Accidentally deleted 2TB of movies. Now recovery software is saying 99% of it is overwritten. Any chance of recovery?

glidesi

Reputable
Sep 22, 2014
2
0
4,520
This is on my HTPC. Windows 8.1 runs on my SSD (C) and I have a WD Green 3TB (D) for just my media. The drive was almost full so I was getting ready to clean up my folder structure before adding in a new drive this week.

I used a tool called Symlink Creator. The idea was to create symlink Media Folders on my C: drive that would then point to the actual media on my storage drive(s). Except when I entered in the folders I did so backwards. Instead of C:/Media/Movies/ linking to D:/Movies/, it created D:/Movies/ as the symlink and almost all of the contents of the folder disappeared before I could stop it.

Immediately after I realized what happened I made sure to not make any writes on my D: drive and confirmed no software was accessing it. I've run a deep scan on Recova and also Undelete360 but the results aren't great. Although it finds most of the small files (thumbnail images, metadata files) the actual movie files (~10gb *.mkv) are almost all said to be "overwritten". Maybe 15 or so large movie files(out of 200+) are said to be recoverable, but I have yet to do so.

I know that when data is overwritten its pretty much impossible to recover, however considering the disk hasn't had any writes since this happened I find it hard to believe almost everything has been overwritten so quickly.

Are there any more steps I should take or should I just chock it up as a learning experience? I'm running another utility, Aidfile, right now but its going to take all night.

Thanks!
 
Solution
Yeah, thankfully I keep backups of my important data but unfortunately I don't have a means of doing so for the large files on my HTPC.

It just seems odd to me that the files would have already been overwritten in a matter of hours (minutes?) despite not having any significant writes on the disk. Maybe because they are each several gigabytes? I feel like they may be lost in some weird symlink purgatory.

Edit: I just realized, when I built the system I set the page file to be on the D: drive (system managed: 8gb). Could that have done the trick in overwriting most of the files?

Edit 2: Recova is saying the data is unrecoverable, but there are no overwritten clusters. Undelete360 is saying their status is overwritten.

Edit 3: I...
D

Deleted member 217926

Guest
Honestly if you have run the good free recovery software like Recuva and it's not recovering your files they are probably gone unless they are worth big money to you. I would say a company specializing in data recovery could probably get them back but they charge about a grand to even try with no guarantee.

It's a good idea to have any data you can't replace stored in at least 2 locations. Your hard drive could fail causing the same problems. You just happened to be the cause of it this time. I'm pretty sure most everyone who has used computers a while has found this out the hard way. I sure did!

Hopefully someone can come along and tell you a method I am unfamiliar with but I doubt it.
 

glidesi

Reputable
Sep 22, 2014
2
0
4,520
Yeah, thankfully I keep backups of my important data but unfortunately I don't have a means of doing so for the large files on my HTPC.

It just seems odd to me that the files would have already been overwritten in a matter of hours (minutes?) despite not having any significant writes on the disk. Maybe because they are each several gigabytes? I feel like they may be lost in some weird symlink purgatory.

Edit: I just realized, when I built the system I set the page file to be on the D: drive (system managed: 8gb). Could that have done the trick in overwriting most of the files?

Edit 2: Recova is saying the data is unrecoverable, but there are no overwritten clusters. Undelete360 is saying their status is overwritten.

Edit 3: I found a solution!!! After trying three different utilities I was about to give up, but R-Studio/R-Undelete is able to see the original directories and restore all of the files I have tested so far! It appears the files were not actually overwritten after all. I'm assuming the other utilities I tried have some issues with recovering large files.

 
Solution
D

Deleted member 217926

Guest
Excellent! Well I wasn't any help but good job. At least by posting here maybe someone will come along with the same problem and see your fix and it will help them too. :)
 

LostAlone

Distinguished
Jan 3, 2011
296
0
18,960
In all honesty, if you are handling large amounts of data you would be extremely well advised to use some kind of RAID set up as opposed to separate disks. Something like RAID 5 will come with only a fairly small overhead in terms of cost, and give you the peace of mind you need to keep all your stuff safe no matter what happens. Being able to access plural hard-drives as one large chunk helps with all kinds of things, and perhaps most importantly it gives you constant extendability as you expand your collection. 3TB sounds big, but when it comes in 10gb chunks it fills up fast. I have a 10tb storage array 98% full, even after re-encoding bluray rips to 720p to save space (I still have the discs, and the serve is only there to push media to mobile devices and Rokus that would require on the fly transcoding to play those 10gb files).

Definitely think about a RAID array. Building your own is cheap and pretty easy (I use UnRaid) and you can learn as you go, and be insulated from failing hard drives and other unpleasant things that at best would cause you a huge amount of lost time, and at worse a lot of lost money beyond the drive failure. Data is precious. Keep it safe!
 

kanewolf

Titan
Moderator


RAID is NOT backup. Do not believe that RAID is the best thing since sliced bread. RAID will NOT protect your from exactly what happened here -- operator error. Only backups will protect against everything. RAID should protect against a single disk failure. But I believe most of us that have been around a while have seen it fail even when it is supposed to protect.

