What Data Recovery Tools Do the Pros Use? 399
Life2Death writes "I've been working with computers for a long time, and every once and a while someone close to me has a drive go belly up on them. I know there are big, expensive recovery houses that specialize in mission-critical data recovery, like if your house blew up and you have millions of files you need or something, but for the local IT group, what do you guys use? Given that most people are on NTFS (Windows XP) by the numbers, what would you use? I found a ton of tools when I googled, and everyone and their brother suggests something else, so I want to know what software 'just works' on most recoveries of bad, but partially working hard drives. Free software always has a warm spot in my heart."
for fat and ntfs (Score:5, Informative)
Re:for fat and ntfs (Score:5, Informative)
It has saved my data many times.
Re:for fat and ntfs (Score:5, Informative)
My first attempt to recover his data was with ntfsundelete, [ntfsundelete.com] however it did not recognize the partition at all. I next used Disk Internals NTFS Recovery [diskinternals.com] program (Commercial) with the same results.
Finally, I Googled a bit and found the testdisk/photorec [cgsecurity.org] package and used that. It took about 40 hours to recover ~225GB data. It was unable to recover filenames, however it did create new directories for each directory it found and recreated the files in those directories, albeit with arbitrary names. Most impressively it did recreate the files with the proper file name extensions. With some creative perl scripting I could have even renamed some of these files based on meta data in the files. This was not necessary in my case.
Re:for fat and ntfs (Score:4, Insightful)
No question with TestDisk [cgsecurity.org] as an excellent open source/free recovery option.
It was the only thing I found (freeware or pay) that relatively easily restored a couple of NTFS logical partitions--and all data--after they were destroyed by an older version (8.0) of Diskeeper's "boot optimization" defragging. The last time I used Diskeeper or recommended it. I continue to use and recommend TestDisk. The author of TestDisk was also responsive to emails when I encountered a unique issue with the drives I ended up needing help with.
Note that TestDisk is only for recovering lost partitions and making non-bootable partitions bootable again. For those functions, there is no better program out there.
Its sister program included in its download--PhotoRec [cgsecurity.org]--can do file recovery. Its designed mainly for recovery of photos off all media, but it supports many different file formats. So the TestDisk/PhotoRec package may be all you need.
Other freeware/non-open source file recovery alternatives that are reliable and work well:
--PC INSPECTOR File Recovery [pcinspector.de]. 100% free & full featured, many options. Been using it for years.
--Recuva [recuva.com]. 100% free, by Piriform [piriform.com], the maker of the very popular CCleaner/Crap Cleaner system cleaner.
Somewhat less elegant than the above one. But the only freeware option I've studied that can do a "deep scan" of your drives for lost files. Which can take hours, but may turn up more missing data than the other non-PhotoRec options here.
--EASEUS Deleted File Recovery [easeus-del...covery.com]. A more limited version of their $70 "EASEUS Data Recovery Wizard", but very well designed for basic file recovery.
There are other freeware file recovery options I've studied, but they are all more limited than the above. Would recommend TestDisk (for partitions) and PhotoRec (for files) first, then the other three (for files) in the order given.
In all honesty, shelling out for a payware solution is very unlikely to "find" more deleted files on a NTFS partition than the above freeware solutions, unless you have special needs they don't cover. Which is rare. And again, there is nothing better than TestDisk--free or payware--for recovering partitions.
Re:For a free solution, check (Score:4, Insightful)
Re: (Score:3, Informative)
You would never get a technician to sign it.
I certainly would not, even though I do not reformat hard drives while there are any other alternatives. (I don't think I ever have, apart from when the customer walks in and says "reformat this for me.")
Hard disk drives dying on the operating table, or power supplies failing and zapping the drive controllers, are just too common for me to take liability for the data.
Re:Make the repair shops pay for loss of data (Score:4, Informative)
Re: (Score:3, Informative)
*idiots*, the only way to be sure is to remove the drive, but I guess it was part of the warranty deal.
Good filesystem to recover from, I have successfully recovered data from a drive formatted over ReiserFS. For all his quirks, it's a great filesystem. What did they format over it, NTFS I'm guessing?
Re: (Score:2)
Re: (Score:2)
I tried to do the same thing on an Ubuntu drive that had bad sectors, but the security on the files prevented them from being accessed.
Security like... file permissions? Did you try backing up the files as root?
