![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
poltr1Here's what I've been doing the past couple of days.
As mentioned earlier, I was able to recover all the files on the hard drive that lost its master boot record, with the exception of the email I received and sent between 2/15 and 2/26. On a lark, I thought, "Can I search the disk for that missing email? It could be in diskspace that isn't associated with a file. Or it's gone forever. What do I have to lose, other than my data?" And so I fired up Runtime's DiskExplorer for FAT, which I bought along with Runtime's GetDataBack for FAT, and searched for some text strings that I knew would be in the missing email. I tried "Digest Number 173" and got nothing. (Unfortunately, I can't use wild cards in the search, os use regular expressions, since it does an exact match.) Then I tried "Sat Feb 14"....
And I got some hits. Yow! There were about 15 groups of contiguous clusters, which corresponded to mail I received between 2/14 and 2/23, and had already been moved to different folders. (Eudora saves its email as plain-text or HTML. Otherwise I wouldn't have been able to search for the mail. Also, when new mail is added or a mailbox is compressed, it rewrites the mailbox file to a different location. So I'll have duplicates, which I can then examine with a text editor and see which ones to use.)
So, how did I rescue the email? First, I copied the clusters of email to text files in DiskExplorer. Then I went to Eudora to create new mailboxes corresponding to these files. Then with two directory windows, I copied over the mailboxes created by Eudora with the new mail. When I opened up each mailbox in Eudora, it created a new table of contents for the mailbox. And there was my missing email. One of the files had incoming email from 2/23 to 2/26, so I was able to get most of the missing email back. Unfortunately, I wasn't able to recover any attached files through this method. However, these attached files should have been recoverable through the file allocation table.
Tomorrow, I will repeat the process, looking for "Mon Feb 23", just to be sure I'm not missing any email.
Hmmmmm.....maybe this could be the start of a new career for me. "Data Recovery Specialist". I like the sound of that. Or "Data Forensics Expert". That sounds nice too, although the job isn't glamorous enough to be featured on "CSI: Cyberspace" any time soon. I plug in drives into a computer system and stare at the screen all day looking (and waiting) for matches. But as more and more people put their works and their lives on hard drives, there will be a demand for data recovery services, because (as we all know) Murphy's Law is in the design spec of *all* hard drives -- they'll fail at the worst possible time.
And being a data recovery expert is one of the few times that it's okay for me to be obsessive-compulsive about data, especially if it's my data that I'm not willing to give up on.
As mentioned earlier, I was able to recover all the files on the hard drive that lost its master boot record, with the exception of the email I received and sent between 2/15 and 2/26. On a lark, I thought, "Can I search the disk for that missing email? It could be in diskspace that isn't associated with a file. Or it's gone forever. What do I have to lose, other than my data?" And so I fired up Runtime's DiskExplorer for FAT, which I bought along with Runtime's GetDataBack for FAT, and searched for some text strings that I knew would be in the missing email. I tried "Digest Number 173" and got nothing. (Unfortunately, I can't use wild cards in the search, os use regular expressions, since it does an exact match.) Then I tried "Sat Feb 14"....
And I got some hits. Yow! There were about 15 groups of contiguous clusters, which corresponded to mail I received between 2/14 and 2/23, and had already been moved to different folders. (Eudora saves its email as plain-text or HTML. Otherwise I wouldn't have been able to search for the mail. Also, when new mail is added or a mailbox is compressed, it rewrites the mailbox file to a different location. So I'll have duplicates, which I can then examine with a text editor and see which ones to use.)
So, how did I rescue the email? First, I copied the clusters of email to text files in DiskExplorer. Then I went to Eudora to create new mailboxes corresponding to these files. Then with two directory windows, I copied over the mailboxes created by Eudora with the new mail. When I opened up each mailbox in Eudora, it created a new table of contents for the mailbox. And there was my missing email. One of the files had incoming email from 2/23 to 2/26, so I was able to get most of the missing email back. Unfortunately, I wasn't able to recover any attached files through this method. However, these attached files should have been recoverable through the file allocation table.
Tomorrow, I will repeat the process, looking for "Mon Feb 23", just to be sure I'm not missing any email.
Hmmmmm.....maybe this could be the start of a new career for me. "Data Recovery Specialist". I like the sound of that. Or "Data Forensics Expert". That sounds nice too, although the job isn't glamorous enough to be featured on "CSI: Cyberspace" any time soon. I plug in drives into a computer system and stare at the screen all day looking (and waiting) for matches. But as more and more people put their works and their lives on hard drives, there will be a demand for data recovery services, because (as we all know) Murphy's Law is in the design spec of *all* hard drives -- they'll fail at the worst possible time.
And being a data recovery expert is one of the few times that it's okay for me to be obsessive-compulsive about data, especially if it's my data that I'm not willing to give up on.
