File Recovery Software

by PlatterSwapper

Probably the single most commonly conducted type of do-it-yourself home data recovery involves attempting file recovery using commercial data recovery software. The purpose of this short article is to give some advice regarding how to proceed with such work. It has been prompted by the regular receipt in our labs of hard drives which have been placed beyond all hope of recovery by the incorrect application of such software.

What Does File Recovery Software Do?

The file recovery software being referred to here is the type that you would use to scan your hard drive in an attempt to locate files which you can no longer access normally. This type of software will scan your drive sector by sector, typically it will be searching for two things. Firstly any fragments of the file system’s file table which have become disconnected from the rest. In less technical terms, it is looking for lost parts of the index to your data. Where these are found the resulting files will usually be recovered with their original file names (the names that you assigned when you last saved them). Secondly the file recovery software will be looking for certain types of files (for example Microsoft Word documents or JPEG photograph files) by looking for their raw characteristics. For example JPEG photograph files will have a characteristic header (beginning) to the file and a characteristic footer (ending). Where the file recovery software can identify these it will simply save everything from the header to the footer as an extracted file. Such files are recovered without their original file names (this information was stored in the file table, or “index”). Most recovery software will assign its own name to such files with the appropriate file extension, e.g. 12345.jpg or 12345.doc etc.

Commonly you will find that when you open “recovered” files the contents are in fact corrupted. The file recovery software cannot tell whether any file that it extracts will be intact, you will have to do this yourself by opening them with appropriate applications. There are many reasons why the recovered files may not be intact, the original data may have been partly overwritten or the original file may have been fragmented (have been spread over various parts of the drive) and not all of the fragments have been recoverable for example.

When is it Safe to Use File Recovery Software?

It is worth being clear, there is nothing inherently wrong with this type of software. Quite the reverse, when used correctly such program are exactly what is needed, but it is very important to understand when it will endanger file recovery rather than facilitate it. Such software  should only ever be used when the hard drive itself is known to be fully operational, i.e. without any physical problems such as bad sectors (which are an extremely common cause of the data on a drive becoming inaccessible) or any other physical impairment to full data access. This type of file recovery is categorically the correct choice where the following has been the cause of your loss of data:

  1. You have unintentionally deleted the data that you need.
  2. You accidentally reformatted or re-partitioned the drive.

In other words the reason that you now need file recovery is not due to a problem with the operation of the hard drive itself.

How Do You Carry Out a Safe File Recovery Scan?

Where you are satisfied that the hard drive itself is healthy the safest way to proceed with the file recovery process is as follows:

1. Stop using the hard drive in question immediately. This is essential, as far as the operating system is concerned the area of the hard drive which is occupied by the files that you are missing is available for use, every time it writes to the hard drive it may over-write your data (and when that happens your data is gone for good).

2. You will need to install the file recovery software on another computer. Never, ever (ever) install this on the drive which holds your lost data, for the reason outlined above. The irony of over-writing your vital lost files with recover software intended to locate and extract them is epic but unwelcome.

3. You will need to remove the hard drive with your lost data and connect it to the computer which will be running the recovery software. The easiest way of doing this is probably by buying a USB caddy into which your hard drive can slot. You can then connect your drive to the second computer via USB port.

4. Start scanning your hard drive with the recovery software (see below for some suggested programs to try). At some point the software will ask you to choose a location to dump the recovered files. Under no circumstances should this be your original drive with the lost data. If you save the recovered files to this same drive then you will of course be over-writing more of your lost data. Choose another drive to save the files to. Bear in mind that the recovery software will probably recover a much greater amount of data than is actually there. It will be reading and re-reading the contents of the drive and trying different interpretations of the data that it finds, much of what is recovered therefore will not be genuine data but you will need the space for it on the target drive for the recovered data.

5. The scan will last for some hours (depending of course upon the capacity of the drive). Most show some sort of progress indicator. If you notice that it is struggling then this is an indication that the drive has physical problems, stop the scanning immediately. Running file recovery software on a drive with physical problems is an excellent way of destroying your data. We routinely see drives which have been subjected to days and even weeks of a recovery software scan, the final recovery results are usually poor from such cases.

There are a huge range of file recovery programs to choose from online. By and large they all carry out the same tasks but if the results are disappointing with one then it is definitely worth trying a second. Most of the reputable programs offer some form of free demonstration version of the software. For example they will allow you to view but not save the data discovered or allow you to recover data up to a certain limited file size. Once you have paid for the software the limitation is then removed of course.

Some of the more commonly used file recovery programs are:

GetDataBack:

http://www.runtime.org/data-recovery-software.htm

R-Studio:

http://www.r-studio.com/

DiskWarrior (Macs only):

http://www.alsoft.com/diskwarrior/

This is not an endorsement (like most specialist data recovery companies we write and use out own in-house recovery software) but any of these should be perfectly satisfactory for the task of logical file recovery.

Note that when choosing the file recovery software you may need to know the file system used on your hard drive as different file systems use different recovery software programs. Usually Windows will be a file system called NTFS (older versions of Windows may be FAT32). You can find out which file system your hard drive is using via the Control Panel. Using the left-hand-side mouse button, click the Windows icon in the bottom right hand corner then click “Control Panel” the precise means of access control panel will vary depending upon which version of Windows you are using:

Then  select “Administrative Tools”:

Then “Computer Management”:

And finally “Disk Management”:

The file system can be important in selecting an appropriate file recovery software program

In this instance it can be seen that the drive is using the NTFS file system (indicated with a red arrow).

If you are a Mac user then you will probably be using the HFS+ file system. If you have a more esoteric file system then you almost certainly already know what it is.

 

Why Do I Need to be Cautious With File Recovery Software?

The reason for the vital caveat regarding the appropriate use of file recovery software is that when a drive is suffering from physical problems each time that a sector is read may well be the last time that it will ever be capable of being read. If this sounds alarmist then ask any data recovery specialist for the single most common reason that file recovery is not possible (even for them) and they will all tell you, “because the drive had been hammered with data recovery software before we received it”. When a drive is in a precarious physical condition it must be cloned, that is each sector read and the contents copied to a healthy drive. Once this has been completed then you are free to try any number of file recovery techniques. Data recovery software reads and in some cases re-reads each sector repeatedly in an effort to rebuild the file system, on a physically ailing hard drive this adds massively to the number of permanently unreadable sectors and at the end of the file recovery software scan instead of a full clone on a healthy hard drive there is nothing to show for it but a small handful of partially recovered files.

Where the cause of the loss of access to the data is known and the drive therefore can be trusted to be physically healthy, then do-it-yourself file recovery using commercial software downloaded from the internet is an excellent and inexpensive way of recovering your data, as long as you follow the basic rules discussed in this article.

Previous post:

Next post:

Tierra EmailRead our RSS FeedFollow us on TwitterLike us on Facebook