YM unsaved archive recovery.Is it possible?

Formatted under which OS?

And with "quick" format or "full" format?

If the data has not been overwritten it should be recoverable.

What is a "YM"?

By "unsaved", you don't really mean "unsaved" you mean "not backed up", I hope.

Encase is more a forensic tool than a data recovery program.

PHOTOREC is a good freeware tool
http//www.cgsecurity.org/wiki/PhotoRec

jaclaz

Assuming it was a Quick format, or just a operating system reload of an NTFS file system then it should be possible to recover.

You need to search the raw disk for all remaininng MFT entries, and find the one for your YM file. Assuming the file was not too fragmented, a full recovery is then possible.

FAT32 is harder as any fragmentation is lost, as well as the full starting cluster address.

Here is some more information.
YM=yahoo messenger
The hard disk was formatted while reinstalling XP (NTFS).There is an option right when XP install starts loading to format with NTFS or FAT.
The archive I am looking for wasn't checked in YM to be saved for the days I need it.The .dat file in YM archive are saved in this format [year][month][day]; So I did serach for the .dat file 20090517 for example and didn't find it.
My real question I guess would be if YM is not configured to save the archive, do the archive files gets saved/logged/snapshot somewhere on the hard disk anyway?

Thanks

Have a look at http//www.xerafoo.com/files/YIM_unallocated.pdf

H

@harryparsonage
Thanks for the nice link/doc. )

@forensika
You are looking NOT for ".dat files", but rather for temporary files/fragments.

Just for the record, and to clear the reason why I asked about the OS and FORMAT use, the behaviour of the FORMAT command has changed from XP in Vista (and presumably 7).
XP
http//support.microsoft.com/kb/302686/en-us
Vista
http//support.microsoft.com/kb/941961/en-us

jaclaz

Have a look at http//www.xerafoo.com/files/YIM_unallocated.pdf

H

Thanks Harry and Jaclaz . It's a very good article.

Assuming it was a Quick format, or just a operating system reload of an NTFS file system then it should be possible to recover.

You need to search the raw disk for all remaininng MFT entries, and find the one for your YM file. Assuming the file was not too fragmented, a full recovery is then possible.

FAT32 is harder as any fragmentation is lost, as well as the full starting cluster address.

FYI - Digital Assembly has developed techniques to recover from even highly fragmented files. Check out http//digital-assembly.com/products/adroit-photo-forensics/

The websote also has technical papers describing the techniques.

Memon - please see my PM on forum usage.