Re: (Score:3, Informative)
By necessity, I discovered and used this software just last night, and the data recovery process was smoother than I had anticipated. At one point when I was copying the salvaged files to a good drive, Windows took exception with one of the files and started barking one of its usual program-terminating error messages. I was afraid that I'd have to have GetDataBack reread the whole drive and start the whole process all over again, but the program was robust enough to avoid crashing. It just moved on to th
Re:for fat and ntfs (Score:4, Interesting)
While there are all sorts of voodoo, data scraping bit-remunging apps available, at the point before you do anything you have no liability. After you "recover" the data, you're on the hook for everything forever.
All you need is for the customer to come back 2 years later and tell you they were sued into the dirt because something they were required to disclose was missing or incorrect and you'll wish you never took the job.
And even if they don't sue, there will be a never-ending stream of phone calls about broken documents, files they can't find and all sorts of other "un-tidyness".
And even if they don't call, there will be eternal uncertainty about the quality of the recovered data. Are their financials correct? What was that number that had the letters nearby really supposed to be?
My favorite drive recovery method is now BackupPC. You set it up, configure it for an appropriate number of incremental backups each day and let it fly. When a drive craps out, replace it, click the appropriate checkbox on the "Restore" page and press the "go" button. No doubt, no lawsuits, no untidyness.
Do-it-yourself Data Recovery is great if you like to putter with things and have lots of time and no liability (employees generally can't be sued by their employer) however when actual money is at stake, it's better to just send the drive out and let someone who is actually equipped and staffed to do the recovery handle the work.
To put things in a different perspective, how happy would you be if the county tried to sell your house for unpaid taxes because billy-bob "who's really good with computers" did their drive recovery and your tax payments were on one of the bad spots?
Re:for fat and ntfs (Score:4, Insightful)
Tell them that you don't have a full copy of all their data. Tell them to tell their lawyers that a hard drive failing is equivalent to a small fire occurring in the secretary's desk and while you, the fireman or handy guy with the fire extinguisher can recover a lot of data, there's no way to be certain that it's all the data.
People like you are a lot of what's wrong with the world. You cover your ass so much that you don't accomplish what your clients really want or need.
Re:for fat and ntfs (Score:4, Insightful)
Do you know what's worse than "No Data"?
Bad Data.
What my clients really need is data they can trust.
Telling someone "Here's your data, I got some of it back for you, but I'm not sure how much you lost or if the stuff I got back for you is correct" is great for your mother's vacation pictures. It's not great for your bank, insurance company, doctor, school or anybody else that needs to have verifiable, correct data.
Ordinary Kitchen Stuff (Score:5, Funny)
Lemon juice and heat!
I tell the tools (Score:5, Insightful)
Re:I tell the tools (Score:4, Insightful)
Re: (Score:3, Insightful)
GetDataBack (Score:5, Informative)
Re: (Score:2)
Any free clones?
Re: (Score:2)
Another "me too" here.
Lost a partition to corruption (had extended partition to > 136G without updating W2K service pack to handle it; worked fine for months until I started to fill up the disk). My data was mincemeat, but GetDataBack helped me get what I could.
Customer service is excellent. The developer is very responsive in the forums.
Recuva + good controller (Score:3, Informative)
Recuva (http://www.recuva.com/) is free and works pretty well. It has a handy preview feature too, although it doesn't always work.
To be honest, there isn't really much beyond what Recuva can do. Some paid-for tools support scanning for a few more file types in situations where the filesystem is gone and you have to scan the whole disk, but unless you happen to have files in some unusual format then there is no real advantage.
The one thing which does make a big difference is the drive controller. Some chips
Well (Score:5, Informative)
ddrescue
But to be honest, if you've hit that point for an "enthusiast" user, then you're already on your last legs. If you ain't got a backup, forget it - the chances of getting one particular file you've lost might be good, the chances of recovering any significant amounts and being able to verify their integrity are bad.
Plus, with SSD's, flash, memory cards, etc. the chances of being able to recover *anything* from a faulty drive without professional equipment are fast approaching zero. Most USB Flash drives just "die" when they hit their write limits, rather than fail gracefully into read-only mode.
Re:Well (Score:5, Informative)
Here's one that's saved my butt several times.
Often times when a drive fails it's not the physical mechanism that goes bad, it's something on the circuit board. If you can find an identical drive (should be pretty easy in a corporate environment, could be tricky for a home user), just carefully remove the board from the good drive and install it on the bad one. You'd be surprised how many times that "totally dead" hard drive will start working like new.
The software solutions are great for some situations, but they can't do anything if the drive isn't even visible to them.
Yep, I agree (Score:2, Insightful)
I agree with you 100%. I've done this many times, myself.
I concur as well, and have done this too (Score:2)
I really should have charged that client a LOT more, but it saved them a ton of $, and it was like $40 on e-bay!
