Forgot your password?
typodupeerror
Data Storage Software IT

What Data Recovery Tools Do the Pros Use? 399

Posted by timothy
from the besides-waterboarding dept.
Life2Death writes "I've been working with computers for a long time, and every once and a while someone close to me has a drive go belly up on them. I know there are big, expensive recovery houses that specialize in mission-critical data recovery, like if your house blew up and you have millions of files you need or something, but for the local IT group, what do you guys use? Given that most people are on NTFS (Windows XP) by the numbers, what would you use? I found a ton of tools when I googled, and everyone and their brother suggests something else, so I want to know what software 'just works' on most recoveries of bad, but partially working hard drives. Free software always has a warm spot in my heart."
This discussion has been archived. No new comments can be posted.

What Data Recovery Tools Do the Pros Use?

Comments Filter:
  • for fat and ntfs (Score:5, Informative)

    by keeegan (1526067) on Tuesday June 02, 2009 @10:20AM (#28181769)
    Get Data Back works very well.
    • Re:for fat and ntfs (Score:5, Informative)

      by darkvad0r (1331303) on Tuesday June 02, 2009 @10:25AM (#28181877)
      For a free solution, check TestDisk [cgsecurity.org].
      It has saved my data many times.
      • Re:for fat and ntfs (Score:5, Informative)

        by TheLinuxSRC (683475) * <slashdotNO@SPAMpagewash.com> on Tuesday June 02, 2009 @11:41AM (#28183243) Homepage
        I could not agree more. Just last week I had a designer friend who accidentally deleted the partition his portfolio was on. We tried to recover the partition however the MFT had become lost/corrupted.

        My first attempt to recover his data was with ntfsundelete, [ntfsundelete.com] however it did not recognize the partition at all. I next used Disk Internals NTFS Recovery [diskinternals.com] program (Commercial) with the same results.

        Finally, I Googled a bit and found the testdisk/photorec [cgsecurity.org] package and used that. It took about 40 hours to recover ~225GB data. It was unable to recover filenames, however it did create new directories for each directory it found and recreated the files in those directories, albeit with arbitrary names. Most impressively it did recreate the files with the proper file name extensions. With some creative perl scripting I could have even renamed some of these files based on meta data in the files. This was not necessary in my case.
      • by Zoromo (1568283) on Tuesday June 02, 2009 @06:04PM (#28188663)

        No question with TestDisk [cgsecurity.org] as an excellent open source/free recovery option.

        It was the only thing I found (freeware or pay) that relatively easily restored a couple of NTFS logical partitions--and all data--after they were destroyed by an older version (8.0) of Diskeeper's "boot optimization" defragging. The last time I used Diskeeper or recommended it. I continue to use and recommend TestDisk. The author of TestDisk was also responsive to emails when I encountered a unique issue with the drives I ended up needing help with.

        Note that TestDisk is only for recovering lost partitions and making non-bootable partitions bootable again. For those functions, there is no better program out there.

        Its sister program included in its download--PhotoRec [cgsecurity.org]--can do file recovery. Its designed mainly for recovery of photos off all media, but it supports many different file formats. So the TestDisk/PhotoRec package may be all you need.

        Other freeware/non-open source file recovery alternatives that are reliable and work well:

        --PC INSPECTOR File Recovery [pcinspector.de]. 100% free & full featured, many options. Been using it for years.

        --Recuva [recuva.com]. 100% free, by Piriform [piriform.com], the maker of the very popular CCleaner/Crap Cleaner system cleaner.

        Somewhat less elegant than the above one. But the only freeware option I've studied that can do a "deep scan" of your drives for lost files. Which can take hours, but may turn up more missing data than the other non-PhotoRec options here.

        --EASEUS Deleted File Recovery [easeus-del...covery.com]. A more limited version of their $70 "EASEUS Data Recovery Wizard", but very well designed for basic file recovery.

        There are other freeware file recovery options I've studied, but they are all more limited than the above. Would recommend TestDisk (for partitions) and PhotoRec (for files) first, then the other three (for files) in the order given.

        In all honesty, shelling out for a payware solution is very unlikely to "find" more deleted files on a NTFS partition than the above freeware solutions, unless you have special needs they don't cover. Which is rare. And again, there is nothing better than TestDisk--free or payware--for recovering partitions.

    • by PFactor (135319)
      I second this. It great for recovering data from pretty much anything: flash drives, memory cards, hard drives. The primary caveat is that the drive itself has to be fully operational. If the drive cannot be mounted/connected (like if the drive electronics are fried) this program won't help you.GetDataBack just does a scan of the disk and offers to 'undelete' any file fragments it finds. Also, the bigger the drive, the longer it takes the process to complete. I suppose this is true of all tools that opera
    • Re: (Score:3, Informative)

      by SputnikPanic (927985)

      By necessity, I discovered and used this software just last night, and the data recovery process was smoother than I had anticipated. At one point when I was copying the salvaged files to a good drive, Windows took exception with one of the files and started barking one of its usual program-terminating error messages. I was afraid that I'd have to have GetDataBack reread the whole drive and start the whole process all over again, but the program was robust enough to avoid crashing. It just moved on to th

    • Re:for fat and ntfs (Score:4, Interesting)

      by pushf popf (741049) on Tuesday June 02, 2009 @11:31AM (#28183055)
      I've been doing consulting and software development for around 30 years, and when I was young and dumb, thought I could fix anything. Now I know better and have found that in this situation, the phrase "Wow, that's too bad. Where are your backups?" works nicely.

