our company hired purged my external drive. Eventually, I will have to go to court to settle this issue. With that said, it would help me out a lot if someone knew if there was a method of extracting dates (or perhaps even the whole file) from an external hardrive that has had its data purged.

I really appreciate your help.

Thanks,
Dan

 

[Sival]

This might help:

http://www.datadepo.com/driveclinic.htm

 

[edfair]

How was it purged?

Try a google search for "undelete".

Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[Freestone]

Never tried this software, but it's freeware:

http://www.pcinspector.de/file_recovery/UK/welcome.htm

Not free:

http://www.runtime.org/gdb.htm

And not being a lawyer, but I wonder if this can be considered tampering with evidence, or some such legal thing.

 

[bcastner]

Google "forensic hard disk utilities"

 

[danielh68]

Thanks for the pointers. It seems, though, this will be more difficult than I thought. This is a quick outline of my dilemma:

Months ago, my employer hired a consultant to evaluate our department. Since we are a design firm, we have no IT guy to backup our data. So the other designer and myself backup our data on our own external drives (company could not afford to buy for us). Anyhow, this consultant asked for us to remove company backups from our drives. No problem. I hooked up my drive and removed the company folder. As I went to disconnect, he sat down in my place and started combing through my folders. Bare in mind, I use my own personal drive so natural I have my own folders and files on it, most of which are the accumulation of years of moonlighting. In any case, he starts deleting my private folders. Tempers flare, the boss steps in between and everything goes wrong. The consultant deletes everything. The only power I had was to leave, so I packed my stuff and departed. I have a court date in the upcoming months.

In any case, I have been unwisely using the same drive for months now. I should have left it alone, but that would mean I would have to buy another, which I cannot afford right now. However, from my understanding, it seems I would have to have access to the company machine to recovery my files since that is where they were deleted, right? If so, I'm out of luck.

Really, I don't need to recover the actual files. All I need is evidence that such folders were deleted on a certain date. Like a log or something.

Anyhow, thanks for hearing me out.

Your expertise is appreciated.

Thanks,
Dan

 

[danielh68]

Hi everyone.

Again, thanks for your help. Using Google, I found this product which sounds like the thing I need. Like I mentioned earlier, I don't need to necessarily recover the file in perfect working order, I just to prove that a file(s) existed on one day and was later deleted.

Anyhow, here's the link to the product I might purchase:

http://www.runtime.org/drivelook.htm

My only question is this: since the consultant dragged my folders from my hard drive onto the desktop's trash can, then emptied it, does the recovery take place on my hard drive or the company's machine?

Thanks for your expertise.

 

[kiddpete]

The files were never 'on' the company's machine. They were simply attached to it via an interface. What's left of the files is still on your drive. The software looks cheap enough although I don't know what it can still do for you.

 

[danielh68]

Thanks, Kiddpete

I will purchase it and see if any info on these files is retrievable.

-Dan

 

[SkipCox]

I'd use a professional third party to do this. I know it's expensive but, you should take every precaution to protect your integrity if this is going to court. If you win, you should recover all monies spent.

When I left my last job, I immediately deleted all xxx company files from my home machine and laptop as I knew I would not return. In agreement with you, it's the fight thing to do in case any ? might arise. That consultant cannot delete your personal stuff anymore than he can invade your home and delete files from your personal pc.

Good luck...it's time to speak with an atty and CYA.

Skip

http://home.comcast.net/~scox9/index.html

 

[edfair]

You haven't told us what operating system the computer was using. And what kind of filesystem was involved. Or for that matter, what kind of external drive.

So far as I know, there is no timestamp showing the purge date, only a creation date or modification date.

Depending on what kind of operating system the spaces previously used for the company files may have been overwritten by now. And the directory structure that points to them and contains the creation date may also have been reused.

It sounds like there are 2 problems involved. First, to prove that you no longer have any company files, and second, to prove that your personal files were removed.
For the first, but using advice from a lawyer, you could get a computer shop to do a directory of your drive. That is not definitive, but would show proper intent.
The second problem, recovering your personal files, is more the problem. Since they were older they were closer to the front of the drive, and once deleted the space will be used again first. And by your own admission you have been using the drive. So the oldest stuff is definitely overwritten, at least the pointers.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[mainegeek]

Hello danielh68,
I use GetDataBack for data recovery and it works well for me.

http://www.runtime.org/gdb.htm

As for the legal side, The entire contents of your drive became company property as soon as you brought it in and attached it.

 

[danielh68]

Thanks for all the replies guys. I think I might just have a removed third party look into it. That sounds like the smartest method.

mainegeek - although the judge will have the final say, I don't entirely agree with you. It's my property and I did not give them permission to go through my personal jobs, some of which are copyrighted. Under you argument, if one parks their car in the company parking lot, the employer has the right to bash in the window, destroy the enterior, rip out the stereo and basically do whatever he wants. Granted, an employer may have your vehicle towed, but that does not included destroying the car. Or, if a woman sits her purse on a company desk, can the employer grab it and dump all it's personal contents in the garbage? What happens to her cel phone, check book, money, personals if the trash guy has already dispensed of it? Is there not any justification in a recourse. Or, what happens when an employee is requested to take home work for the weekend, so he takes home the company drive, plugs it in and copys the files to his/her machine. By merely connecting it, it becomes employees property now? No, it's stil the company's work.

Anyhow, I could be wrong, but the judge will finialize it. I appreciated your thoughts on the matter.

Thanks again everyone.

Dan