Re: (Score:3, Interesting)
When did this start? I had to do this at home not to long ago to save some data from a relatively recent 500GB drive. That worked out fine.
I'm not doubting you, just curious.
Re: (Score:2)
Repair a clone of a clone (Score:5, Insightful)
If you are working on a 2nd generation clone you can afford to take risks in restoring the filesystem. "Oh it that didn't work, fire up another clone and try something else".
ddrescue (and other damaged disk oriented cloners) lets you work on a copy (or in my preference: a copy of a copy). This preserves the original disk if it has to go to a specialist lab later.
SpinRite has also saved my bacon more than once but that's something run on the original drive: not done lightly.
(Warning: dd_rescue is not Gnu ddrescue and Debian Linuxes rename dd_rescue to ddrescue. dd_rescue is a similar but not identical).
Finally: I need to add Windows NTFS rescue (built in) impressed me last time I needed it. It trundled for many hours but at the end, I had a mostly intact copy of a filesystem on my 2nd generation cloned drive. The original disk had been a mess.
Re: (Score:3, Informative)
For me, SpinRite has successfully corrected fubared Windows installations (STOP error at boot, unreadable boot volume, registry
None! (Score:2, Informative)
Real professionals never lose their data.
Re: (Score:3, Insightful)
Real professionals backup their data.
Re: (Score:2, Insightful)
I'm kinda hoping your trying to be amusing here, if you are though its gone under my humour radar today (and I apologise if I seem like an arse)
Yes most "professionals" will have backups of their data (which is what I presume you are alluding to) however it's not always the case that those backups will be literally up to the minute, and sometimes its just less hassle to recover any lost "recent" data then it is to just cycle to the last backup and deal with the shortfall. Also its not exactly uncommon for "
Re: (Score:2)
Backups by definition can't be real time - Mirrors can.. but you wouldn't need to recover data if you have a Mirror.
Out side of experienceing unknown failure of a backup you shouldn't be trying to recover anything.
When ever you design your backup strategy you have to define the amount of data that is willing to be lost - then design around that and your budget.
and i don't care what anyone says.. zero loss is never truly achievable.
I Like Knoppix with a Good BIOS (Score:5, Interesting)
I use a live CD of Knoppix which has really good system repair and troubleshooting [wikipedia.org]. I also have another important tool which is an old Dell Intel motherboard that allows me to set the rotational speed of the drive. Example: my friend's laptop is giving him the click of death so I pop out the IDE drive and hook it up to a 2.5" to 3.5" connector and plug it into the motherboard with a working 1TB 3.5" slaved. On boot up, I hit the BIOS and set the speed as low as it can go or low enough like 1,000 RPM. Then I boot into Knoppix live CD and check to see if I can mount the file system. Knoppix seems to be able to mount a lot of partitions that other more stringent flavors of Linux don't. Sometimes it clicks from the get go and there's nothing you can do. But if it doesn't, then I set a script up to copy their most valuable directories first onto the working 1TB drive. I let it run all night or weekend and check the drive periodically for heat problems. People are surprised what you can save for them doing this
dd (Score:2)
once you have linux up and running the first thing I do is try dd with the "ignore error" setting. this way I cant get a copy of the bad disk onto a good disk. Now I've separated the recovery from corruption from the problems due to intermittency.
Re: (Score:3, Interesting)
ddresuce (or dd_rescue) is a better choice here, because instead it will write zeros in place of read errors, so that successfully read block later on are in the right place. You can also set it to retry error block multiple times, and record progress to a log file so you can resume the retries at a later time.
Re: (Score:2, Informative)
Re: (Score:2)
Knoppix (or any linux I'd imagine) was able to read the drive & files with no problem.
R-Studio (Score:5, Informative)
Back when most data recovery and disk utility applications didnt work on vista (and many still dont) I found one called r-studio. It managed to recover a whole lot of data of a damaged flaky 5TB Raid 5 array, which is pretty impressive considering it was the only application at the time that could even recognize it as a drive, all the others just call it a damaged volume.
As far as I know its still the only one that can do Raids, at least as far as I can find. It also allows many customization options of searches and donest over simplify things too much. It takes forever but it finds any potential damaged file systems and then lets you use whichever one you like to recover whichever files you like. It can also be used to recover deleted files.
As far as I recall its pretty cheap, at least compared to a few out there and worth a try. But with all recovery and security software, I find the information and their website extremely generalized and vague about what exactly you can do, so I always download the software first to make sure it can do what I want, which 90% of the time it cant, and then if it works I buy it. Its not the most legal practice but if they dont offer demos and wont be specific about what their software does its the only practical solution.
