Data Recovery

[artois7]

Lots of free tools floating around on the net, but no reputable IT forums actually discuss this at any length.

What's everyone's experience with data recovery?

Neighbour reinstalled windows, formatted, questions where all the 7 years worth of family photos and business files went. Ask me for help before, not after!

[goontron]

Re: Data Recovery

Backup? if no, try photorec. You may get some back if it's a large drive.... Also give him a rant about not backing up his files for me.

[ChaosLegionnaire]

Re: Data Recovery

common mistake esp. on oem pcs is to create only one partition on a hard disk. always create at least two partitions. one for os only and another for storing user data. i suggest u repartition their hard disk for them too while u're at it, after u have recovered the data of course.

also remember when saving the recoverd files, save them to a different drive! do not overwrite or write/save anything to the drive u are recovering. elementary mistake thats often made.

also ranting at them for not backing up is not enough. they need a thick book about computers. apparently, they have no clue what formatting a drive means!

u can also try pc inspector file recovery. try multiple data recovery programs to find and get most of the data recoverable.

[Th3_uN1Qu3]

Re: Data Recovery

Recuva is the best free one. Better programs like Easeus, PhotoRec or GetDataBack you need to pay for.

[goontron]

Re: Data Recovery

Recuva is the best free one. Better programs like Easeus, PhotoRec or GetDataBack you need to pay for.

WTF error detected. Photorec is free and oss!

[kaboom]

Re: Data Recovery

common mistake esp. on oem pcs is to create only one partition on a hard disk. always create at least two partitions. one for os only and another for storing user data

WTF error #2.

Never do that! When a nasty gets in, it'll kill all partitions, including the one you "certainly" backed up to.

We're not in the 90's anymore; all backups are to external HDDs, local, offsite, otherwise. But the backup drive is never left hot in a system, except when backing up/recovering.

[Sparkey55]

Re: Data Recovery

WTF error #2.

Never do that! When a nasty gets in, it'll kill all partitions, including the one you "certainly" backed up to.

We're not in the 90's anymore; all backups are to external HDDs, local, offsite, otherwise. But the backup drive is never left hot in a system, except when backing up/recovering.

Isolate & quarantine. You got it. +1000

[ChaosLegionnaire]

Re: Data Recovery

i think u misunderstand my point. the TS did not mention anything about a virus in his post as the reason for reformatting and reinstalling windows. my point is seperating the os and data into two partitions allows reinstalling the os without messing up the user's storage data.

considering the majority of ppl typically do not possess external backups, dual partition allows wiping the os without wiping storage data. i did not explicitly state this method also protects against malware. this is a data recovery thread not a malware protection thread... i do know that dual partitions and raid 1 or 5 do not protect against malware.

[TVRepairNoobie]

Re: Data Recovery

Try Runtime GetDataBack (Google It!), works for me on numerous occasions.

[Joe Black]

Re: Data Recovery

+1 to Recuva. Did superb things for me, and is totally free.

+1 to backuping on another physical disk. another partition is fine when you do formats, but hardware quality is going down fast.

[artois7]

Re: Data Recovery

Recuva failed miserably. EaseUS Data Recovery pro has also failed. It's quoted to have found 2.72TB of data but nothing really there whatsoever.

I'm starting to wonder if the Vaio recovery program did a 'full' backup/overwrite rather than a quick format.

[fzabkar]

Re: Data Recovery

I would first establish the physical condition of the drive. Can you obtain a SMART report with a tool such as CrystalDiskInfo? Look for reallocated, pending, or uncorrectable sectors.

http://crystalmark.info/software/Cry...o/index-e.html

If the drive is failing, then I would clone it, sector by sector, with a tool that understands how to work around bad media. Ddrescue is the best freeware tool for this purpose.

https://www.gnu.org/software/ddrescue

Next you need to start by examining the patient drive or the clone with a disc editor in readonly mode. Once you have established the nature of the file system damage, then you can choose your method of repair.

I recommend DMDE. The freeware version has an excellent disc editor and can recover a lot of damaged drives. The full version (US$20) is a powerful data recovery tool.

http://dmde.com/

In the disc editor, go to sector 0 and drag your cursor down the vertical scrollbar. If every sector (past the formatted area at the beginning) is full of zeros, then the drive will have been wiped. Otherwise the data should still be there.

If you have removed the drive from an external enclosure and installed it inside your computer, then be aware that some external drives (eg WD My Book Essentials) are hardware encrypted. The USB-SATA bridge PCB inside the enclosure handles the encryption/decryption. If you install such a drive inside your PC, all you will see will be gibberish. Furthermore, WD and Seagate external 3TB+ drives use 4KB sectoring. If you install such a drive inside your PC, you will expose its native 512B sectoring and render the file system inaccessible. Essentially you will have a 4Kn file system on a 512e drive.

PhotoRec (freeware) searches for files on the basis of their headers. For example, JPEGs may have "JFIF" text in the header while GIF files begin with "GIF89a". Usually such files will be recovered without file names. That's because the original MFT will have been destroyed by the formatting process.

Data recovery professionals recommend R-Studio and UFS Explorer. Some use GetDataBack.

The freeware version of DMDE will allow you to perform an NTFS search. This will find all remnants of the previous file system. You will be able to recover a limited amount of data, but at least you will see whether recovery is possible.

[Per Hansson]

Re: Data Recovery

I recommend R-Studio, it's done some magic for me in the past.
GetDataBack NTFS is also useful, but IMO not nearly as good as the former.