      While there are all sorts of voodoo, data scraping bit-remunging apps available, at the point before you do anything you have no liability. After you "recover" the data, you're on the hook for everything forever.

      All you need is for the customer to come back 2 years later and tell you they were sued into the dirt because something they were required to disclose was missing or incorrect and you'll wish you never took the job.

      And even if they don't sue, there will be a never-ending stream of phone calls about broken documents, files they can't find and all sorts of other "un-tidyness".

      And even if they don't call, there will be eternal uncertainty about the quality of the recovered data. Are their financials correct? What was that number that had the letters nearby really supposed to be?

      My favorite drive recovery method is now BackupPC. You set it up, configure it for an appropriate number of incremental backups each day and let it fly. When a drive craps out, replace it, click the appropriate checkbox on the "Restore" page and press the "go" button. No doubt, no lawsuits, no untidyness.

      Do-it-yourself Data Recovery is great if you like to putter with things and have lots of time and no liability (employees generally can't be sued by their employer) however when actual money is at stake, it's better to just send the drive out and let someone who is actually equipped and staffed to do the recovery handle the work.

      To put things in a different perspective, how happy would you be if the county tried to sell your house for unpaid taxes because billy-bob "who's really good with computers" did their drive recovery and your tax payments were on one of the bad spots?
      • by Anpheus (908711) on Tuesday June 02, 2009 @12:45PM (#28184135)

        Tell them that you don't have a full copy of all their data. Tell them to tell their lawyers that a hard drive failing is equivalent to a small fire occurring in the secretary's desk and while you, the fireman or handy guy with the fire extinguisher can recover a lot of data, there's no way to be certain that it's all the data.

        People like you are a lot of what's wrong with the world. You cover your ass so much that you don't accomplish what your clients really want or need.

        • by pushf popf (741049) on Tuesday June 02, 2009 @01:06PM (#28184419)
          People like you are a lot of what's wrong with the world. You cover your ass so much that you don't accomplish what your clients really want or need.

          Do you know what's worse than "No Data"?

          Bad Data.

          What my clients really need is data they can trust.

          Telling someone "Here's your data, I got some of it back for you, but I'm not sure how much you lost or if the stuff I got back for you is correct" is great for your mother's vacation pictures. It's not great for your bank, insurance company, doctor, school or anybody else that needs to have verifiable, correct data.
  • by Mikkeles (698461) on Tuesday June 02, 2009 @10:21AM (#28181771)

    Lemon juice and heat!

  • I tell the tools (Score:5, Insightful)

    by Anonymous Coward on Tuesday June 02, 2009 @10:21AM (#28181793)
    That they should have backed up.
    • by Big Hairy Ian (1155547) on Tuesday June 02, 2009 @11:22AM (#28182925)
      Agreed Although the number of times I've been called in when the back up was cocked because nobody knew what they were doing make me think this is a little harsh. Good lesson here kids just because the tape was in overnight doesn't mean there's anything useful on it.
    • Re: (Score:3, Insightful)

      by AmberBlackCat (829689)
      I think, when someone replies to a question about data recovery, and the only thing in the reply is "you should have backed up your data", the person who replied should be modded as some kind of hypertroll. If it were combined with a useful answer, it would be okay. But by itself, it's an absolutely useless reply for the person asking the question.
  • GetDataBack (Score:5, Informative)

    by sean_nestor (781844) on Tuesday June 02, 2009 @10:22AM (#28181807) Homepage
    GetDataBack [runtime.org] has worked perfectly for me many times. Very easy interface, works on deleted files as well as formatted disks (provided the data you want to recover hasn't been overwritten, of course). Worth the $79, IMO.
    • by antdude (79039)

      Any free clones?

    • Another "me too" here.

      Lost a partition to corruption (had extended partition to > 136G without updating W2K service pack to handle it; worked fine for months until I started to fill up the disk). My data was mincemeat, but GetDataBack helped me get what I could.

      Customer service is excellent. The developer is very responsive in the forums.

    • by AmiMoJo (196126)

      Recuva (http://www.recuva.com/) is free and works pretty well. It has a handy preview feature too, although it doesn't always work.

      To be honest, there isn't really much beyond what Recuva can do. Some paid-for tools support scanning for a few more file types in situations where the filesystem is gone and you have to scan the whole disk, but unless you happen to have files in some unusual format then there is no real advantage.

      The one thing which does make a big difference is the drive controller. Some chips

  • Well (Score:5, Informative)

    by ledow (319597) on Tuesday June 02, 2009 @10:23AM (#28181827) Homepage

    ddrescue

    But to be honest, if you've hit that point for an "enthusiast" user, then you're already on your last legs. If you ain't got a backup, forget it - the chances of getting one particular file you've lost might be good, the chances of recovering any significant amounts and being able to verify their integrity are bad.