Knoppix with a Drive Adaptor (Score:3, Interesting)
My .02 (Score:2, Interesting)
For the folks (family and friends) that seem to think I'm a free computer repair store I told them to go buy a cheap USB hard drive and just set up a quick and dirty batch file to back things up nightly (or weekly, depending on how big their files are).
I've told them to do this or there's a good chance that I won't be able to recover their files if their PC crashes. This is an easy solution, cheap, and requires virtually no end-user interaction. That last bit is especially impo
Re: (Score:2)
Not to be a smartass, but...
For the folks (family and friends) that seem to think I'm a free computer repair store
I have way too many people like that in my life.
I imagine they all think my talents have been dwindling over the years. These days, more often than not, I just tell them that I wouldn't have the slightest clue what to do about their problem (even if it's an easy one).
When I was young and single, it didn't bother me so much. But now I have a wife and kids that I like to spend my free time with, so I've decided to discourage the behavior by simply being entirely useless anytime anyone calls with a computer
Re: (Score:2)
Oh, I almost forgot the most important policy.
In the rare instances that I do agree to help someone out, NEVER, under any circumstances do I do phone support. I'm not going to spend 10 minutes explaining to someone how to find the information that I need when I could see it in a split second if the computer was in front of me.
If you want me to work on your computer, and by some miracle I agree, then you will drop it off at my house, and I'll get to it at my convenience. It may be awhile. If you need it i
Re:My .02 (Score:5, Funny)
Bah - learn to make house calls to fix computers. It gets you laid (as in : having sex with a real woman.)
The trick is, pay attention to the computer for a while (ignoring the woman.) Then set it off doing something that's going to take a half hour or so (defragging the hard drive or backing up to an external) and explain - well, that's going to take an hour ... what can we do that will keep me busy while that thing works? Then the clothes start flying off.
Hey, it could happen!
Re: (Score:2)
Doesn't work out that way.
In reality you'll find that she just wants you to get her computer running so she can fire up her web cam and cyber with the dude she met in some chat room a few days ago. And she'll jabber on and on about how great he is the whole time you're there.
If you're lucky, she'll have beer in the fridge and offer you one or two while you work, but that's about all you can realistically hope for.
But be sure to get the name of that chat room before you leave! :-)
Re:My .02 (Score:4, Informative)
Even sadder, is I do this for a living - onsite, in home repair & installation - and the reality is they just whine about having to pay you for watching the progress bar. Pickup & dropoff involves so much less whining.
Re: (Score:3, Interesting)
I used to do the in-home thing on the side several years back. Even at $100 an hour for regular home users, I had enough business going that I could almost have quit my day job.
But, you're right. Home users whine way, way too much. They also have no concept of "business hours". They don't think twice about calling you at 10:00 pm to ask why some website won't load. They also seem to honestly and truly believe that their blown power supply is your fault because you installed Office on their computer 6 w
Freeware does the job. (Score:3, Informative)
Further Info: I phoned a Tamworth, UK-based company (Google it if you're bothered) regarding recovering a file from a USB drive for a teacher where I tech. They asked what I did so far to recover the file, I said I'd run some freeware recovery tool. They told me that's all they'd do, as they don't make money spending any more than about 5 minutes on it. If that can't find it, and you don't have hundreds / thousands of pounds to spend on engineer time, it's the best you'll get.
Re: (Score:3, Informative)
Pros avoid having to use data recovery tools. (Score:5, Informative)
Pros make sure they have good backups. Pros tell their users "nothing on your laptop/desktop is backed up", make that corporate policy, and respond to virus infestations by re-imaging the victim's computers to make sure that everyone's too damn scared of Mordac the Preventer to keep anything on local storage.
Re:Pros avoid having to use data recovery tools. (Score:5, Funny)
No the pro install nightly backup tools on the laptops. At least they do on mine.The backup software then uses heuristic algorithms to start the backups when the laptop is being used for meeting presentations in front of many people.
Re: (Score:2)
Re: (Score:3, Insightful)
That works just fine until a computer illiterate employee didn't back up their files, spent weeks making a file, the HD gives the click of death and your boss says how he read about recovering data from a broken HD and if you can't do it he can "find someone else".
Been there, done that, got quotes from vendors, got approval from the CFO, hand-carried the disk over to the top data recovery house in Houston, and they failed to get the files back,
Professionals don't fight battles they can only lose, and always
Re: (Score:3, Funny)
Re: (Score:2)
And middle-management tells pros "we don't have budget for backup systems!"
