Data Recovery from a Formatted Hard Disk using EnCase Forensics

[MrJoyride619]

Thanx for the info and the vid.Luv the music,could i get a name of it or download it?

[labobo]

"Basically, formatting your drive doesn't erase any thing at all."

Actually that depends on what type of formatting and program you use.

Deleting files:

It's due to performance reasons. It takes a lot of time to overwrite the data.

Ex. on NTFS they just change a bit from used to unsued in the MFT

There are drivers you can install that will do the overwrite, if you really are that paranoid. That and full hard drive encryption will make you safe, at least from this attack. :)

[Plastik13]

On Mac, if you erase in securely way (that means that the computer doesnt just erase the address but add 0 on the sector where the file is), you cannot recover the deleted file. Am I right ?

[Marychen91207]

Farstone@DriveClone offers backup & recovery

[Pece17]

Could someone send a link for Encase?

[Pece17]

I accidentaly formated my 500G HD-PEU2 : MiniStation™ Lite and basically all my music, pictures and files erased. I haven't got a backup anywhere. So I must get back my files. Where can I download EnCase free? Please help!

[BrodcastingWorldwide]

@Pece17

I had the same problem, except I used a free program called teskdisk/photorec

This is NOT a scam, and it seriously worked for me!!!! :DDD

I hope you got your problem solved :]

[Pece17]

@BrodcastingWorldwide Can it bring back Olympus raw picture file (ORF)?

[BrodcastingWorldwide]

@Pece17

Yes I believe it can bring back every file there is.

[youknowita]

@BrodcastingWorldwide Exactly,it can't recovery all the data, it depends on how you lost your data.Data recovery software is really a good thing, MiniTool data recovery software is a good choice for you. It is easy to use and it is efficient.. some of the editions are absolutely FREE!!!!!!!!you can have a try.

[inaj2011]

why use expensive software for forensics just to restore a formated harddisk, there are many free tools out there

[Techdude365]

/watch?v=opdQrKXraV8

its better

and to get it for free enter

/watch?v=gvi_t9nh71Q

[kawikatube]

The Windows XP setup music is so relaxing.

[TheIceManBig]

Where to download free???

[taryra]

hallo, can you help me? because me unable to do ;((( and you can help me? me skype taryra

[mmar4281990]

wats the name of the program

[pater429]

so if i delete my hard drive, and i will connect it on a other computer, it wil give me those files back?, even if i set my recycle bin to delete imediatly?

[sangr3azt3ca]

hey can u help me i formated a file from my mp3 and now the drive were i plug my mp3 won't open cuse it keep sayin i need 2 formate but when it is done formatin it says erro

[xInspecteurClouseaux]

There are plenty of free and open source tools you can use to do compute forensics. For example Caine Live, DEFT and SIFT (from sans.org) I've been using caine to recover evidence from several hard drives in my possession that a certain other youtube user has insinuated contain what he termed illegal porn. I have informed the police about this and the forensic work I have done has given me a good idea as to who has been remotely accessing my computers. It's best not to fuck with people like me.

[xInspecteurClouseaux]

because I'm the sort of person who will pursue such a matter to the maximum possible extent. I'm heartened to learn that you're studying this subject, the sort of cowardly sociopaths who perpetrate computer crime believing that they will get away with it need to be taught a lesson.

[unholyernest]

I'll be removing this video soon as i have long completed my project. Got a B grade and thanks everyone for the 10,000 views. its means a lot to me. Hopefully I have answered your questions with my limited knowledge on harddisk recovery.

I would recommend everyone to backup your data many times. Harddisk recovery is for the forensics, not for commercial purposes. If you really need to recover lost data, bring it to the experts.. they deserve your money.. seriously.. =D

[Recon777x]

About this video: You should have drawn attention to the fact that you did a QUICK FORMAT on the drive, which does not actually delete anything. A complete format will not be recoverable. Likewise, if you use TrueCrypt to encrypt an entire drive (which takes hours) your data will be completely 100% secure from programs like EnCase as long as they don't have your key, which can be any combination of any words and/or files.

[unholyernest]

@Recon777x We have already done a format using the windows setup way.. the blue screen way.. if you get what i mean.. we were still able to recover PORTION of the data.. but we didn't record down.. as for encrypting, I have not done any research on it so I'm in no position to comment..

[amemaitAustin]

@unholyernest A "blue screen" format does not wipe any data. It only does a sector-by-sector read to verify that the disk is readable. It marks any bad sectors it finds. It initializes the directory structure, so it will wipe out the root directory of the disk, but those contents are still recoverable by scanning for a directory signature. Only a multiple-pass, low-level format will truly wipe the data and prevent EnCase from recovering it.

[SilentServiceCode]

@Recon777x a full "format" still doesn't erase anything, it just checks for bad sectors, that's why it takes so long.

[guerocomico]

how much exactly does this cost to buy it?

[unholyernest]

@guerocomico estimated 3000 pounds.

[Gangster240212]

@unholyernest I love torrents ;)

[dragonkiller301]

i accidently formatted my hard drive, there goes my 318 songs :(

[tigerintermusic]

@dragonkiller301 try having to lose about 6000:(((((((((

[dragonkiller301]

@tigerintermusic damn dude, u can get them back if they were on an ipod i got all mine back

[tigerintermusic]

@dragonkiller301 na i wouldnt bother to try ill just download them over plus my friend has all the songs that really cant get :Dso i should be fine

[LyricalTv2009]

hey, this is a very good way :=) i used a password on my external hard drive today and my hard drive got fucked up, i cant open up, it says please format , i said hell no, i got 290 gb of my music and videos + pictures from my life, i need to get it back, i found this program and bought it, i have waited 5 hours now, its soon finished, all i need to do now is to copy em over to my brand new hard drive, and then i will format the one who fucked this shit up :=)

[LyricalTv2009]

hey, this is a very good way :=) i used a password on my external hard drive today and my hard drive got fucked up, i cant open up, it says please format , i said hell no, i got 290 gb of my music and videos + pictures from my life, i need to get it back, i found this program and bought it, i have waited 5 hours now, its soon finished, all i need to do now is to copy em over to my brand new hard drive, and then i will format the one who fucked this shit up :=)

[sunny27jan]

After installing this software, I dont see my local drives what do I do now.

