Author Topic: Data recovery software suggestions? (Read 46415 times)

iphigenie · « **Reply #25 on:** August 31, 2007, 08:10 AM »

Spinrite is not all FUD to me. Spinrite managed to recover a huge amount of data of a drive which was dying on me and was erratic, and could not be read from any other way. It also once recovered a lot of files for me on a drive where the whole partitioning had gone wrong. Both were a long time ago, but still. I also used to to recover files of a drive in a laptop which had been badly damaged and couldnt run long enough in windows to run any of those easier tools.

Spinrite doesnt make sense when your drive is fine and windows still runs and these other tools can actually run. And when the reason you have lost your files is either deleting them or something overwriting them, all of it within the normal working of your OS. Spinrite is aimed at a different situation.

Not had to use it much since as I have better backup policies in place, but will continue buying new versions until I can no longer remember why I am so grateful to it.

rjbull · « **Reply #26 on:** August 31, 2007, 10:09 AM »

For undeletion, I don't think Recuva has been mentioned yet - see Appaholic's blog post. Freeware - well, donationware

by the CCleaner people.

For getting stuff off damaged drives, there's Roadkil's Unstoppable Copier, mentioned on TinyApps, though I didn't have much luck the only time I tried it.

brahman · « **Reply #27 on:** August 31, 2007, 05:57 PM »

Rjbull already mentioned it, but here is some more information:

Usually the free undeleter are bested by their commercial counterparts, but this has changed in recent weeks.

One of the best undelete file utilities I have found is the new Recuva.

It is incredibly fast, yet accurate and gives detailed recovery information.

You can also make it show a directory view of undeleted files, which is very nice. Also it restores files to their original date, which is a feature that when missing annoys me mucho.

I took part in their beta and believe me those guys are very serious about their software! It has gone through innumerable betas before they even released it into public beta and then more and more until it went final. And you don't see it, because they keep their extremely sophisticated software simple by design. Of course free is very nice also!

You know them probably, because they are the publishers of Crap Cleaner, which by the way is in RC status for version 2, and it is very, very good also. Completely portable now, no dependencies and even faster than the previous version, something I have thought to be impossible but they did it! Tip for upgrader: Copy your old winapp2.ini (the 2 is the important number here) to your new ccleaner folder.

Please let me know how Recuva stacks up to your other file recovery software.

I have heard very good things about Restorer v3. A freeware alternative to this program may be the very capable version 1 of Handy Recovery, which is still being given away as a service, while the higher versions (v4 now) are commercial.

BTW another favorite undeleter is BacktoLife for TC, which works seamlessly in Total Commander and therefore earned this status for pure convenience.

I also looked at CD Roller mentioned by Darwin in another thread and it seems to be a truly capable program.

If you can settle for a little bit less of bells and whistles I would consider another freeware CD Recovery.

Also all of these are very nicely complemented by the new v3 beta release of freeware standby Roadkil's Unstoppable Copier, which has enhanced its data recovery functions quite a bit. It has done wonders for me when recovering big multimedia files from DVD which had a few bad bytes in them (oh so common these days when you go over 4GB capacity on DVDs). Also take a good look at his other utilities: The only freeware REVERSE cloning program known to me (important on a failing HD, because the reverse cloning is easier on the failing hardware and you can encircle an area of bad sectors from front and behind).

Spinrite I have found a bit tricky. It used to be a life saver in the pre-IDE days, but nowadays I think HDDRegenerator is a little bit easier on the hardware while doing the same if not better task but more gentle on the drive. But really: If Spinrite reports any anomally, data should be moved ASAP and the drive retired IMHO. Both these programs cost quite a bit.

Regards,

Brahman

mwb1100 · « **Reply #28 on:** August 31, 2007, 06:32 PM »

I have heard very good things about Restorer v3.
-brahman (August 31, 2007, 05:57 PM)

I recently had another opportunity to attempt recovery from a drive with a head crash using Restorer 2000 v2. The bad news is that v2 could not recover the data; the good news is that after an inexpensive upgrade to v3, all the files that were important were successfully pulled out of the image file that v2 had made (imaging the drive took about 30 hrs due to the number of defective areas).