    Plus, with SSD's, flash, memory cards, etc. the chances of being able to recover *anything* from a faulty drive without professional equipment are fast approaching zero. Most USB Flash drives just "die" when they hit their write limits, rather than fail gracefully into read-only mode.

    • Re:Well (Score:5, Informative)

      by bonehead (6382) on Tuesday June 02, 2009 @10:40AM (#28182157)

      Here's one that's saved my butt several times.

      Often times when a drive fails it's not the physical mechanism that goes bad, it's something on the circuit board. If you can find an identical drive (should be pretty easy in a corporate environment, could be tricky for a home user), just carefully remove the board from the good drive and install it on the bad one. You'd be surprised how many times that "totally dead" hard drive will start working like new.

      The software solutions are great for some situations, but they can't do anything if the drive isn't even visible to them.

    • by seawall (549985) on Tuesday June 02, 2009 @12:06PM (#28183621)
      Assuming the disk works at all: Work on a clone, not the original.

      If you are working on a 2nd generation clone you can afford to take risks in restoring the filesystem. "Oh it that didn't work, fire up another clone and try something else".

      ddrescue (and other damaged disk oriented cloners) lets you work on a copy (or in my preference: a copy of a copy). This preserves the original disk if it has to go to a specialist lab later.

      SpinRite has also saved my bacon more than once but that's something run on the original drive: not done lightly.

      (Warning: dd_rescue is not Gnu ddrescue and Debian Linuxes rename dd_rescue to ddrescue. dd_rescue is a similar but not identical).

      Finally: I need to add Windows NTFS rescue (built in) impressed me last time I needed it. It trundled for many hours but at the end, I had a mostly intact copy of a filesystem on my 2nd generation cloned drive. The original disk had been a mess.

  • None! (Score:2, Informative)

    by Anonymous Coward

    Real professionals never lose their data.

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      Real professionals backup their data.

    • Re: (Score:2, Insightful)

      by tiggertaebo (1480739)

      I'm kinda hoping your trying to be amusing here, if you are though its gone under my humour radar today (and I apologise if I seem like an arse)

      Yes most "professionals" will have backups of their data (which is what I presume you are alluding to) however it's not always the case that those backups will be literally up to the minute, and sometimes its just less hassle to recover any lost "recent" data then it is to just cycle to the last backup and deal with the shortfall. Also its not exactly uncommon for "

      • by Amouth (879122)

        Backups by definition can't be real time - Mirrors can.. but you wouldn't need to recover data if you have a Mirror.

        Out side of experienceing unknown failure of a backup you shouldn't be trying to recover anything.

        When ever you design your backup strategy you have to define the amount of data that is willing to be lost - then design around that and your budget.

        and i don't care what anyone says.. zero loss is never truly achievable.

  • I'm not a pro in this department although I've saved a lot of partial data from hard drives for some friends (I'll be very interested in these comments).

    I use a live CD of Knoppix which has really good system repair and troubleshooting [wikipedia.org]. I also have another important tool which is an old Dell Intel motherboard that allows me to set the rotational speed of the drive. Example: my friend's laptop is giving him the click of death so I pop out the IDE drive and hook it up to a 2.5" to 3.5" connector and plug it into the motherboard with a working 1TB 3.5" slaved. On boot up, I hit the BIOS and set the speed as low as it can go or low enough like 1,000 RPM. Then I boot into Knoppix live CD and check to see if I can mount the file system. Knoppix seems to be able to mount a lot of partitions that other more stringent flavors of Linux don't. Sometimes it clicks from the get go and there's nothing you can do. But if it doesn't, then I set a script up to copy their most valuable directories first onto the working 1TB drive. I let it run all night or weekend and check the drive periodically for heat problems. People are surprised what you can save for them doing this ... the downside is sometimes I'm surprised in what I save for people--p0rn is not worth my time.
    • by goombah99 (560566)

      once you have linux up and running the first thing I do is try dd with the "ignore error" setting. this way I cant get a copy of the bad disk onto a good disk. Now I've separated the recovery from corruption from the problems due to intermittency.

      • Re: (Score:3, Interesting)

        by Kiaser Zohsay (20134)

        ddresuce (or dd_rescue) is a better choice here, because instead it will write zeros in place of read errors, so that successfully read block later on are in the right place. You can also set it to retry error block multiple times, and record progress to a log file so you can resume the retries at a later time.

    • Re: (Score:2, Informative)

      by ctrl-alt-canc (977108)
      Knoppix is used here as well, and it can help you to save your data in many situations. One suggestion: not every network card is supported by the standard knoppix distributions, so either you burn a custom knoppix CD tailored for your system, or you keep a disk at hand with the appropriate drivers.
    • by EkriirkE (1075937)
      Vote here, too. A few times something got corrupt in the NTFS filesystem on seperate machines. Windows would start to boot, but once the ntfs driver loaded... BSOD! Even WindowsPE discs, same result. If I booted PE fully and attached the drive via USB adaptor ... BSOD!

      Knoppix (or any linux I'd imagine) was able to read the drive & files with no problem.
  • R-Studio (Score:5, Informative)

    by CodyRazor (1108681) on Tuesday June 02, 2009 @10:28AM (#28181927) Homepage

    Back when most data recovery and disk utility applications didnt work on vista (and many still dont) I found one called r-studio. It managed to recover a whole lot of data of a damaged flaky 5TB Raid 5 array, which is pretty impressive considering it was the only application at the time that could even recognize it as a drive, all the others just call it a damaged volume.

