Slashdot Mirror
What Data Recovery Tools Do the Pros Use?
Life2Death writes "I've been working with computers for a long time, and every once and a while someone close to me has a drive go belly up on them. I know there are big, expensive recovery houses that specialize in mission-critical data recovery, like if your house blew up and you have millions of files you need or something, but for the local IT group, what do you guys use? Given that most people are on NTFS (Windows XP) by the numbers, what would you use? I found a ton of tools when I googled, and everyone and their brother suggests something else, so I want to know what software 'just works' on most recoveries of bad, but partially working hard drives. Free software always has a warm spot in my heart."
I'm not a pro in this department although I've saved a lot of partial data from hard drives for some friends (I'll be very interested in these comments).
... the downside is sometimes I'm surprised in what I save for people--p0rn is not worth my time.
I use a live CD of Knoppix which has really good system repair and troubleshooting. I also have another important tool which is an old Dell Intel motherboard that allows me to set the rotational speed of the drive. Example: my friend's laptop is giving him the click of death so I pop out the IDE drive and hook it up to a 2.5" to 3.5" connector and plug it into the motherboard with a working 1TB 3.5" slaved. On boot up, I hit the BIOS and set the speed as low as it can go or low enough like 1,000 RPM. Then I boot into Knoppix live CD and check to see if I can mount the file system. Knoppix seems to be able to mount a lot of partitions that other more stringent flavors of Linux don't. Sometimes it clicks from the get go and there's nothing you can do. But if it doesn't, then I set a script up to copy their most valuable directories first onto the working 1TB drive. I let it run all night or weekend and check the drive periodically for heat problems. People are surprised what you can save for them doing this
My work here is dung.
For your health!
Does the job when all hope is lost. I've used it many times for myself and clients. $89.00 and worth every penny. http://spinrite.info/
On the other hand, if it's a thermal problem, you may have to rescue in "chunks". I had a disk go that could only be used for about 10 minutes before it got too warm and shut down.
On the third hand, you may have something that looks like physical damage, but when you wipe the disk with zeros to confirm the fault and get ready for RMA-time, it all magically comes back. That's a sign you got corrupted data on the disk that the ECC couldn't deal with. (And probably that you've got a drive with questionable firmware, and is reporting the wrong kind of error: Fujitsu, I'm looking at you. Especially for not recording anything in the SMART counters.)
I've been doing consulting and software development for around 30 years, and when I was young and dumb, thought I could fix anything. Now I know better and have found that in this situation, the phrase "Wow, that's too bad. Where are your backups?" works nicely.
While there are all sorts of voodoo, data scraping bit-remunging apps available, at the point before you do anything you have no liability. After you "recover" the data, you're on the hook for everything forever.
All you need is for the customer to come back 2 years later and tell you they were sued into the dirt because something they were required to disclose was missing or incorrect and you'll wish you never took the job.
And even if they don't sue, there will be a never-ending stream of phone calls about broken documents, files they can't find and all sorts of other "un-tidyness".
And even if they don't call, there will be eternal uncertainty about the quality of the recovered data. Are their financials correct? What was that number that had the letters nearby really supposed to be?
My favorite drive recovery method is now BackupPC. You set it up, configure it for an appropriate number of incremental backups each day and let it fly. When a drive craps out, replace it, click the appropriate checkbox on the "Restore" page and press the "go" button. No doubt, no lawsuits, no untidyness.
Do-it-yourself Data Recovery is great if you like to putter with things and have lots of time and no liability (employees generally can't be sued by their employer) however when actual money is at stake, it's better to just send the drive out and let someone who is actually equipped and staffed to do the recovery handle the work.
To put things in a different perspective, how happy would you be if the county tried to sell your house for unpaid taxes because billy-bob "who's really good with computers" did their drive recovery and your tax payments were on one of the bad spots?