Beware of Windows 7 when recovering data!

A forum on data recovery using the professional data recovery software R-STUDIO.
QuattroDK
Posts: 2
Joined: Thu Jan 05, 2012 6:59 am
Location: Zeeland, Denmark

Re: Beware of Windows 7 when recovering data!

Post by QuattroDK » Tue Oct 21, 2014 8:55 pm

I made it best practice here always to use the RSEmergencyGUI CD when recovering windows disks. :idea:
It's not only this Win 7 issue, it is also the system volume information being filled with some info from my windows installation. So if there is any data lost/deleted this alone may ruin your chances for a good recovery. :oops:
--
:ugeek: Alternative - the even better prattice - is to use a read-only device for the client disk - now as USB 3.0 has arrived the speed loss of former days USB 1 or 2 connected disks has gone. AND the devices has become cheaper - I see then at some 60$ where before they were at +250$ (forensic "class")
Per aspera ad astra

Alt
Site Moderator
Posts: 2454
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Beware of Windows 7 when recovering data!

Post by Alt » Wed Oct 22, 2014 6:40 am

Linux systems are good for that, too.

Data-Medics
Posts: 186
Joined: Tue Oct 20, 2015 10:13 am
Location: Providence, RI USA
Contact:

Re: Beware of Windows 7 when recovering data!

Post by Data-Medics » Tue May 10, 2016 12:56 pm

If you want to deactivate a drive so Windows won't make any changes all you have to do is deactivate the MBR by changing the last two characters in sector 0 from AA to BB. Then Windows will completely ignore the disk. R-Studio on the other hand will have no issue, as it ignores this change. It's a small feature that some of us have requested to be added into R-Studio in the past, but is easy enough to manually do it.

coctailrob

Re: Beware of Windows 7 when recovering data!

Post by coctailrob » Sun Apr 28, 2019 4:41 am

I find its best to disable automounting of drives for any machine that is being used for data recovery.
This way it not only prevents Windows from writing to the drive, it also stops it trying to read bad drives which can cause severe slowdowns for drives with bad sectors.
https://www.tenforums.com/tutorials/117 ... ndows.html
Briefly:
1. Open an elevated command prompt.
2. Type diskpart into the elevated command prompt, and press Enter. (see screenshot below)
3. Type automount disable into the elevated command prompt, and press Enter
Of course it means you have to go into diskmanagement to assign drive letters to any drives you do want mounted, for example external drives, but I find that is a small price to pay.

Alt
Site Moderator
Posts: 2454
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Beware of Windows 7 when recovering data!

Post by Alt » Sun Apr 28, 2019 1:15 pm

coctailrob wrote:
Sun Apr 28, 2019 4:41 am
I find its best to disable automounting of drives for any machine that is being used for data recovery.
Thanks for a good advice!

Post Reply