[dba-Tech] Can a "factory restore" be undone?

OMG!!!

Re-imaging is pretty brutal. The only hope that there would be any pictures
left is if these picture are still there on an unwritten portion of the
drive partition.

There are a couple of programs suggested for such a feat. They were
initially created for Linux drives but these tools read and write NTS/FAT
formats as well as Extx formats.

http://www.cgsecurity.org/wiki/TestDisk

...and...

http://www.cgsecurity.org/wiki/PhotoRec

HTH
Jim

-----Original Message-----
From: dba-tech-bounces at databaseadvisors.com
[mailto:dba-tech-bounces at databaseadvisors.com] On Behalf Of John Bartow
Sent: Monday, May 20, 2013 8:14 PM
To: DBA-Tech
Subject: [dba-Tech] Can a "factory restore" be undone?

Hi All,
I had a young mother call me in desperation (because she didn't call me in
the first place ;-) 

Had an infected Compaq Windows Vista PC and boyfriend took care of the
problem for her by restoring it to "factory condition". She's freaked out
because she had 5 years of pictures of her kids on it that are gone now.
(da)

My first hope was that he just reinstalled Windows and the user profiles
would be orphaned but alas, not true. Looks like a clean image has been
written to the partition - I'm assuming that like most consumer PCs, the
factory reset reimaged the hard drive's OS partition from the protected
partition. It does have a protected "recovery" partition.

Any suggestions on trying to recover her photos?

_______________________________________________
dba-Tech mailing list
dba-Tech at databaseadvisors.com
http://databaseadvisors.com/mailman/listinfo/dba-tech
Website: http://www.databaseadvisors.com