[unholyernest]

there are 2 versions to this EnCase program. First is the EnCase forensics. second is the so-called "trial" version.. which is known as Encase Enterprise. For Enterprise, you can't fully use this program until you have the USB dongle. which is believe is the case for you. You have to purchase the USB dongle from Encase themselves.

[thedonutholes69]

where can i get this software? :O

[sunny27jan]

mail me for this software

[unholyernest]

for some reason, i can't post link on youtube. So people google for Encase. go to the website called guidance software. from that website, you have to request for a quotation from the company as EnCase is a program used by the forensic team in the law enforcement unit. So its not exactly a commercial program.

[shivanand08]

@unholyernest

dude just wanna ask u recovering files by this method i.e by using any recovery software but in case if u dont have internet then can we recover data manually..how does this software actually works on the system..Can you tell me where it searches and from which location in the system to searches for lost data and recovers it ...is it possible to manually recover lost data without using any recovery software

[DjKurdo10]

is there a way i can recover actual formatted drives with like over 500gb of lost storage thanks to reformated my pc

[unholyernest]

Like i said, data recovery is not always 100%, it is greatly affected by what you did after formatting.

If you format already but have not put in any data, there is a higher chance of data recovery.

But if you fill up your harddisk again and therefore resetting the binary codes, it is much harder to recover.

It is easier to recover smaller files as they remain intact. Things like videos gets harder as losing a small portion could mean corruption.

[EgyptianKings6]

Does this program fix this problem... I was transferring data from one pc to another. Then it seemed I was asked to format the thumbdrive(Centon DataStickPro 8GB). So I did. Now I still can see it in "Mycomputer", but when I click to open it it tells me I need to format it. When I try now it never completes even after hours and has to cancel. Under its properties it shows 0% for used and unused space available. But says it's working properly.

.

Thanx for reply to any smart guru.

[unholyernest]

Well i can't really give you a solution, but i seriously believe that your thumbdrive is somehow faulty. and that lowers the chance of recovering data.

[morry39]

I was just looking at your vid and there's a part where you right click and select recover file...on my program, that option is not available...actually it's not there period. Do you know what's wrong? I reformatted my hard drive recently and I so need to get some important files back!!!

[unholyernest]

There is 2 modes for this program, one is the enterprise version, which is without the USB dongle plugged in, you will only get to browse around the program, you can't use the full function, which includes recovering the partition.

[edwardnese]

Does this encase software always recover files that are not corrupt

[unholyernest]

yes of course, but the chance of recovering a file that is not corrupted is very difficult. if u delete and recover straight away, the chance of recovering is higher, but if you wan to recover a very old file, there is a chance that the binary sa be reset or your files u build up overtime.

[cyberkid111]

well... is this free? i NEED it! please tell me.

[unholyernest]

nope its not free.. 3000 euro pounds if i've not mistaken. my school bought it.

[cyberkid111]

HOLY SHIT! good thing i found another program i can use...

[unholyernest]

not enough words to explain, but i'll do it simple.

when u delete a data, the binary combination have not been lost, not a single bit.

unless u attempt to change it on purpose, like overwriting and fully used up your harddisk.

when the old binary combinations are overwritten, i'm pretty sure it's near impossible to get back already.

but would u have time to format and fill up 1TB of harddisk?

even so, there are experts who can read broken binary codes, those FBI perhaps.

[unholyernest]

no matter how many times u format or delete, slow or fast, there is still a possibility of getting the data back.

the only way to fully mess up the file is to change the binary combination of the harddisk, meaning to overwrite your old data in terms of 0s and 1s.

In theory, it is highly unlikely to get data back that way, but there are professionals who claims its still possible.

[pitbulldog911]

hello .. u can delete / format a hard drive to kill all data i have done it like 5 times i never did no slow format like what u did cuz what u did lets ppl get your data back what i do dont not even the fbi can find any data on one of the hard drives i formated

[ALUMINUM20]

lol..they can

[charliebell01]

i had Encase a couple of months ago and i used it to just fool around but then i realized that this software is good, it gives you dates of deletion and can recover files easily (it depends how long the file was deleted from your dvice, it may have already been overwriten), but i think i deleted it when i re-installed win xp and opensuse, LOL

[smartgirlfat]

what is the name of the song ?

I heard it before during window XP installation.

i miss it so much

[unholyernest]

C:\WINDOWS\system32\oobe\image­s\title.wma

[wutupz]

hahah the movie has chinese sub

[unholyernest]

hhaha.. ya.. thats the file my friend was passing around..

[unholyernest]

which version of encase are u using? there's quite a few versions..

the program won't work if u dun have the EnCase dongle.

did u choose your file location correctly?

[nitrogen111]

i have that encase but its not working.

i lost every thing after format and then i get tht software i follow all the steps and all was well when i get the last one when its finish the recovery it dsnt appear any recovery in the hard can u help plz.

thx

[unholyernest]

EnCase is not a program entitled to anyone, u can google for it and guidance software is the company who "made" this. u can puchase at the price of $3000 pounds. and there are a lot of paper work to fill in. my team is using under our school name.

[aliimalone]

Can u please provide the link of this software i will be realy glad n ty for the video dude

[sunny27jan]

@aliimalone mail me for that