A hardware RAID controller with NAS grade (WD Red, etc) can have much better performance and reliability but it isn't a fix all.
 

LostAlone

Distinguished
Jan 3, 2011
296
0
18,960


I didn't say it was the best thing since sliced bread. I said that it provides constant extendability, and protection from hard drive failure. Both of those things are a huge deal if you have large amounts of data, and definitely justifies the minor cost of building an array.

I didn't say that it was backup, and I didn't say that it protects you from user error - However having a proper raid array means you are much less likely to need complete back up, and reduces the number of user interactions that could lead to significant data loss. The OPs exact problem was caused by trying to do something that would never have come up if his HDDs were spanned together.

As for back ups - Are you seriously saying that you operate a 3-2-1 back up policy for your home movie collection? Seriously? Because if you do, you are crazy. You are an actual mad person.

In the home back ups are for personal files that you can't re-obtain in some other way. You back up your photos and your documents, and maybe your save games. You don't back up video files that can be re-downloaded or re-ripped from a disc because all of those files are already backed up. Literally - They are. They exist in another form that you can access and contain a perfect copy of the data you want to get back.

Additionally keeping back ups of this non-critical data quickly becomes expensive and cumbersome. If you are automating the backup and the devices aren't air-gapped, then they are exactly as prone to failure as the existing drives, and so you would be far better advised to run RAID 1, 5 or 6 depending on your needs. If the drives are air gapped then you need to manually re-sync the backup every day and every time you change anything.

In the home, for non critical data it's comical to suggest back ups as opposed to a RAID array. Back ups have no particular benefits, as the data can be re-obtained with some effort anyway, and come with significant costs in terms of actual money and personal effort. I for one certainly don't want to get home from work and dick around with my back ups. By contrast RAID 5 (and even RAID 6 for 3+ drive arrays) comes with a lower cost, with immediate upsides in terms of usability. The only situation where backups are better at all are in the event of multiple drive failures (triple drive failure for RAID 6), saving you the time it takes to rebuild the data you lost, but that's a pretty unlikely case in a home server.

And that's what you're forgetting. Home storage is a totally different environment to enterprise. Critical, irreplaceable data is the minority of data. Storage is not under constant multi-user stress which greatly increases it's lifespan while decreasing the chances of plural simultaneous device failure. The benefits of RAID, like easily adding capacity and working with one big chunk of space further decreases possible sources of data loss by letting novice users avoid advanced interactions.

Most importantly what we are talking about here is the cost of implementing vs the convenience in the case of failure, because the data is all available somewhere else. Convenience is what you are paying for, the cost of not having to go re-download stuff, which is obviously a significant amount of work but there's a point at which better data security isn't worth the cost you pay for it. I mean, a weekend spent re-obtaining things is crappy, but how much is that actually worth to you?

For back ups the cost is double the cost of your storage, as well as an ongoing amount of effort, with the benefit of being able to pick up quickly should a device fail. For RAID, at least for me, the cost has been 20% of my storage (five disks, one extra parity disk needed) with the benefit of a single hard drive failure being actually transparent - When a drive fails on my array it sends me an alert, but the array stays in use with all data available until I can replace it. In the event of multiple device failure I have to go and find stuff again, but with only a $100 premium instead of a $500 premium, I'm ok with that. It's an adequate amount of security for non-critical data.

All forms of data protection are basically just setting yourself up so that more things need to fail before you are inconvenienced, but you have to chose something that is right for your circumstances. In the corporate world, with constant up time being demanded and systems being heavily stressed you clearly need something more substantial than pinning the future of your business that two drives don't fail at once. But at home, with non critical data, come on man. It's like saying that he should buy two toasters, two kettles and two fridges so that in the event of any two devices failing he can still make breakfast. You can live without breakfast (or your home media server) for a week.

It's nice to have some level of redundancy because it cuts down the number of times you need to re-obtain a whole collection because disks do fail, but there's a pretty clear line between what's reasonable to save yourself effort, and what's madness to protect data that doesn't strictly speaking need to be protected.
 

kanewolf

Titan
Moderator
I agree that backups of non-critical data is a waste of time and resources. I am a proponent of RAID, but I am a realist. If it can fail it will fail, the only question is when. Identifying what is critical data and what you can live without is a required step in configuration of storage. DVDs that you have ripped can be rebuilt. 500MB of family movies and photos can't be. Go through the mental exercise that component "X" has failed, what do I do now?

I also wanted to stress that RAID can only fix some things. Don't get a false sense of security that your critical data is safe because it is on RAID. The uninitiated can easily fall victim to this. Operator error is a much bigger threat than hardware failure. I didn't suggest backups instead of RAID, I just tried to stress the need for BOTH.

This OP seems to have a lot of media, it is probably replaceable. But there is no way for us to know it that media is critical. That is a designation only the OP can make.