I gotta back up that machine more often than once a week...

brahman · « **Reply #29 on:** September 01, 2007, 03:41 AM »

Hi mwb1100,

glad you got your data back!

Could you elaborate on the imaging facilities of Restorer?
Can it do reverse cloning? Skip over defective areas? Long reads? Clone the physical drive even when the MBR is corrupted?

Usually professionals do not use Windows based programs for cloning, because Windows prevents software to have direct disk access. Therefore it will be impossible to mount a drive that is not recognized by the BIOS. (An exception is the very professional and expensive ($3000+) PC3000, which actually uses its own PCI board as a separate controller to attach drives too (not telling Windows that this is a drive controller) thereby allowing its own software complete GUI control over everything.)

Regards,

Brahman

f0dder · « **Reply #30 on:** September 01, 2007, 03:54 AM »

Recuva looks interesting, probably very decent against accidental deletes etc... but is it any good for real recovery? I'm talking of the "Oops, I accidentally formatted my harddrive and reinstalled windows+kaspersky, and realized I didn't get _those_ important files backed up" kind?

Because that's the situation I'm facing right now. GetDataBack found a whole lot of stuff, but not exactly what I was looking for >_<, so now I'm writing my own imaging software.

brahman · « **Reply #31 on:** September 01, 2007, 05:32 AM »

Recuva looks interesting, probably very decent against accidental deletes etc... but is it any good for real recovery?

As you correctly gathered: No it is not!

No need to write your own imaging software: What you need are the following completely FREE programs to

1.) CLONE the drive first to a drive of equal or bigger size.

a.) To make life MUCH easier for you in the recovery process later: WIPE (I.E. OVERWRITE) THE TARGET DRIVE YOU ARE CLONING TO BIT BY BIT FIRST - A FORMAT IS NOT ENOUGH!

b.) Install the original drive as a secondary HD on the second master IDE channel, leaving the slave channel empty. Install the target drive on another master IDE channel, leaving its slave channel empty also. If you now do not have any IDE channels left, go the DOS route below.

c.) If you plan to clone under Windows (since I assume there are no physical problems, just an accidental delete):

Roadkil's RawCopy

OR alternatively from DOS with copyr.dma OR Clone Maxx (read the FAQ on the Web).

d.) After you have made the clone, work with the clone only. Take out the original HD and keep your original data safe.

e.) Mount the CLONED drive as a secondary HD on the second master IDE channel, leaving the slave channel empty. Now

2.) Use Testdisk if you think there may be a full partition that can still be recovered, because youy new install did not overwrite a partition boundary OR (if no partition can be recovered) Photorec from the same author (the name is misleading) to search your CLONED HD for recoverable files to be put together from pieces.

Testdisk and Photorec are HIGHLY recommended for recovering partitions (mainly Testdisk) and putting lost files together (mainly Photorec).

But: NO GUI.

+++Read the instructions carefully! Some functions are well hidden

.
+++Do NOT rewrite the MBR with Testdisk!
+++For working with the cloned drive use the geometry of the original drive in testdisk (if necessary as a last resort), but better try a thorough scan without entering any parameters.
+++DO NOT use Testdisk (or any other recovery software like it) on a hard drive connected to a USB port, since the USB connection CANNOT correctly communicate the physical characteristics of the drive to the OS and therefore the assumptions these programs make for partition recovery (cylinder boundaries) may be wrong!

(Photorec CAN be used safely on a USD HD.)

If you are looking for a commercial solution, then Restorer 2000 v3 may be a good one in this case, though you may need the PRO version to do the advanced file scanning.

Also Handy Recovery v4 may do the trick. The emphasis on these windows program is more on recovery than on cloning.

A capable commercial DOS alternative would be Diskpatch which is on sale right now ($29.95 vs. $49.95). It is is an excellent cloning tool but it won't help you much with the recovery in your particular case of a reformated and overwritten partition. I consider it the best cloning tool in the sub-200 Dollar range, only some really professional software (pricewise mostly) can best it.

