Slashdot Mirror
What Data Recovery Tools Do the Pros Use?
Life2Death writes "I've been working with computers for a long time, and every once and a while someone close to me has a drive go belly up on them. I know there are big, expensive recovery houses that specialize in mission-critical data recovery, like if your house blew up and you have millions of files you need or something, but for the local IT group, what do you guys use? Given that most people are on NTFS (Windows XP) by the numbers, what would you use? I found a ton of tools when I googled, and everyone and their brother suggests something else, so I want to know what software 'just works' on most recoveries of bad, but partially working hard drives. Free software always has a warm spot in my heart."
That they should have backed up.
Real professionals backup their data.
I'm kinda hoping your trying to be amusing here, if you are though its gone under my humour radar today (and I apologise if I seem like an arse)
Yes most "professionals" will have backups of their data (which is what I presume you are alluding to) however it's not always the case that those backups will be literally up to the minute, and sometimes its just less hassle to recover any lost "recent" data then it is to just cycle to the last backup and deal with the shortfall. Also its not exactly uncommon for "professionals" to be asked to help recover data for NON-professionals.
I agree with you 100%. I've done this many times, myself.
If you can recover any lost "recent" data in less than 20 minutes, then by all means do it.
Otherwise, tell me which is preferable to management:
1) Spending 20-30 minutes restoring the file from last night's backup
2) Spending 2-3 hours, hacking FAT tables on a PC
Restoring from backup is a known cost (of labor), whereas hacking file tables isn't. Could take hours, during which you are getting less real work done.
If your a Pro you back up all your important data anyway, so it is a moot point. Likely you even have some remote back up. There are services out there. Use Google, it ain't hard. In a pinch you can just email yourself some attachments in Gmail. Not good for media files or anything large, but if you want to save some key documents or your tax returns etc... Privacy may be an issue, but if your really prickly about that, then just encrypt it (though make sure you can decrypt easily later).
If it is a friend or family member who has just lost everything: Look very superior, point at them, remind them they should have backed up, and how stupid it is not to do so, then laugh at them for a while. Once your eyes clear of tears, repeat. After 4 or 5 times maybe it might sink in, and you will have done them a great service. Send them a bill in the mail.
Harsh I know, but come on, this has been cannon for years, get with the program.
Honestly though most people's computers are totally full of crap. There are some things like Personal files, Photos, and the like that are irreplaceable, but most stuff is just media you can replace, or software you can replace, etc... and if it is important to you, then back it up for god sakes.
Seriously, if you save their data you are just re-enforcing and rewarding bad behavior.
If you are working on a 2nd generation clone you can afford to take risks in restoring the filesystem. "Oh it that didn't work, fire up another clone and try something else".
ddrescue (and other damaged disk oriented cloners) lets you work on a copy (or in my preference: a copy of a copy). This preserves the original disk if it has to go to a specialist lab later.
SpinRite has also saved my bacon more than once but that's something run on the original drive: not done lightly.
(Warning: dd_rescue is not Gnu ddrescue and Debian Linuxes rename dd_rescue to ddrescue. dd_rescue is a similar but not identical).
Finally: I need to add Windows NTFS rescue (built in) impressed me last time I needed it. It trundled for many hours but at the end, I had a mostly intact copy of a filesystem on my 2nd generation cloned drive. The original disk had been a mess.
That works just fine until a computer illiterate employee didn't back up their files, spent weeks making a file, the HD gives the click of death and your boss says how he read about recovering data from a broken HD and if you can't do it he can "find someone else".
Been there, done that, got quotes from vendors, got approval from the CFO, hand-carried the disk over to the top data recovery house in Houston, and they failed to get the files back,
Professionals don't fight battles they can only lose, and always have a plan B.
Tell them that you don't have a full copy of all their data. Tell them to tell their lawyers that a hard drive failing is equivalent to a small fire occurring in the secretary's desk and while you, the fireman or handy guy with the fire extinguisher can recover a lot of data, there's no way to be certain that it's all the data.
People like you are a lot of what's wrong with the world. You cover your ass so much that you don't accomplish what your clients really want or need.
I'm not sure why the moderators decided the parent posts were flamebait: at worst, by not recommending some product, they might be considered off-topic.
But the simple fact is that the surest way to keep your data is to back it up, back it up more than once, and to VERIFY your backups. Of course that doesn't help if we're having to salvage someone else's fuckup, but at least you can say "Everybody told you so".