Re: (Score:2)
And middle-management tells pros "we don't have budget for backup systems!"
Pros implement backup systems anyway.
Re: (Score:2)
Yup... In this case, an ounce of prevention is worth several tons of cure. I was in this situation, and ended up using AD group policy to redirect everyone's My Docs to a server directory that I could back up. Then just make sure everyone knows that *everything* important has to go in there. Fortunately, most stuff defaults to saving there.
It only took one round of "oh no, I accidentally deleted X, and spent HOURS on it!!" "Was it in your My Documents?" "No" "Sorry, can't help." for everyone to get the hint
Re: (Score:2)
This is probably the most important policy you can implement in a business environment. Not only does it make fixing a broken PC trivial, it makes moving people from one
Re: (Score:2)
I've "accidentally" deleted many files that only had one copy over the years.
Files more than a day old? You must be doing something silly like keeping files you care about on a Windows desktop or laptop.
dd (Score:5, Informative)
dd if=/dev/sdb of=dump.img bs=512 conv=noerror,sync iflag=direct
Once a drive has started failing the first thing you want to do is get as good a copy of everything as you can manage. If it's a physical problem, especially if it's a damaged platter, then it tends to get worse as the drive is used. Get everything off and then work on the copy.
Tim.
Re: (Score:3, Interesting)
On the other hand, if it's a thermal problem, you may have to rescue in "chunks". I had a disk go that could only be used for about 10 minutes before it got too warm and shut down.
On the third hand, you may have something that looks like physical damage, but when you wipe the disk with zeros to confirm the fault and get ready for RMA-time, it all magically comes back. That's a sign you got corrupted data on the disk that the ECC couldn't deal with. (And probably that you've got a drive with questionable
Re: (Score:2)
Good points. I've never tried to recover a drive that fails for thermal reasons. Infact I've never seen a drive fail like this (not saying it doesn't happen)
I've recovered drives that have had an obvious head crash (computer was dropped down the stairs and certain chunks of the disk became unreadable and spread) and those with just corrupted data where the drive itself was rescued once the corrected sectors were dd back.
And I've recovered drives where getting the disk to start was the problem. One instance
Re: (Score:2)
What do you think conv=noerror,sync and iflag=direct are for?
I haven't actually used ddrescue and it looks like it has some valuable automatic features, especially if you have more than one damaged copy but I don't think for the raw reading it will do anything different to my dd command.
Tim.
TRK - dd/dd_rescue/ddrescue, Restorer (Score:5, Informative)
It depends on the type of failure, but generally, I start with a ddrescue [gnu.org] to get an image of the drive, especially if the drive is running bad sectors. Either I set the image to go to a secondary spare drive or I push it across the network. ddrescue is nice in that it doesn't bail when it hits those bad sectors, can run in reverse mode, and eventually it'll get as much as isn't corrupt on the drive into the image.
After establishing the image, the original failed drives go into ESD bags and aren't touched again unless they are to get shipped to one of the expensive clean room type places for their style recovery.
Most of the win32 drive recovery softwares out there can handle reading from an image file, so from here on out, I work with the images I took with ddrescue. Restorer has worked pretty well for me on getting things back from hard drives, CF cards, and even raid sets (figuring out the cluster sizes on the raid can be a pain if you don't happen to know them, but the software does support reassembling raid drives from the images you take of the single drives).
Most of the win32 packages out there have support for making the original images, but I haven't had as much luck with most of them when dealing with severely corrupted drives or with a large scattering of bad sectors. Either they take far too long to make it through the image or they end up failing to get by the bad sectors.
Regardless of what you end up picking, you don't want to use any of the recovery tools that advertise how they can fix the partition table and such on the drive, live . . . any recovery operation that thinks it is ok to 'fix' a drive with data on it you want to recover has the wrong mindset. The data is important, not making the drive work again.
EASEUS Disk Copy (Score:2, Informative)
its the mechanical failures (Score:3)
that keep the expensive guys in business
if all data loss were just a matter of awesome software, then wonderful. but frequently you are dealing with mechanical failures like the write head crashing onto the platters, death of the controller, failing motor, etc.
no software is going to fix these things. then its to the $100/hr guys in the clean room
Re: (Score:2)
You wish the clean room guys charged $100/hr. Most of them charge a grand or more just to evaluate the disk.