However, you can try the demo version of iRecover which is a windows program from the same people. It allows you to recover PHOTO files for FREE and is limited in the demo version to recover ONE DIRECTORY, no matter how many files or how big it is.

Also now ON SALE for $39.95 vs. 79.95 original.

It does not CLONE but you can use it to IMAGE your drive if you want. It recovers non-destructively. It thorougly scans your HD and puts your lost files together again. DO NOT use it on a failing drive with hardware problems, but for your situation it may be the perfect solution. It can also be run from Bart PE if you have no other way of accessing your drive (f.e. a problem with your notebook drive).

They have very good and competent tech support. Their web site and forum also has a wealth of information about sound recovery procedures and is extremely educational.

How about arranging for some BIG discounts on restorer 2000 and handy recovery for our supporting members? It would benfit us all when disaster strikes (irecover and diskpatch are already on sale)!

Hope this helps.

Regards,

Brahman

f0dder · « **Reply #32 on:** September 01, 2007, 06:50 AM »

Problem is that I can't really install a new drive or move the other drive to another box, since it's a laptop drive I need to image... so I'm doing my own TCP/IP imaging thingamajig. I've already wrote the receiving end and tested it (<3 netcat), now I need to write the sending end. I've also made ~132gig free on my workstation, but I plan to use a sparse file for the image, since large parts of the laptop drive was - hopefully - empty.

Once I have the image, I'll probably just grep through it, or write some special (==fast) data-pattern searcher. GetDataBack didn't find the file(s) I was looking for, so the filesystem metadata was destroyed/overwritten enough that it won't be helpful, I'll have to boyer-moore on the actualy file contents; good it was text/source files and I have a good idea what to search for.

Of course there's no guarantee that the actual file data wasn't overwritten by windows reinstall, but I hope this windows+kaspersky install is "at the beginning at the disk" and that my file data used to be somewhere around "the middle of the disk".

But of course if what really happened is that I deleted "c:\src" insted of moving it under "c:\stuff", the file data from "c:\src" was probably overwritten when I RAR'ed "c:\stuff" to "c:\stuff.rar". Oh well, time will tell.

brahman · « **Reply #33 on:** September 01, 2007, 07:10 AM »

Hi f0dder,

please read the last part of my previous post, in which I added important information overlapping with your post later.

For your situation iRecover run from a BartPE boot CD saving the recovered data to a USB drive should do the trick.

BUT: There are very inexpensive adapters from notebook IDE to laptop IDE which let you install the notebook drive in a desktop machine (less than $5).

Then you can also follow the more elaborate routine outlined above.

But first try the demo of iRecover. It might do the job.

Regards,

Brahman

f0dder · « **Reply #34 on:** September 01, 2007, 08:17 AM »

Well, I'd have to find an IDE drive big enough to fit in my (sucky) USB enclosure, or buy an adapter... it's more fun (and cheaper and a bit faster, considering it's saturday and computer shops are closed

) writing the image-transferring software myself... and it might come in handy some other time.

Once I have the image file on my workstation I can use "whatever" to work on the image file, but I doubt any of the standard tools will work, since the filesystem metadata has been overwritten. Raw searching for text data should work, though, if there is anything left.

Thanks for your suggestions, nevertheless

mwb1100 · « **Reply #35 on:** September 01, 2007, 01:06 PM »

Could you elaborate on the imaging facilities of Restorer?
Can it do reverse cloning? Skip over defective areas? Long reads? Clone the physical drive even when the MBR is corrupted?
-brahman (September 01, 2007, 03:41 AM)

Ummm... mostly I don't know. It skips defective areas, but it takes a long time doing so as it appears to attempt to read the defective sector multiple times, and there are usually many defective sectors in a particular bad area. I'm really not knowledgeable about the internal workings of the software.

I don't even know what a reverse clone or long read is.

It does require that the drive be recognized by windows, at least to the point where it will give it a drive letter (I think), but certainly Windows does not need to be able to recognize a file system on the device.

What I did was remove the failed drive and plug it into an IDE to USE adapter. I plugged the USB adapter into another machine and started up Restorer. It showed the failed drive in its list of devices, and I told it to create an image to a location that had plenty of space (this was done with Restorer v2).