    As far as I know its still the only one that can do Raids, at least as far as I can find. It also allows many customization options of searches and donest over simplify things too much. It takes forever but it finds any potential damaged file systems and then lets you use whichever one you like to recover whichever files you like. It can also be used to recover deleted files.

    As far as I recall its pretty cheap, at least compared to a few out there and worth a try. But with all recovery and security software, I find the information and their website extremely generalized and vague about what exactly you can do, so I always download the software first to make sure it can do what I want, which 90% of the time it cant, and then if it works I buy it. Its not the most legal practice but if they dont offer demos and wont be specific about what their software does its the only practical solution.

  • by Push Latency (930039) on Tuesday June 02, 2009 @10:29AM (#28181939)
    For your health!
  • My .02 (Score:2, Interesting)

    by NES HQ (1558029)
    Not to be a smartass, but...

    For the folks (family and friends) that seem to think I'm a free computer repair store I told them to go buy a cheap USB hard drive and just set up a quick and dirty batch file to back things up nightly (or weekly, depending on how big their files are).

    I've told them to do this or there's a good chance that I won't be able to recover their files if their PC crashes. This is an easy solution, cheap, and requires virtually no end-user interaction. That last bit is especially impo

    • by bonehead (6382)

      Not to be a smartass, but...

      For the folks (family and friends) that seem to think I'm a free computer repair store

      I have way too many people like that in my life.

      I imagine they all think my talents have been dwindling over the years. These days, more often than not, I just tell them that I wouldn't have the slightest clue what to do about their problem (even if it's an easy one).

      When I was young and single, it didn't bother me so much. But now I have a wife and kids that I like to spend my free time with, so I've decided to discourage the behavior by simply being entirely useless anytime anyone calls with a computer

  • by L4t3r4lu5 (1216702) on Tuesday June 02, 2009 @10:30AM (#28181983)
    Work your way through this [cnet.com] list. Unless you're a corporate entity with a large purse, it's probably going to be a freeware app they use too (unless they have a suite which covers many types of media and file systems). They make money from companies, not end users.

    Further Info: I phoned a Tamworth, UK-based company (Google it if you're bothered) regarding recovering a file from a USB drive for a teacher where I tech. They asked what I did so far to recover the file, I said I'd run some freeware recovery tool. They told me that's all they'd do, as they don't make money spending any more than about 5 minutes on it. If that can't find it, and you don't have hundreds / thousands of pounds to spend on engineer time, it's the best you'll get.
    • Re: (Score:3, Informative)

      by L4t3r4lu5 (1216702)
      Hate to reply to my own comment, but some pointers;
      • Clone disks before you work on them.
      • Never work on the original disk
      • Never boot the original disk. Swapping can overwrite data which has been deleted permenantly.
      • "Deep" scans are a nightmare. Often the names are not restored, you get block-by-block groups of sectors instead of contiguous files, and converting them to any useable data structure is why these recovery firms can charge through the nose.
  • Pros make sure they have good backups. Pros tell their users "nothing on your laptop/desktop is backed up", make that corporate policy, and respond to virus infestations by re-imaging the victim's computers to make sure that everyone's too damn scared of Mordac the Preventer to keep anything on local storage.

    • by jumpingfred (244629) on Tuesday June 02, 2009 @10:48AM (#28182281)

      No the pro install nightly backup tools on the laptops. At least they do on mine.The backup software then uses heuristic algorithms to start the backups when the laptop is being used for meeting presentations in front of many people.

    • That works just fine until a computer illiterate employee didn't back up their files, spent weeks making a file, the HD gives the click of death and your boss says how he read about recovering data from a broken HD and if you can't do it he can "find someone else".
      • Re: (Score:3, Insightful)

        by argent (18001)

        That works just fine until a computer illiterate employee didn't back up their files, spent weeks making a file, the HD gives the click of death and your boss says how he read about recovering data from a broken HD and if you can't do it he can "find someone else".

        Been there, done that, got quotes from vendors, got approval from the CFO, hand-carried the disk over to the top data recovery house in Houston, and they failed to get the files back,

        Professionals don't fight battles they can only lose, and always

    • Re: (Score:3, Funny)

      by TheLink (130905)
      I think you're confusing BoFH with Pros.
    • And middle-management tells pros "we don't have budget for backup systems!"

      • by argent (18001)

        And middle-management tells pros "we don't have budget for backup systems!"

        Pros implement backup systems anyway.

    • by eth1 (94901)

      Yup... In this case, an ounce of prevention is worth several tons of cure. I was in this situation, and ended up using AD group policy to redirect everyone's My Docs to a server directory that I could back up. Then just make sure everyone knows that *everything* important has to go in there. Fortunately, most stuff defaults to saving there.

      It only took one round of "oh no, I accidentally deleted X, and spent HOURS on it!!" "Was it in your My Documents?" "No" "Sorry, can't help." for everyone to get the hint

      • Yup... In this case, an ounce of prevention is worth several tons of cure. I was in this situation, and ended up using AD group policy to redirect everyone's My Docs to a server directory that I could back up. Then just make sure everyone knows that *everything* important has to go in there. Fortunately, most stuff defaults to saving there.

