Leosghost - 1:19 am on Nov 1, 2012 (gmt 0) [edited by: Leosghost at 1:39 am (utc) on Nov 1, 2012]
If they "deleted" it, that can ( and frequently does mean ) they merely told the drive to forget what it did with the data..ie which files are where etc..
This is also known as "low level" formatting..
This can be recovered from ..
But someone needs physical access to the drives that have been wiped ..either on the server or the drives need pulling and mounting as external drives to another machine..off it is the preferred way..
Either way, ( on original machine or off it ) the machine has to have an OS running on another drive ( not on the drive with the data that you want to recover )..
Then you need a "file recovery" program..which one depends on what the file system was that the wiped drive was using..and you need another empty drive , equal in size to, or larger than the "wiped" drive..
the file recovery software is set to read the wiped drive..this will take some considerable time ( depends on the size of the drive(s)..what it finds is then presented as "results" and usually as "a percentage of possibility of recovery"..or in other words how complete and faithful to the original, each file will be..
File in this case can mean html , jpeg, mpeg ,css, jscript etc..file recovery software will allow you to set what it is to look for..( so if you don't have tiff or 3D files , it wont waste time looking for them )..then when it has analysed the "wiped" you set it to "recover" to the empty drive..more than one wiped drive ? ..you need more than one empty one to recover too ..or at least as much space in data terms as you had in total on the wiped drive(s)..
This is basically the same process as is used to recover data from thumbdrives and camera cards..merely scaled up ..it can take a while if the drives you are recovering are over 1 terra..but it is not impossible even with multiple 2 terra drives..
Even if they have wiped by formatting..it is still possible..but the more passes they have made..the less possibility that you have of getting recognisable files back as the file integrity is compromised with each pass of a wipe program..But most vandals do not wipe by multiple pass formatting ..they merely delete and don't even run one full format pass..
Thus your entire site could be there still but merely have the "file allocation tables" ( or their equivalents ) wiped..and so the drive(s) will appear bare..even with a new "vandalised" index page loaded..
Do not write anything to the wiped drive at all if you want to try to recover the data..( because doing so would be writing over your underlying data..which may yet be recoverable ).best is to "pull" that drive..put in a temp redirect at your registrar to another account on another disc..and there ..with a page explaining what happened ..than do as I instructed above..
File recovery software is not horribly expensive ( some good ones at under $100.oo )..it is not a case of you get what you pay for..most is designed to recover from FAT or NTFS ..but some can also recover from UNIX ( linux or mac )..
Depends on what your server(s) was/ were running..
Sorry about any spelling errors in there ..I'm eating while posting ..but figured it was urgent..:)
You can also send the drive to a company specilising in data recovery ( if they don't need to open the drive then you won't need "clean room" services ) ..in which case it may not cost you more than a couple of hundred dollars plus the cost of a second drive for them to write to..
People are always wiping camera cards of weddings , baptisms etc..and occasionally they ( or someone wipes their entire HD )..
I actually a have a business which does data recovery..most is "I wiped my camera card" or "the kids wiped the camera".."clean room" work I farm out to trade houses..
But HDs that do not need opening ..
I have a machine and software set just to recover from HDs and "media"..
It isn't rocket surgery :)
And the software does the work.. while I do something else ..
Not looking for business, I never "tout" in this forum or elsewhere.. ( and I'm not on the same continent ;) ..but if you ask them ..then maybe you'll find that your host has an arrangement with a recovery company ..or a quick search will find you some ..maybe even within driving distance..
Or get the drive in your hands..download the software, and do as explained above..
[edited by: Leosghost at 1:39 am (utc) on Nov 1, 2012]