Spinrite works miracles (Score:4, Informative)
Re:Spinrite works miracles (Score:5, Informative)
Same here. At $89, SpinRite is a bit on the pricey side, but I have recovered data from hard drives that I thought I had zero chance of saving. I figure since it saved hundreds of dollars in labor -- several times -- it was worth every penny. Especially in those circumstances where your highly paid datacenter techs thought it was a great idea to construct a RAID 5 from all identical hard drives from the exact same manufacturer lot. Sucks when two of those drives experience the exact same fault within a few minutes of each other. Fortunately I was able to whip out SpinRite and save the day, because otherwise we were looking at days and days of restoring from incremental backup tapes.
It's an ancient-looking DOS command-line utility, but I definitely give props to Steve Gibson for keeping SpinRite up to date to where it works on modern hard drives. $89 versus days and days of overtime pay for IT guys -- it certainly made me look pretty good come performance review time.
Re:Spinrite works miracles (Score:4, Informative)
I was using Spinright back in the 90's - it was awesome then, but I wasn't aware they are still around.
I endorse the package from the 90s and if it is the same guys I'm tempted to endorse them today.
Re: (Score:2)
Re:Spinrite works miracles (Score:4, Informative)
RStudio (Score:2)
Midnight... (Score:2)
One time I used Me (Score:3, Informative)
Uphill, both ways, in the snow.
This is the ultimate last resort if you absolutely, have to, get a file back.
SpinRite (Score:3, Interesting)
dd, testdisk, foremost (Score:2)
The chain of tools I used barely a month ago goes like this.
1. dd to get whatever can be had off the hardware and into a disk image.
2. testdisk recovers partition information to make the images mount-able.
3. foremost to recover files. Pay attention to the conf file. There are *lots* of options that will discover all kinds of files in various condition.
As someone who just went through this with my laptop, the last two things to remember:
-You will need tons of disk space to work with the disk images and all
Depends (Score:3, Informative)
We usually start off with a bootable XP CD. Often there isn't anything really that messed up, and you can read the data that way with no problems. There are a couple of free programs, the names of which I can't remember off the top of my head, that do a fine job for "undeleting" files.
If it won't read in that, the next step is usually Knoppix. You can tell it to force mount a bad partition. Now that is a mixed blessing since sometimes the data you'll get is garbled which is why you try something else first. However, barring any serious problems, it'll usually mount and read.
If both of those have problems, the next set it the tools from the drive manufacturer to check for physical problems. You set those to do a full scan. At this point, there are three possible results:
1) It runs to completion, no errors. Means the physical disk is fine, it is all a logical data problem. Now go back to bootable Windows and run a checkdisk. Reason we didn't do this earlier is the moving of data checkdisk does can screw things up worse if there are physical problems.
2) It runs to completion, errors found and corrected. Back to Windows or if that doesn't work Knoppix to try and read the disk again. Usually it'll read, checkdisk it if not.
3) It errors out and gives a a diagnostic code meaning serious, unrecoverable errors. We are now at another juncture:
a) The data is really important. At this point, time to send it off to a specialist. Gillware.com is who I like. Pack it up and mail it off, you probably get your data back along with a bill for $300.
b) The data isn't critical, but we'd like to recover it. Run what I call "the magic disk destroyer." It's a program called Spinrite. It is a VERY aggressive recovery program. Because of that it is either going to get the disk readable, or fuck it up so bad nobody will be able to. Hence my nick name for it. Put the disk somewhere that you can have a fan blow on it, fire up Spinrite, and let it go for a day or two. See what happens.
A collection of small apps... (Score:2, Informative)
I agree with others about GetDataBack... it indeed is a good app.
Sometimes however, people have come to me with a hard drive with a FOUND.000 directory full (sometimes about 10GB) of CHK files... for that I recommend:
http://www.ericphelps.com/uncheck/ [ericphelps.com]
It is free and does a good job recognizing the supported files
Also, it is worth getting something like mplayer or VLC and try to manually open the biggest CHK files to see if they are some kind of media file.
Additionally, a Hex editor like xvi32 can be helpful
dd, file scavenger (Score:2)
I have used file scavenger (windows) with great success. File scavenger has restored files from disks that were unreadable or disks that come up as un-formatted. Even if you accidentally reformat the disk and write some data to it file scavenger will find what ever has not yet been corrupted and copy it to where ever you want it to go. Files that cant be recovered are still written to the backup disk but are given a zero byte size. You can then search for zero byte files and see what was unable to be recove
Pros before Hos... (Score:5, Insightful)
If your a Pro you back up all your important data anyway, so it is a moot point. Likely you even have some remote back up. There are services out there. Use Google, it ain't hard. In a pinch you can just email yourself some attachments in Gmail. Not good for media files or anything large, but if you want to save some key documents or your tax returns etc... Privacy may be an issue, but if your really prickly about that, then just encrypt it (though make sure you can decrypt easily later).