[shovenose]

Re: Data Recovery

For backup, I highly recommend Backblaze. Sure, it's a recurring fee but it's cheap ($95 for two years), so cheaper than a 2TB external HDD and you don't have to worry about plugging it in, losing it, dropping it, virus getting to it, etc. That's under $4/month less than one Starbucks. Even if you only pay monthly it's $5/month which is still a good deal.

As I mentioned, Backblaze is not affected by CryptoLocker, etc. since it doesn't mount a volume to the computer for back up. So if you get CryptoLocker (or CryptoWall, or any other variant) of that nasty virus which can destroy external hard drives, network attached storage, shared files on servers, etc. simply reinstall the computer and download all your stuff again

Backblaze saved my ass multiple times, mainly when I left my laptop on the hood of my truck, it fell onto a busy road, and got run over for a few hours. The SSD pancake did not have any more data on it at that point.

Oh, and BackBlaze has a blog with tons of cool info on it, including their open source storage pod designs and they also publish hard drive failure rate statistics:
https://www.backblaze.com/blog/


Not affiliate link: https://www.backblaze.com/cloud-backup.html
Affiliate link (thank you!): http://www.backblaze.com/partner/af8504

As far as data recovery, there is a local company here called DriveSavers. At the computer store I have a part time job at, we recommend them all the time. They are pricey, but it's amazing what they can get back.

As far as software to recover data, there is only so much software can do even after a reinstall. Backing up properly so that you don't need to worry about data recovery is the only way to go.

[artois7]

Re: Data Recovery

I would first establish the physical condition of the drive. Can you obtain a SMART report with a tool such as CrystalDiskInfo? Look for reallocated, pending, or uncorrectable sectors.

http://crystalmark.info/software/Cry...o/index-e.html

If the drive is failing, then I would clone it, sector by sector, with a tool that understands how to work around bad media. Ddrescue is the best freeware tool for this purpose.

https://www.gnu.org/software/ddrescue

Next you need to start by examining the patient drive or the clone with a disc editor in readonly mode. Once you have established the nature of the file system damage, then you can choose your method of repair.

I recommend DMDE. The freeware version has an excellent disc editor and can recover a lot of damaged drives. The full version (US$20) is a powerful data recovery tool.

http://dmde.com/

In the disc editor, go to sector 0 and drag your cursor down the vertical scrollbar. If every sector (past the formatted area at the beginning) is full of zeros, then the drive will have been wiped. Otherwise the data should still be there.

If you have removed the drive from an external enclosure and installed it inside your computer, then be aware that some external drives (eg WD My Book Essentials) are hardware encrypted. The USB-SATA bridge PCB inside the enclosure handles the encryption/decryption. If you install such a drive inside your PC, all you will see will be gibberish. Furthermore, WD and Seagate external 3TB+ drives use 4KB sectoring. If you install such a drive inside your PC, you will expose its native 512B sectoring and render the file system inaccessible. Essentially you will have a 4Kn file system on a 512e drive.

PhotoRec (freeware) searches for files on the basis of their headers. For example, JPEGs may have "JFIF" text in the header while GIF files begin with "GIF89a". Usually such files will be recovered without file names. That's because the original MFT will have been destroyed by the formatting process.

Data recovery professionals recommend R-Studio and UFS Explorer. Some use GetDataBack.

The freeware version of DMDE will allow you to perform an NTFS search. This will find all remnants of the previous file system. You will be able to recover a limited amount of data, but at least you will see whether recovery is possible.

Excellent reply; thank you.

The harddrive is fine, smart data is all OK. My guess is that Windows got corrupted, and rather than talk to me, they went ahead and used the built in recovery partition.

EaseUS data recovery is returning just RAW files, 90% of which is corrupt.

R-studio looks powerful, however runs as a live system only. I have the harddrive connected to a machine via usb.

Running a scan with DMDE now. Will report back. It's looking a lot like the custom recovery did a once over write on the drive.

[eccerr0r]

Re: Data Recovery

Now with phones and android and ios, there really is no option to "reinstall" and overwrite your photos... Good thing? Bad thing?






Obviously... bad thing... Not the obvious bad thing that you simply can't reformat and get back to initial state, but when people start thinking and expecting things to never need reinstall, they'll put PCs out to pasture because they "need" to do it "once in a while"?

[artois7]

Re: Data Recovery

What? Are you trying to say you can't reinstall the OS on an Android or iOS device?

This issue is still perfectly relevant in mobile devices. Sorry; not sure I follow what you are suggesting.

[ratdude747]

Re: Data Recovery

Now with phones and android and ios, there really is no option to "reinstall" and overwrite your photos... Good thing? Bad thing?






Obviously... bad thing... Not the obvious bad thing that you simply can't reformat and get back to initial state, but when people start thinking and expecting things to never need reinstall, they'll put PCs out to pasture because they "need" to do it "once in a while"?

Sure you can on an android device... if it's rooted. TWRP /CWM for the win.

[goontron]

Re: Data Recovery

Now with phones and android and ios, there really is no option to "reinstall" and overwrite your photos... Good thing? Bad thing?






Obviously... bad thing... Not the obvious bad thing that you simply can't reformat and get back to initial state, but when people start thinking and expecting things to never need reinstall, they'll put PCs out to pasture because they "need" to do it "once in a while"?

Lay off the weed. Of course you can! Flash the signed firmware for your device!

[eccerr0r]

Re: Data Recovery

rooted? Is that default when you buy any phone?

You can flash the firmware with the phone itself without another machine?