Slashdot Mirror
What Data Recovery Tools Do the Pros Use?
Life2Death writes "I've been working with computers for a long time, and every once and a while someone close to me has a drive go belly up on them. I know there are big, expensive recovery houses that specialize in mission-critical data recovery, like if your house blew up and you have millions of files you need or something, but for the local IT group, what do you guys use? Given that most people are on NTFS (Windows XP) by the numbers, what would you use? I found a ton of tools when I googled, and everyone and their brother suggests something else, so I want to know what software 'just works' on most recoveries of bad, but partially working hard drives. Free software always has a warm spot in my heart."
That they should have backed up.
Real professionals backup their data.
If your a Pro you back up all your important data anyway, so it is a moot point. Likely you even have some remote back up. There are services out there. Use Google, it ain't hard. In a pinch you can just email yourself some attachments in Gmail. Not good for media files or anything large, but if you want to save some key documents or your tax returns etc... Privacy may be an issue, but if your really prickly about that, then just encrypt it (though make sure you can decrypt easily later).
If it is a friend or family member who has just lost everything: Look very superior, point at them, remind them they should have backed up, and how stupid it is not to do so, then laugh at them for a while. Once your eyes clear of tears, repeat. After 4 or 5 times maybe it might sink in, and you will have done them a great service. Send them a bill in the mail.
Harsh I know, but come on, this has been cannon for years, get with the program.
Honestly though most people's computers are totally full of crap. There are some things like Personal files, Photos, and the like that are irreplaceable, but most stuff is just media you can replace, or software you can replace, etc... and if it is important to you, then back it up for god sakes.
Seriously, if you save their data you are just re-enforcing and rewarding bad behavior.
If you are working on a 2nd generation clone you can afford to take risks in restoring the filesystem. "Oh it that didn't work, fire up another clone and try something else".
ddrescue (and other damaged disk oriented cloners) lets you work on a copy (or in my preference: a copy of a copy). This preserves the original disk if it has to go to a specialist lab later.
SpinRite has also saved my bacon more than once but that's something run on the original drive: not done lightly.
(Warning: dd_rescue is not Gnu ddrescue and Debian Linuxes rename dd_rescue to ddrescue. dd_rescue is a similar but not identical).
Finally: I need to add Windows NTFS rescue (built in) impressed me last time I needed it. It trundled for many hours but at the end, I had a mostly intact copy of a filesystem on my 2nd generation cloned drive. The original disk had been a mess.
Tell them that you don't have a full copy of all their data. Tell them to tell their lawyers that a hard drive failing is equivalent to a small fire occurring in the secretary's desk and while you, the fireman or handy guy with the fire extinguisher can recover a lot of data, there's no way to be certain that it's all the data.
People like you are a lot of what's wrong with the world. You cover your ass so much that you don't accomplish what your clients really want or need.
People like you are a lot of what's wrong with the world. You cover your ass so much that you don't accomplish what your clients really want or need.
Do you know what's worse than "No Data"?
Bad Data.
What my clients really need is data they can trust.
Telling someone "Here's your data, I got some of it back for you, but I'm not sure how much you lost or if the stuff I got back for you is correct" is great for your mother's vacation pictures. It's not great for your bank, insurance company, doctor, school or anybody else that needs to have verifiable, correct data.
In cases like this, when you are bringing your system in to have someone work on a specific component (not the hard drive), I find it is hand to have a small "I don't care about this" drive that you can slap an OS on, then remove and set aside. Then if you ever need a repair, put it back and remove the one with your actual data on it. (Or once I knew someone that had 2 drives in their system - 1 for the OS and 1 for data. I suggested he remove the data one before bringing it in. And of course, they reformatted the one with the OS on it, even though he had requested doing nothing with the hard drive.) After having almost the exact same thing happen to a friend of mine a few years ago, that is what I did for his system, and what i recommend to anyone going to have the systems worked on by "geniuses" or "geeks".
"But this one goes to 11!"
No question with TestDisk as an excellent open source/free recovery option.
It was the only thing I found (freeware or pay) that relatively easily restored a couple of NTFS logical partitions--and all data--after they were destroyed by an older version (8.0) of Diskeeper's "boot optimization" defragging. The last time I used Diskeeper or recommended it. I continue to use and recommend TestDisk. The author of TestDisk was also responsive to emails when I encountered a unique issue with the drives I ended up needing help with.
Note that TestDisk is only for recovering lost partitions and making non-bootable partitions bootable again. For those functions, there is no better program out there.
Its sister program included in its download--PhotoRec--can do file recovery. Its designed mainly for recovery of photos off all media, but it supports many different file formats. So the TestDisk/PhotoRec package may be all you need.
Other freeware/non-open source file recovery alternatives that are reliable and work well:
--PC INSPECTOR File Recovery. 100% free & full featured, many options. Been using it for years.
--Recuva. 100% free, by Piriform, the maker of the very popular CCleaner/Crap Cleaner system cleaner.
Somewhat less elegant than the above one. But the only freeware option I've studied that can do a "deep scan" of your drives for lost files. Which can take hours, but may turn up more missing data than the other non-PhotoRec options here.
--EASEUS Deleted File Recovery. A more limited version of their $70 "EASEUS Data Recovery Wizard", but very well designed for basic file recovery.
There are other freeware file recovery options I've studied, but they are all more limited than the above. Would recommend TestDisk (for partitions) and PhotoRec (for files) first, then the other three (for files) in the order given.
In all honesty, shelling out for a payware solution is very unlikely to "find" more deleted files on a NTFS partition than the above freeware solutions, unless you have special needs they don't cover. Which is rare. And again, there is nothing better than TestDisk--free or payware--for recovering partitions.