If it is a friend or family member who has just lost everything: Look very superior, point at them, remind them they should have backed up, and how stupid it is not to do so, then laugh at them for a while. Once your eyes clear of tears, repeat. After 4 or 5 times maybe it might sink in, and you will have done them a great service. Send them a bill in the mail.
Harsh I know, but come on, this has been cannon for years, get with the program.
Honestly though most people's computers are totally full of crap. There are some things like Personal files, Photos, and the like that are irreplaceable, but most stuff is just media you can replace, or software you can replace, etc... and if it is important to you, then back it up for god sakes.
Seriously, if you save their data you are just re-enforcing and rewarding bad behavior.
Re: (Score:2)
also grammar nazi's stay back! I see my mistakes and I like them damnit!
Re: (Score:3, Informative)
Wow, you're an asshole.
Maybe you should just do what you can for your family and then remind them that they should backup with their new drive. You know, as opposed to reinforcing the stereotype that all computer geeks are antisocial bastards that don't care about a person's feelings at all.
simple.. but not free. (Score:2, Informative)
Ontrack EasyRecovery Professional (Score:2, Informative)
The software, last time I checked, is no longer suported or updated. Ontrack now seems to specialize in data recovery, not data recovery software. I'm sure however you can find the software.... somewhere....
Crashed drive with a virtualbox image (Score:2, Interesting)
Circuitboard Repair or Replacement often necessary (Score:3, Informative)
As far as software goes, a combination of dd / ddrescue / strings / fdisk / grep / mount / and the r-studio suite from r-tt.com are what I use. Though, most of the time the drive is physically damaged, and it's not always inside.
For example, last week I had a laptop come in with no power to the drive. I examined the board with my eyes and my Fluke Multimeter and discovered that the power +5V on pins 41 and 42 wasn't reaching very far into the board and was basically disconnected at the first component. It looked to be a power-protection diode which had blown due to a surge. I was able to bypass it with a dot of solder, and once reassembled the hard drive powered on, I copied the data off. When the customer decided he didn't want to pay, well, I removed that solder dot before returning his drive to him without his data...
On 3.5" hard drives you'll often see a rectifier diode serving the same purpose, so when you run into a drive that doesn't spin up, check that out first. It's a small black component connecting the power to ground, and it shouldn't be passing electricity (but it will when it fails, so just pop it off to get your drive working again).
Other times a clicking drive can be fixed by just swapping out the board with an identical one from another drive. Sometimes, similar model number boards will work as well, but not often. It's a lot of fun trial and error. On the plus side, if the drive is totally fubar'd but still spins up, you can pop it open and do some hard drive spin art!
A mix of tools... (Score:3, Informative)
If the disk is good, but the OS hosed, try a Vista install DVD. Boot it into recovery mode, and one of the options is "copy files". (Honestly, the recovery tools included with Vista are a good first step). It'll copy the files to a USB hard disk.
If not, then it's time to boot Knoppix (which can mount NTFS just fine, thanks to ntfs-3g). If the disk is dying, but still good, use something like ddrescue to make an image (ddrescue uses dd to clone the disk, but it'll first do the good parts (fast), then try harder and harder on the parts the disk has problems with - this way you'll get the good parts of the disk off quickly and it can concentrate on the bad parts).
If you lost your partitions, gpart wourks great at seeking and finding 'em. One of my coworkers had just that problem and gpart managed to recover the partition table...
My toolset. (Score:2)
Windows PE live disc to try to read disc/chkdsk, and/or use HandyRecovery v1 (fw) for undelete/quick format recovery
Knoppix to read corrupt NTFS
SpinRite to try and recover/reset bad sectors
if Linux doesn't work (Score:3, Interesting)
if the tools you can get for Linux don't work, check out R-Studio [r-tt.com].
If you come across a product called "Stellar Phoenix" RUN AWAY. They are the shittiest company in existence. A few years ago I needed a tool and the demo of Stellar Phoenix seemed it would work (it lists the files it said it could recover) so we purchased it only to find that it could not recover them. Come to find out that while they claim support for ALL of NTFS's features, their software WOULD NOT recover files compressed using NTFS compression. This was despite their claims of NTFS5.1 support. They refused to issue a refund and it was a months-long battle so we finally complained to Amex to try to get a chargeback against them but we tried to work it out directly with stellarinfo for too long, so it was too late. They (stellarinfo) claim a 30-day money-back guarantee but DO NOT HONOR IT - or at least they didn't back then.
