Main Area and Open Discussion > General Software Discussion

Data recovery software suggestions?

<< < (7/11) > >>

f0dder:
Recuva looks interesting, probably very decent against accidental deletes etc... but is it any good for real recovery? I'm talking of the "Oops, I accidentally formatted my harddrive and reinstalled windows+kaspersky, and realized I didn't get _those_ important files backed up" kind?

Because that's the situation I'm facing right now. GetDataBack found a whole lot of stuff, but not exactly what I was looking for >_<, so now I'm writing my own imaging software.

brahman:
Recuva looks interesting, probably very decent against accidental deletes etc... but is it any good for real recovery?
--- End quote ---

As you correctly gathered: No it is not!

No need to write your own imaging software: What you need are the following completely FREE programs to

1.) CLONE the drive first to a drive of equal or bigger size.

a.) To make life MUCH easier for you in the recovery process later: WIPE (I.E. OVERWRITE) THE TARGET DRIVE YOU ARE CLONING TO BIT BY BIT FIRST - A FORMAT IS NOT ENOUGH!

b.) Install the original drive as a secondary HD on the second master IDE channel, leaving the slave channel empty. Install the target drive on another master IDE channel, leaving its slave channel empty also. If you now do not have any IDE channels left, go the DOS route below.

c.) If you plan to clone under Windows (since I assume there are no physical problems, just an accidental delete):

Roadkil's RawCopy

OR alternatively from DOS with copyr.dma OR Clone Maxx (read the FAQ on the Web).

d.) After you have made the clone, work with the clone only. Take out the original HD and keep your original data safe.

e.) Mount the CLONED drive as a secondary HD on the second master IDE channel, leaving the slave channel empty. Now

2.) Use Testdisk if you think there may be a full partition that can still be recovered, because youy new install did not overwrite a partition boundary OR (if no partition can be recovered) Photorec from the same author (the name is misleading) to search your CLONED HD for recoverable files to be put together from pieces.

Testdisk and Photorec are HIGHLY recommended for recovering partitions (mainly Testdisk) and putting lost files together (mainly Photorec).

But: NO GUI.

+++Read the instructions carefully! Some functions are well hidden :read:.
+++Do NOT rewrite the MBR with Testdisk!
+++For working with the cloned drive use the geometry of the original drive in testdisk (if necessary as a last resort), but better try a thorough scan without entering any parameters.
+++DO NOT use Testdisk (or any other recovery software like it) on a hard drive connected to a USB port, since the USB connection CANNOT correctly communicate the physical characteristics of the drive to the OS and therefore the assumptions these programs make for partition recovery (cylinder boundaries) may be wrong! :eusa_naughty: (Photorec CAN be used safely on a USD HD.)

If you are looking for a commercial solution, then Restorer 2000 v3 may be a good one in this case, though you may need the PRO version to do the advanced file scanning.

Also Handy Recovery v4 may do the trick. The emphasis on these windows program is more on recovery than on cloning.

A capable commercial DOS alternative would be Diskpatch which is on sale right now ($29.95 vs. $49.95). It is is an excellent cloning tool but it won't help you much with the recovery in your particular case of a reformated and overwritten partition. I consider it the best cloning tool in the sub-200 Dollar range, only some really professional software (pricewise mostly) can best it.

However, you can try the demo version of iRecover which is a windows program from the same people. It allows you to recover PHOTO files for FREE and is limited in the demo version to recover ONE DIRECTORY, no matter how many files or how big it is.

Also now ON SALE for $39.95 vs. 79.95 original.

It does not CLONE but you can use it to IMAGE your drive if you want. It recovers non-destructively. It thorougly scans your HD and puts your lost files together again. DO NOT use it on a failing drive with hardware problems, but for your situation it may be the perfect solution. It can also be run from Bart PE if you have no other way of accessing your drive (f.e. a problem with your notebook drive).

They have very good and competent tech support. Their web site and forum also has a wealth of information about sound recovery procedures and is extremely educational.  :Thmbsup:

How about arranging for some BIG discounts on restorer 2000 and handy recovery for our supporting members? It would benfit us all when disaster strikes (irecover and diskpatch are already on sale)!

Hope this helps. :)

Regards,

Brahman

f0dder:
Problem is that I can't really install a new drive or move the other drive to another box, since it's a laptop drive I need to image... so I'm doing my own TCP/IP imaging thingamajig. I've already wrote the receiving end and tested it (<3 netcat), now I need to write the sending end. I've also made ~132gig free on my workstation, but I plan to use a sparse file for the image, since large parts of the laptop drive was - hopefully - empty.

Once I have the image, I'll probably just grep through it, or write some special (==fast) data-pattern searcher. GetDataBack didn't find the file(s) I was looking for, so the filesystem metadata was destroyed/overwritten enough that it won't be helpful, I'll have to boyer-moore on the actualy file contents; good it was text/source files and I have a good idea what to search for.

Of course there's no guarantee that the actual file data wasn't overwritten by windows reinstall, but I hope this windows+kaspersky install is "at the beginning at the disk" and that my file data used to be somewhere around "the middle of the disk".

But of course if what really happened is that I deleted "c:\src" insted of moving it under "c:\stuff", the file data from "c:\src" was probably overwritten when I RAR'ed "c:\stuff" to "c:\stuff.rar". Oh well, time will tell.

brahman:
Hi f0dder,

please read the last part of my previous post, in which I added important information overlapping with your post later.

For your situation iRecover run from a BartPE boot CD saving the recovered data to a USB drive should do the trick.

BUT: There are very inexpensive adapters from notebook IDE to laptop IDE which let you install the notebook drive in a desktop machine (less than $5).

Then you can also follow the more elaborate routine outlined above.

But first try the demo of iRecover. It might do the job.

Regards,

Brahman

f0dder:
Well, I'd have to find an IDE drive big enough to fit in my (sucky) USB enclosure, or buy an adapter... it's more fun (and cheaper and a bit faster, considering it's saturday and computer shops are closed ;)) writing the image-transferring software myself... and it might come in handy some other time.

Once I have the image file on my workstation I can use "whatever" to work on the image file, but I doubt any of the standard tools will work, since the filesystem metadata has been overwritten. Raw searching for text data should work, though, if there is anything left.

Thanks for your suggestions, nevertheless :)

Navigation

[0] Message Index

[#] Next page

[*] Previous page