        This is probably the most important policy you can implement in a business environment. Not only does it make fixing a broken PC trivial, it makes moving people from one

  • dd (Score:5, Informative)

    by locofungus (179280) on Tuesday June 02, 2009 @10:32AM (#28182015)

    dd if=/dev/sdb of=dump.img bs=512 conv=noerror,sync iflag=direct

    Once a drive has started failing the first thing you want to do is get as good a copy of everything as you can manage. If it's a physical problem, especially if it's a damaged platter, then it tends to get worse as the drive is used. Get everything off and then work on the copy.

    Tim.

    • Re: (Score:3, Interesting)

      by greed (112493)

      On the other hand, if it's a thermal problem, you may have to rescue in "chunks". I had a disk go that could only be used for about 10 minutes before it got too warm and shut down.

      On the third hand, you may have something that looks like physical damage, but when you wipe the disk with zeros to confirm the fault and get ready for RMA-time, it all magically comes back. That's a sign you got corrupted data on the disk that the ECC couldn't deal with. (And probably that you've got a drive with questionable

      • Good points. I've never tried to recover a drive that fails for thermal reasons. Infact I've never seen a drive fail like this (not saying it doesn't happen)

        I've recovered drives that have had an obvious head crash (computer was dropped down the stairs and certain chunks of the disk became unreadable and spread) and those with just corrupted data where the drive itself was rescued once the corrected sectors were dd back.

        And I've recovered drives where getting the disk to start was the problem. One instance

  • by millisa (151093) on Tuesday June 02, 2009 @10:32AM (#28182017)
    My favorite tools are a combination of the Trinity Rescue Kit linux boot cd and the Restorer [restorer-ultimate.com] tool.

    It depends on the type of failure, but generally, I start with a ddrescue [gnu.org] to get an image of the drive, especially if the drive is running bad sectors. Either I set the image to go to a secondary spare drive or I push it across the network. ddrescue is nice in that it doesn't bail when it hits those bad sectors, can run in reverse mode, and eventually it'll get as much as isn't corrupt on the drive into the image.

    After establishing the image, the original failed drives go into ESD bags and aren't touched again unless they are to get shipped to one of the expensive clean room type places for their style recovery.

    Most of the win32 drive recovery softwares out there can handle reading from an image file, so from here on out, I work with the images I took with ddrescue. Restorer has worked pretty well for me on getting things back from hard drives, CF cards, and even raid sets (figuring out the cluster sizes on the raid can be a pain if you don't happen to know them, but the software does support reassembling raid drives from the images you take of the single drives).

    Most of the win32 packages out there have support for making the original images, but I haven't had as much luck with most of them when dealing with severely corrupted drives or with a large scattering of bad sectors. Either they take far too long to make it through the image or they end up failing to get by the bad sectors.

    Regardless of what you end up picking, you don't want to use any of the recovery tools that advertise how they can fix the partition table and such on the drive, live . . . any recovery operation that thinks it is ok to 'fix' a drive with data on it you want to recover has the wrong mindset. The data is important, not making the drive work again.
  • EASEUS Disk Copy (Score:2, Informative)

    by dinkdinkdink (920721)
    I have had success with the *free* EASEUS Disk Copy boot CD - http://www.easeus.com/download.htm [easeus.com] [easeus.com]. It will perform a bit for bit copy from the defective drive to a new organ-doner drive. I believe you have the option to continue the copy, even on erroneous sectors. On a recent drive in the early stages of failing, I was able to recover the entire disk after I did the bit-for-bit copy and then performed a error check/fix on boot-up. The standard Windows XP error check tool corrected all of the pr
  • that keep the expensive guys in business

    if all data loss were just a matter of awesome software, then wonderful. but frequently you are dealing with mechanical failures like the write head crashing onto the platters, death of the controller, failing motor, etc.

    no software is going to fix these things. then its to the $100/hr guys in the clean room

    • then its to the $100/hr guys in the clean room

      You wish the clean room guys charged $100/hr. Most of them charge a grand or more just to evaluate the disk.

  • by stenchcow (1554779) on Tuesday June 02, 2009 @10:39AM (#28182129)
    Spinrite [grc.com] has worked miracles in the past for me. It's brought back unbootable corrupted windows partitions back to life for me. Supposedly it also fixes physical defects in hard drives as well. It boots off of a image from disc. It costs $89.00 but it's saved my butt in the past.
    • by NetRanger (5584) on Tuesday June 02, 2009 @11:31AM (#28183041) Homepage

      Same here. At $89, SpinRite is a bit on the pricey side, but I have recovered data from hard drives that I thought I had zero chance of saving. I figure since it saved hundreds of dollars in labor -- several times -- it was worth every penny. Especially in those circumstances where your highly paid datacenter techs thought it was a great idea to construct a RAID 5 from all identical hard drives from the exact same manufacturer lot. Sucks when two of those drives experience the exact same fault within a few minutes of each other. Fortunately I was able to whip out SpinRite and save the day, because otherwise we were looking at days and days of restoring from incremental backup tapes.