A day and a half later (because attempting to read the defective areas takes a long time), the image was complete, and I told Restorer v2 to analyze the image. It didn't come up with anything that looked useful, so I tried the v3 trial, and it was able to successfully analyze the image (the trial limitation is that it will only let you copy off files smaller than 64K). So I upgraded to v3 and was able to recover what I wanted.

tomos · « **Reply #36 on:** June 05, 2008, 08:03 AM »

well after deleting a backup which I shouldnt have & it mysteriously not being in the Recycle Bin
I tried these on my backup partition

Recuva 1.14.321 - found absolutely nothing
Handy Recovery 1 -the free version linked to above by Braham - didnt seem to find anything - not what I was looking for at any rate
Back2Life - found absolutely nothing
File Recover 6.2.0.20 (PCTools) found a bunch of stuff, unnamed, no details about what they were, wouldnt restore them because it was a trial (again, a case of hiding the fact it had to be paid for*, never mind the price, not stating trial limitations clearly - on principle I've decided to avoid software that does this, unless I'm desperate

)

I threw in the towel at that stage, went & redid my lost work - I lost more time this morning faffing around with these than I actually lost with the deleted file

* on the page I went to at any rate -
found it from an add actually, & thought I'd try it cause PCTools are supposed to be good (I think)

Darwin · « **Reply #37 on:** June 05, 2008, 08:42 AM »

Should have trialled Restorer 2000 or RecoverMyFiles... both are quite pricey shareware but offer previews of the files recovered and display the recovered files with their original filename! Of course, if either of these trials had found your file, you'd have been out the purchase price to actually recover it! RecoverMyFiles is $69 for a lifetime licence and Restorer2000 $49 with free updates to the version you buy... My usage of them proceeds this way - try RecoverMyFiles first, proceed to Restorer2000 if RMF doesn't find what I'm looking for. This actually happens only rarely. I should probably do this the other way around as Restorer2000 is MUCH quicker in searching for and displaying deleted content. However, RFM has a slightly more intuitive interface IMHO!

Curt · « **Reply #38 on:** June 05, 2008, 10:57 AM »

GetDataBack has a very good reputation: http://www.runtime.org/
-mouser (September 12, 2006, 07:25 PM)

I am getting even more interested in this GetDataBack because of this new feature they added via the free HDHost:

HDHost
Recover files over your local network or even over the Internet

HDHost enables you to run the GetDataBack on one computer ("remote") while accessing the drives of another computer ("host").

The "remote" computer runs GetDataBack, the "host" computer runs HDHost.

If there is no way to attach the drive to a working computer (e.g. a laptop hard drive) you can run HdHost from a WinPE boot CD-Rom. The benefit is you do not need to install any software on the system or drive you want to recover from.

You can run GetDataBack (too) from a WinPE boot CD-ROM.

GetDataBack for NTFS is $79, and for FAT it is $69 - GetDataBack supports Unicode.

Note: We recommend that you download the demo version of GetDataBack first to see if your files are recoverable. The demo version allows you to perform the data recovery and to see and verify your recovered files.

A license key is then required to actually save these files. Once you have a license key for the software, you don't have to run the program again, just enter the license key in the demo version to enable the copy function.

- even more thumbs up!

http://www.runtime.o...ecovery-software.htm

f0dder · « **Reply #39 on:** June 05, 2008, 11:05 AM »

GetDataBack is pretty slow, but it has worked very well for me in the past - except when doing really stupid things

Darwin · « **Reply #40 on:** June 05, 2008, 12:02 PM »

Should have trialled Restorer 2000 or RecoverMyFiles... both are quite pricey shareware but offer previews of the files recovered and display the recovered files with their original filename! Of course, if either of these trials had found your file, you'd have been out the purchase price to actually recover it! RecoverMyFiles is $69 for a lifetime licence and Restorer2000 $49 with free updates to the version you buy... My usage of them proceeds this way - try RecoverMyFiles first, proceed to Restorer2000 if RMF doesn't find what I'm looking for. This actually happens only rarely. I should probably do this the other way around as Restorer2000 is MUCH quicker in searching for and displaying deleted content. However, RFM has a slightly more intuitive interface IMHO!
-Darwin (June 05, 2008, 08:42 AM)

And Darwin sets a new standard for breathlessness... look at all of those exclamation marks! Doh! I did it again....