We then tried R-Studio, and their trial software listed files it could recover - AND it could recover 64KB chunks to prove it. So for some files I needed immediately I used the trial to decompress and reassemble the files (in 64KB chunks, and then catted them together), and for the rest when we received the key for the full version. We were able to recover every single file. I've used R-studio for clients since then and it has worked every single time, providing the drive will enumerate.
If the drive will not enumerate you have two possibilities: freezing it in CO2 (I have had success with that), or finding another of the same model drive with the same firmware and swap PCBs, and hope that the problem is with the controller and not the drive itself.
Why was there no backup? Believe me I asked the same question. :)
Summary:
free Linux tools - good
R-Studio - Awesome
stellar phoenix from stellar info - snake oil from a shitty company comprised of douchebags
Freeze the drive, seriously... (Score:3, Interesting)
List of data recovery tools (Score:3, Informative)
Here is a list of data recovery programs I have put together. Some of them may be a little old, for floppies or optical media only, but should still be useful. Unless otherwise noted, they are all for Microsoft Windows.
A-FF Labs [hdd-tools.com] - NTFS Undelete [ntfsundelete.com] and Partition Find and Mount [findandmount.com]
Access Data [accessdata.com] - FTK Imager [accessdata.com]
Acronis [acronis.com] - RecoveryExpert [acronis.com]
Advanced NTFS Recovery [ntfsrecovery.com] - NTFS Recovery [ntfsrecovery.com] (may handle FAT32 as well)
bitMART [bitmart.net] - Restorer Ultimate [restorer-ultimate.com]
Brant, Dmitry [dmitrybrant.com] - DiskDigger [dmitrybrant.com]
BriggSoft [briggsoft.com] - Directory Snoop [briggsoft.com]
CGSecurity [cgsecurity.org] - TeskDisk [cgsecurity.org] and PhotoRec [cgsecurity.org]
Convar [convar.com] - PC Inspector File Recovery [pcinspector.de]
Digital Assembly [digital-assembly.com] - Adroit Photo Recovery [digital-assembly.com] (pictures only)
DiskInternals [diskinternals.com] - NTFS Recovery [diskinternals.com]
DIY Data Recovery [diydatarecovery.nl] - iRecover [diydatarecovery.nl]
DTI Data [dtidata.com] - Recover It All [dtidata.com]
DataRescue.Com [datarescue.com] - PhotoRescue [datarescue.com] (intended for flash RAM cards, which are typically formatted with FAT, may work with other devices as well)
EASEUS [easeus.com] - Data Recovery & Security Suite [easeus.com]
Fsys Software [dfsee.com] - DFSee [dfsee.com]
Gibson Research Corp. [grc.com] - Spinrite [spinrite.com]
Gillware [gillware.com] - GillWare File Viewer [gillware.com]
Higher Ground Software [highergroundsoftware.com] - Hard Drive Mechanic Gold [highergroundsoftware.com]
Kato, Brian [aumha.org] - Restoration [aumha.org] (also here [cnet.com])
LC Technology [lc-tech.com] - [lc-tech.com]
[Continued in next message, as for some reason, Slashdot would not let me post in its entirety (too many URLs?). AG]
Mac OS X options (also: the freezer trick) (Score:3, Informative)
Also, a couple of times I've had dying drives that work OK for a few minutes after a cold boot, and then they (heat up and) die. I've had good luck throwing the drive in the freezer (in a ziplock bag) for a day, then powering up it, recovering as much as I can until the drive chokes again, lather, rinse, repeat, until all recoverable data has been copies off to a good drive.
Comment removed (Score:4, Informative)
Re: (Score:2)
Backup is better than RAID.
Also - RAID 5 is great if you smoke a drive. What happens if you smoke your RAID controller? I've seen it happen.
Re: (Score:2, Interesting)
I agree, RAID is not perfect but as for restoring data from a failed drive via some sort of recovery software will be useless in the case of multiple failures.
I work on large SAN/NAS arrays and there is never any full proof way of getting data back. Even if the OS is backed up to tape there is always the chance that the parity will fail, exc.. Most raid controllers are capable of detecting existing RAID configurations so replacing a card should no be that big of a deal. I will give you that it is never f
Re: (Score:2, Interesting)
Oh, I forgot, It also had scheduled snapshots on the LUN so it could be recovered to any point at any time.. Was such a beautiful thing..
Re: (Score:2)
Ironically, we haven't had much luck with the commercial stuff.
We've also got a silly python script that will run the "file" command on each file and sort them into the appropriate piles.
Re: (Score:2)
Backups. Backups. Bees.