Oops… It wasn’t a Trojan

For many years I have taught people that they really need to back up their data. Sometimes malicious software destroys data and a good back up is one defense against that type of attack, but more often data is lost due to many other reasons. In addition to backing up your data you need to verify the backup worked. That’s where I just got bit.

I got a MacBook Pro and I backed up my old hard drive… or so I thought. I didn’t validate the backup and a few files evidently didn’t get backed up.  The old hard drive had 3 partitions and over 150 gigabytes of data. I unpartitioned the hard drive and then created a single partition and formatted the drive.

I wasn’t really concerned with wiping the drive because I know where it will get used and with enough use my old data won’t be recoverable. Before I was about to turn in the old hard drive I decided to see what all cold be recovered, so I enlisted the assistance of our own Distinguished Researcher, Aryeh Goretsky. Aryeh has commercial recovery software.

Most of the former C drive was recoverable, however, the folders that contained the files I wanted were not recoverable. I’m trying a couple of other utilities to see if I can find the files, but life will go on splendidly without them anyway.

There are two morals to the story are:

1) Test your back ups. It can be quite useful to make sure you have the right number of files.
2) Much of your data is still quite easy to recover even after repartitioning your hard drive, so before you let an old hard drive get into an unknown person’s hands, make sure you use a file wiping utility.

Incidentally, for some things I make multiple backups just in case I lose one or the media fails.

Randy Abrams
Director of Technical Education

Author , ESET

Follow us

Copyright © 2016 ESET, All Rights Reserved.