North York, Ontario, Canada.
Everyone once in a while we get an interesting case that makes you scratch your head. We recently had a client that had re-formatted her hard drive and re-installed a bunch of programs before realizing that over 5 years of digital photographs were inadvertently forgotten. In a panic she arrived desperate for some advice or assistance in retrieving her photos. We quickly calmed her fears and assured her if there were photographs left intact on her hard drive, we could recover them.
Once in the lab we discovered that her actions had only overwritten a small portion of the drive’s file system and we were able to provide her with 85% of her pictures intact and in their original folders. We also recovered hundreds of orphaned photos which we gathered and put into a separate folder. She was ecstatic and went on her way happy to have her pictures.
A few days passed and we received a call from one very unhappy client. Apparently, we have included photographs which do not belong to her and they are of a very racy nature. She is irate and offended. Of course her husband denies any knowledge of these pictures, nobody else has access to her system, and the people in the pictures are not familiar to her or her husband.
I’m at a loss to explain how this could happen. My only thought is that the target drive we imaged her drive to, was not erased prior to us using it, and we have recovered images from what is left of some former client’s data image. But our target drives are always prepared in advance with a pre-determined pattern written on every sector, and we are extremely meticulous in these processes. We quickly pull out our virgin image of her drive, which we retain for 30 days, and we confirm that the areas of our drive not used by the present image are still filled with our pre-determined pattern. Ok so what the heck?
In order to get to the bottom of this issue we had the client once again send in her original hard drive. Our image was then compared with the original and not one byte was out of synch. It’s pretty clear that the mystery pictures were on her original drive before she ever brought it to us. A conversation ensues with the client as to the history of the computer and the hard drive inside it. She reveals that the original hard drive was filled to capacity several years ago and her son-in-law upgraded her to a larger drive. Uh-huh … I think we’re getting somewhere. Where did the son-in-law purchase the “new” drive? “Oh it wasn’t so new, he purchased it on eBay.” The pieces quickly merge together as we realize that the images have survived several formats and at least 2 years of constant computer use. Who took the pictures originally and who the cute girl is, we may never know, but we do know there is one husband who is very happy not to recognize her.
