A major brain-fade forces Fred Langa to search for the most powerful recovery tools he could find.
It was late. I was tired. And I screwed up, big time.
I'd been on the West Coast for a week, and was on the daylong west-to-east return trip. Thanks to frequent-flier miles, I had a good seat on the plane, and was able to work on my laptop almost all the way across North America. I landed with hundreds of E-mails queued on my hard drive, and dozens of new files created or altered. All I needed was to drive home, transfer the files to my main system, reconnect to the Net, and I'd be off and running.
But when I arrived home, I started doing too many things at once: While checking the house, turning on lights and the heat, I booted my home office server and primary desktop system, and then started unloading the car. In between trips, I hooked up the laptop to the LAN, and started synching files with the desktop PC.
After a couple minutes of ferrying more stuff in from the car, some foggy synapse finally fired: Uh-oh. I stopped short, realizing that I'd synched in the wrong direction. I'd also used the synch-tool's dangerous nondefault settings to clone the drive's contents. It's the setting I normally use when setting up a new PC, not for catching up after a trip. Instead of the laptop sending new and changed files to the desktop PC, my desktop PC was busily overwriting the new files on the laptop with the old files from before I left on the trip. Doh!
I could blame jet lag or any number of other factors, but it was just a plain, unadorned, ugly brain-fade: I wasn't thinking clearly, and had done too much, too fast.
I raced through the house to the office and aborted the synch -- I had no idea how far it had gotten, but it was enough so that I had a really bad feeling in the pit of my stomach. I then carefully -- very carefully -- re-synched in the proper direction, pulling files off the laptop to the desktop system, which is what I'd meant to do in the first place. This made no further changes to the laptop system, and did get whatever was left of the new files backed up onto the desktop PC.
I then surveyed the damage. Fortunately, I have large hard drives with lots of files, so most of the original, aborted synch had been comparing files that were identical on both systems. And it turned out that I'd aborted the bad synch before any of the mail files were munged. Whew.
But once I waded through the file structures, I found there were at least four important files that had been reverted to their pre-trip state. It could have been much, much worse, but it still wasn't good news: I could recreate the four rolled-back files, but it would cost me probably half a day's work.
Then I got thinking: Maybe the files were recoverable. The files in question were overwritten, not simply deleted, so basic "unerase" or "undelete" tools weren't likely to help. If the new text existed anywhere, it would probably be outside of the active file areas, somewhere on the laptop's hard drive.
I'd used deep-geek recovery tools -- sometimes called "hex editors," "disk editors," "sector editors," or "programmers' editors" -- in the past, but the one I had on hand was an ancient DOS-based fossil. So I went looking for a newer version, and therein lies a tale.
How Enterprises Are Attacking the IT Security EnterpriseTo learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
2017 State of IT ReportIn today's technology-driven world, "innovation" has become a basic expectation. IT leaders are tasked with making technical magic, improving customer experience, and boosting the bottom line -- yet often without any increase to the IT budget. How are organizations striking the balance between new initiatives and cost control? Download our report to learn about the biggest challenges and how savvy IT executives are overcoming them.