      It's an ancient-looking DOS command-line utility, but I definitely give props to Steve Gibson for keeping SpinRite up to date to where it works on modern hard drives. $89 versus days and days of overtime pay for IT guys -- it certainly made me look pretty good come performance review time.

  • I used to use Norton Tools, until it was bastardized by Symantec. I have had good luck in the last couple of years with RStudio (http://www.r-tt.com/). I used it to recover the pictures from a wiped SD card. I wish I hadn't once I saw the photos, but that isn't the software's fault. Looks like there is a free version for use on ext2/ext3 filesystems.
  • Black jump suit, glass cutter, crowbar, can of black spray paint, butterfly knife, pack of smokes, maybe a giant burlap sack with a green $$$ printed on the side because if it said 'data' it might look suspicious...
  • One time I used Me (Score:3, Informative)

    by TinBromide (921574) on Tuesday June 02, 2009 @10:50AM (#28182335)
    I had a drive where the file system was shredded, so I loaded the drive into FTK Imager (its free, about halway down the page) [accessdata.com], did a search of the raw space of the drive for the file name I needed, found the relevant $i30 reference (its in there), [scribd.com] jumped to the relevant sectors on the disk using ftk imager's goto command , carved out the hex with ftk imager's copy hex command, dumped it into a hex editor, and saved the file under the extension. It worked perfectly.

    Uphill, both ways, in the snow.

    This is the ultimate last resort if you absolutely, have to, get a file back.
  • SpinRite (Score:3, Interesting)

    by powerbooklinux (630199) on Tuesday June 02, 2009 @10:54AM (#28182391)
    Does the job when all hope is lost. I've used it many times for myself and clients. $89.00 and worth every penny. http://spinrite.info/ [spinrite.info]
  • The chain of tools I used barely a month ago goes like this.

    1. dd to get whatever can be had off the hardware and into a disk image.
    2. testdisk recovers partition information to make the images mount-able.
    3. foremost to recover files. Pay attention to the conf file. There are *lots* of options that will discover all kinds of files in various condition.

    As someone who just went through this with my laptop, the last two things to remember:
    -You will need tons of disk space to work with the disk images and all

  • Depends (Score:3, Informative)

    by Sycraft-fu (314770) on Tuesday June 02, 2009 @11:03AM (#28182563)

    We usually start off with a bootable XP CD. Often there isn't anything really that messed up, and you can read the data that way with no problems. There are a couple of free programs, the names of which I can't remember off the top of my head, that do a fine job for "undeleting" files.

    If it won't read in that, the next step is usually Knoppix. You can tell it to force mount a bad partition. Now that is a mixed blessing since sometimes the data you'll get is garbled which is why you try something else first. However, barring any serious problems, it'll usually mount and read.

    If both of those have problems, the next set it the tools from the drive manufacturer to check for physical problems. You set those to do a full scan. At this point, there are three possible results:

    1) It runs to completion, no errors. Means the physical disk is fine, it is all a logical data problem. Now go back to bootable Windows and run a checkdisk. Reason we didn't do this earlier is the moving of data checkdisk does can screw things up worse if there are physical problems.

    2) It runs to completion, errors found and corrected. Back to Windows or if that doesn't work Knoppix to try and read the disk again. Usually it'll read, checkdisk it if not.

    3) It errors out and gives a a diagnostic code meaning serious, unrecoverable errors. We are now at another juncture:

    a) The data is really important. At this point, time to send it off to a specialist. Gillware.com is who I like. Pack it up and mail it off, you probably get your data back along with a bill for $300.

    b) The data isn't critical, but we'd like to recover it. Run what I call "the magic disk destroyer." It's a program called Spinrite. It is a VERY aggressive recovery program. Because of that it is either going to get the disk readable, or fuck it up so bad nobody will be able to. Hence my nick name for it. Put the disk somewhere that you can have a fan blow on it, fire up Spinrite, and let it go for a day or two. See what happens.

  • I agree with others about GetDataBack... it indeed is a good app.

    Sometimes however, people have come to me with a hard drive with a FOUND.000 directory full (sometimes about 10GB) of CHK files... for that I recommend:

    http://www.ericphelps.com/uncheck/ [ericphelps.com]

    It is free and does a good job recognizing the supported files

    Also, it is worth getting something like mplayer or VLC and try to manually open the biggest CHK files to see if they are some kind of media file.

    Additionally, a Hex editor like xvi32 can be helpful

  • I have used file scavenger (windows) with great success. File scavenger has restored files from disks that were unreadable or disks that come up as un-formatted. Even if you accidentally reformat the disk and write some data to it file scavenger will find what ever has not yet been corrupted and copy it to where ever you want it to go. Files that cant be recovered are still written to the backup disk but are given a zero byte size. You can then search for zero byte files and see what was unable to be recove

  • Pros before Hos... (Score:5, Insightful)

    by DarthVain (724186) on Tuesday June 02, 2009 @11:17AM (#28182821)

    If your a Pro you back up all your important data anyway, so it is a moot point. Likely you even have some remote back up. There are services out there. Use Google, it ain't hard. In a pinch you can just email yourself some attachments in Gmail. Not good for media files or anything large, but if you want to save some key documents or your tax returns etc... Privacy may be an issue, but if your really prickly about that, then just encrypt it (though make sure you can decrypt easily later).