Armando · « **Reply #41 on:** June 05, 2008, 06:32 PM »

What happens when a file is accidentally overwritten (replaced) by a file with the same name? Is it actually physically over written, or is it still there somewhere on the hard drive (hence possible to recover)?

f0dder · « **Reply #42 on:** June 05, 2008, 06:37 PM »

What happens when a file is accidentally overwritten (replaced) by a file with the same name? Is it actually physically over written, or is it still there somewhere on the hard drive (hence possible to recover)?
-Armando (June 05, 2008, 06:32 PM)

Depends on the filesystem. Traditionally, the area that's overwritten is re-used directly, because that's the most efficient thing to do. The old data is then gone (OK, so it's said that there's magnetic residue etc., but I've never been able to tell if that's just superstition based on how old MFM drives worked, or if it's possible to (ab)use this for modern drives... but normal people don't have access to the necessary gear, anyway).

There's probably at least one "versioning filesystem" out there, but I don't know of any off top of my head, and I would assume it'd have a nasty hit wrt. performance and fragmentation.

Lashiec · « **Reply #43 on:** June 05, 2008, 06:43 PM »

There's probably at least one "versioning filesystem" out there, but I don't know of any off top of my head, and I would assume it'd have a nasty hit wrt. performance and fragmentation.
-f0dder (June 05, 2008, 06:37 PM)

ZFS?

f0dder · « **Reply #44 on:** June 05, 2008, 07:02 PM »

There's probably at least one "versioning filesystem" out there, but I don't know of any off top of my head, and I would assume it'd have a nasty hit wrt. performance and fragmentation.
-f0dder (June 05, 2008, 06:37 PM)
ZFS?
-Lashiec (June 05, 2008, 06:43 PM)

Humm, ZFS uses copy-on-write journalling, but does it do revisions? I know it has, probably tied to it's COW journalling

, some relatively inexpensive snapshot, stuff, but I'm not sure just how it works (ie., if it's something you could turn on globally, or you need to manually "take a snapshot" of a file).

Anyhow, it's COW journalling does mean you could probably track down old file contents, which is the most important point. Think about the implications wrt. secure file wiping?

Armando · « **Reply #45 on:** June 05, 2008, 07:07 PM »

Thanks. I was asking because my dad overwrote an important finance file yesterday and he wanted to know whether it was possible to get back... or not. So I guess it's not possible?

f0dder · « **Reply #46 on:** June 05, 2008, 07:38 PM »

Thanks. I was asking because my dad overwrote an important finance file yesterday and he wanted to know whether it was possible to get back... or not. So I guess it's not possible?
-Armando (June 05, 2008, 07:07 PM)

If he's using normal FAT or NTFS filesystems, no - unless you're really lucky that a temporary copy has been made somewhere...

Armando · « **Reply #47 on:** June 05, 2008, 08:44 PM »

OK. I'll check that out. Thank you very much f0dder.

Shades · « **Reply #48 on:** June 05, 2008, 08:46 PM »

TestDisk.....yep, the force is strong with this one. Unfortunately it is alo misguided. Indeed, there is no GUI, but it makes up for it with quite fast retrieval of data that you thought was long gone.

All the times I have used it (version 6.5, if memory serves me right) quickly a pile of information was retrieved using the naming convention "File%number%.%original extension%". It took me hours to find my lost file011223.doc.

Don't know if I missed a setting of some sorts, but this software is not for the time-challenged ones among us.

steeladept · « **Reply #49 on:** June 06, 2008, 07:50 PM »

Personally for data recovery, I must suggest Ontrack EasyRecovery. It is expensive, but it works like a charm (when I bought it, it was $200 USD, but they now have an individual version for $89 USD). As an added bonus, you can check with their tool to ensure you can recover your data with their software before you buy it. It is read only and prevents any copying, that is how they force you to buy it; but it is spot on - when it says it can get it, it can!