People like you are a lot of what's wrong with the world. You cover your ass so much that you don't accomplish what your clients really want or need.
Do you know what's worse than "No Data"?
Bad Data.
What my clients really need is data they can trust.
Telling someone "Here's your data, I got some of it back for you, but I'm not sure how much you lost or if the stuff I got back for you is correct" is great for your mother's vacation pictures. It's not great for your bank, insurance company, doctor, school or anybody else that needs to have verifiable, correct data.
In cases like this, when you are bringing your system in to have someone work on a specific component (not the hard drive), I find it is hand to have a small "I don't care about this" drive that you can slap an OS on, then remove and set aside. Then if you ever need a repair, put it back and remove the one with your actual data on it. (Or once I knew someone that had 2 drives in their system - 1 for the OS and 1 for data. I suggested he remove the data one before bringing it in. And of course, they reformatted the one with the OS on it, even though he had requested doing nothing with the hard drive.) After having almost the exact same thing happen to a friend of mine a few years ago, that is what I did for his system, and what i recommend to anyone going to have the systems worked on by "geniuses" or "geeks".
"But this one goes to 11!"
Try putting the bad drive in the fridge for about 15 minutes. Sometimes it's a thermal expansion problem on the board or in a chip and you can get a few working minutes with the drive to copy files off. If that doesn't work, try the freezer. If that doesn't work, try some gentle heat with a hair dryer. If none of that works, you're back to the board swap or a professional recovery service. If the fridge/freezer thing works, using a USB interface on the drive will buy you some more up time, as you don't waste "cool" time while the machine boots up before you start pulling files off.
I agree about the freezer suggestion but you left out one VERY IMPORTANT precaution! The cold metal being re-exposed to a warmer environment with higher humidity when removed from the freezer will result in condensation on all external AND internal surfaces! The best way to do this safely is to put your internal drive into an external HD enclosure, connect the USB and power cord, then double bag it and tape the ends. You have to make the bag air tight but leave your cables hanging out. This way the drive is cooled with a fixed amount of air (and thus water particulate) surrounding it. As it cools a very small amount of moisture will be locked in the bag but not enough to be of concern. When it is removed from the freezer, this small amount of moisture is all it can/will be exposed to and further moisture from the surrounding air will be isolated. Once the drive has stabilized to ambient temperature it can be safely removed.
Due to the variety of types of errors and possible causes of data loss, I find that -throughout the recovery process- the more options you set by yourself (requiring knowledge and experience in hard drives and file systems) the more efficient the process is. So, no matter the tool you choose, try to provide as much info to the tool as possible, and don't rely on the software developer(s) to choose a best general case which will always work...
Your Ad here
No question with TestDisk as an excellent open source/free recovery option.
It was the only thing I found (freeware or pay) that relatively easily restored a couple of NTFS logical partitions--and all data--after they were destroyed by an older version (8.0) of Diskeeper's "boot optimization" defragging. The last time I used Diskeeper or recommended it. I continue to use and recommend TestDisk. The author of TestDisk was also responsive to emails when I encountered a unique issue with the drives I ended up needing help with.
Note that TestDisk is only for recovering lost partitions and making non-bootable partitions bootable again. For those functions, there is no better program out there.
Its sister program included in its download--PhotoRec--can do file recovery. Its designed mainly for recovery of photos off all media, but it supports many different file formats. So the TestDisk/PhotoRec package may be all you need.
Other freeware/non-open source file recovery alternatives that are reliable and work well:
--PC INSPECTOR File Recovery. 100% free & full featured, many options. Been using it for years.
--Recuva. 100% free, by Piriform, the maker of the very popular CCleaner/Crap Cleaner system cleaner.
Somewhat less elegant than the above one. But the only freeware option I've studied that can do a "deep scan" of your drives for lost files. Which can take hours, but may turn up more missing data than the other non-PhotoRec options here.
--EASEUS Deleted File Recovery. A more limited version of their $70 "EASEUS Data Recovery Wizard", but very well designed for basic file recovery.
There are other freeware file recovery options I've studied, but they are all more limited than the above. Would recommend TestDisk (for partitions) and PhotoRec (for files) first, then the other three (for files) in the order given.
In all honesty, shelling out for a payware solution is very unlikely to "find" more deleted files on a NTFS partition than the above freeware solutions, unless you have special needs they don't cover. Which is rare. And again, there is nothing better than TestDisk--free or payware--for recovering partitions.