    If it is a friend or family member who has just lost everything: Look very superior, point at them, remind them they should have backed up, and how stupid it is not to do so, then laugh at them for a while. Once your eyes clear of tears, repeat. After 4 or 5 times maybe it might sink in, and you will have done them a great service. Send them a bill in the mail.

    Harsh I know, but come on, this has been cannon for years, get with the program.

    Honestly though most people's computers are totally full of crap. There are some things like Personal files, Photos, and the like that are irreplaceable, but most stuff is just media you can replace, or software you can replace, etc... and if it is important to you, then back it up for god sakes.

    Seriously, if you save their data you are just re-enforcing and rewarding bad behavior.

    • by DarthVain (724186)

      also grammar nazi's stay back! I see my mistakes and I like them damnit!

    • Re: (Score:3, Informative)

      by TheSpoom (715771) *

      Wow, you're an asshole.

      Maybe you should just do what you can for your family and then remind them that they should backup with their new drive. You know, as opposed to reinforcing the stereotype that all computer geeks are antisocial bastards that don't care about a person's feelings at all.

  • by Piffer76 (1042180)
    In the past I've used SpinRite to check the disk for errors, and it's been a life saver twice. But in the case where there's nothing wrong with the physical drive, which is probably the case most of the time, I've had great success with R-Studio. My 2 cents. -P
  • Ontrack EasyRecovery is the best software I've used. It WILL NOT WORK under Vista, so hopefully you'll have 2k or xp installed somewhere.

    The software, last time I checked, is no longer suported or updated. Ontrack now seems to specialize in data recovery, not data recovery software. I'm sure however you can find the software.... somewhere....
  • Last week I crashed drive with a virtualbox image on it. The nature of the crash was a ground loop spike while programming a microcontroller board. This spike blew a big capacitor on the board, fried tracks, wiped out 1 of 2 usb controllers on my laptop and zapped my second hard drive. By murphy's law I had just cleared off the one hard drive that was the recent backup for this vdi file and now I'm left with a two year old backup (after looking through about 50 dvds and 6 old hard drives). I bought an e
  • by TunaPhish (81577) on Tuesday June 02, 2009 @11:58AM (#28183507) Homepage

    As far as software goes, a combination of dd / ddrescue / strings / fdisk / grep / mount / and the r-studio suite from r-tt.com are what I use. Though, most of the time the drive is physically damaged, and it's not always inside.

    For example, last week I had a laptop come in with no power to the drive. I examined the board with my eyes and my Fluke Multimeter and discovered that the power +5V on pins 41 and 42 wasn't reaching very far into the board and was basically disconnected at the first component. It looked to be a power-protection diode which had blown due to a surge. I was able to bypass it with a dot of solder, and once reassembled the hard drive powered on, I copied the data off. When the customer decided he didn't want to pay, well, I removed that solder dot before returning his drive to him without his data...

    On 3.5" hard drives you'll often see a rectifier diode serving the same purpose, so when you run into a drive that doesn't spin up, check that out first. It's a small black component connecting the power to ground, and it shouldn't be passing electricity (but it will when it fails, so just pop it off to get your drive working again).

    Other times a clicking drive can be fixed by just swapping out the board with an identical one from another drive. Sometimes, similar model number boards will work as well, but not often. It's a lot of fun trial and error. On the plus side, if the drive is totally fubar'd but still spins up, you can pop it open and do some hard drive spin art!

  • A mix of tools... (Score:3, Informative)

    by tlhIngan (30335) <slashdot@wor f . n et> on Tuesday June 02, 2009 @11:59AM (#28183539)

    If the disk is good, but the OS hosed, try a Vista install DVD. Boot it into recovery mode, and one of the options is "copy files". (Honestly, the recovery tools included with Vista are a good first step). It'll copy the files to a USB hard disk.

    If not, then it's time to boot Knoppix (which can mount NTFS just fine, thanks to ntfs-3g). If the disk is dying, but still good, use something like ddrescue to make an image (ddrescue uses dd to clone the disk, but it'll first do the good parts (fast), then try harder and harder on the parts the disk has problems with - this way you'll get the good parts of the disk off quickly and it can concentrate on the bad parts).

    If you lost your partitions, gpart wourks great at seeking and finding 'em. One of my coworkers had just that problem and gpart managed to recover the partition table...

  • Testdisk to recover partition & mbr data.
    Windows PE live disc to try to read disc/chkdsk, and/or use HandyRecovery v1 (fw) for undelete/quick format recovery
    Knoppix to read corrupt NTFS
    SpinRite to try and recover/reset bad sectors
  • by kimvette (919543) on Tuesday June 02, 2009 @12:39PM (#28184041) Homepage Journal

    if the tools you can get for Linux don't work, check out R-Studio [r-tt.com].

    If you come across a product called "Stellar Phoenix" RUN AWAY. They are the shittiest company in existence. A few years ago I needed a tool and the demo of Stellar Phoenix seemed it would work (it lists the files it said it could recover) so we purchased it only to find that it could not recover them. Come to find out that while they claim support for ALL of NTFS's features, their software WOULD NOT recover files compressed using NTFS compression. This was despite their claims of NTFS5.1 support. They refused to issue a refund and it was a months-long battle so we finally complained to Amex to try to get a chargeback against them but we tried to work it out directly with stellarinfo for too long, so it was too late. They (stellarinfo) claim a 30-day money-back guarantee but DO NOT HONOR IT - or at least they didn't back then.

    We then tried R-Studio, and their trial software listed files it could recover - AND it could recover 64KB chunks to prove it. So for some files I needed immediately I used the trial to decompress and reassemble the files (in 64KB chunks, and then catted them together), and for the rest when we received the key for the full version. We were able to recover every single file. I've used R-studio for clients since then and it has worked every single time, providing the drive will enumerate.

    If the drive will not enumerate you have two possibilities: freezing it in CO2 (I have had success with that), or finding another of the same model drive with the same firmware and swap PCBs, and hope that the problem is with the controller and not the drive itself.

    Why was there no backup? Believe me I asked the same question. :)

    Summary:

    free Linux tools - good
    R-Studio - Awesome
    stellar phoenix from stellar info - snake oil from a shitty company comprised of douchebags

  • by DomNF15 (1529309) on Tuesday June 02, 2009 @12:55PM (#28184289)
    We recently had an NTFS drive on one of our Dell servers go partially bad. Windows wouldn't boot or read it. I had limited success using various Linux Live distros along with tools like PhotoRec (http://www.cgsecurity.org/wiki/PhotoRec) since the drive was part of a Windows logical raid array. Don't be fooled by the website, the tool works for all kinds of files, not just photos, on various file system types. In the end, someone I work with suggested putting the drive in a ziplock bag and freezing it for a few hours. The rest of us were skeptical, but were also at our wit's end trying to recover the files from this drive, so we tried it. Amazingly, we were able to boot the drive normally and recover the needed files before it got back up to normal operating temperature and failed again.
  • by Aryeh Goretsky (129230) on Tuesday June 02, 2009 @02:50PM (#28185915) Homepage
    Hello,

    Here is a list of data recovery programs I have put together. Some of them may be a little old, for floppies or optical media only, but should still be useful. Unless otherwise noted, they are all for Microsoft Windows.

    A-FF Labs [hdd-tools.com] - NTFS Undelete [ntfsundelete.com] and Partition Find and Mount [findandmount.com]
    Access Data [accessdata.com] - FTK Imager [accessdata.com]
    Acronis [acronis.com] - RecoveryExpert [acronis.com]
    Advanced NTFS Recovery [ntfsrecovery.com] - NTFS Recovery [ntfsrecovery.com] (may handle FAT32 as well)
    bitMART [bitmart.net] - Restorer Ultimate [restorer-ultimate.com]
    Brant, Dmitry [dmitrybrant.com] - DiskDigger [dmitrybrant.com]
    BriggSoft [briggsoft.com] - Directory Snoop [briggsoft.com]
    CGSecurity [cgsecurity.org] - TeskDisk [cgsecurity.org] and PhotoRec [cgsecurity.org]
    Convar [convar.com] - PC Inspector File Recovery [pcinspector.de]
    Digital Assembly [digital-assembly.com] - Adroit Photo Recovery [digital-assembly.com] (pictures only)
    DiskInternals [diskinternals.com] - NTFS Recovery [diskinternals.com]
    DIY Data Recovery [diydatarecovery.nl] - iRecover [diydatarecovery.nl]
    DTI Data [dtidata.com] - Recover It All [dtidata.com]
    DataRescue.Com [datarescue.com] - PhotoRescue [datarescue.com] (intended for flash RAM cards, which are typically formatted with FAT, may work with other devices as well)
    EASEUS [easeus.com] - Data Recovery & Security Suite [easeus.com]
    Fsys Software [dfsee.com] - DFSee [dfsee.com]
    Gibson Research Corp. [grc.com] - Spinrite [spinrite.com]
    Gillware [gillware.com] - GillWare File Viewer [gillware.com]
    Higher Ground Software [highergroundsoftware.com] - Hard Drive Mechanic Gold [highergroundsoftware.com]
    Kato, Brian [aumha.org] - Restoration [aumha.org] (also here [cnet.com])
    LC Technology [lc-tech.com] - [lc-tech.com]
    [Continued in next message, as for some reason, Slashdot would not let me post in its entirety (too many URLs?). AG]
  • by kriegsman (55737) on Tuesday June 02, 2009 @03:04PM (#28186109) Homepage
    For an Mac OS X volume (HFS, HFS+), I've had lots of luck with Data Rescue II [prosofteng.com] ($99) for recovering from serious drive failures. For drives that are still operational but have become borked at the filesystem level, Disk Warrior [alsoft.com] does a great job of rebuilding a healthy new directory structure. I make it a point to always have a copy of Disk Warrior within 100 yards of my PowerBook.

    Also, a couple of times I've had dying drives that work OK for a few minutes after a cold boot, and then they (heat up and) die. I've had good luck throwing the drive in the freezer (in a ziplock bag) for a day, then powering up it, recovering as much as I can until the drive chokes again, lather, rinse, repeat, until all recoverable data has been copies off to a good drive.

Lend money to a bad debtor and he will hate you.

Working...