Slashdot Mirror
What Data Recovery Tools Do the Pros Use?
Life2Death writes "I've been working with computers for a long time, and every once and a while someone close to me has a drive go belly up on them. I know there are big, expensive recovery houses that specialize in mission-critical data recovery, like if your house blew up and you have millions of files you need or something, but for the local IT group, what do you guys use? Given that most people are on NTFS (Windows XP) by the numbers, what would you use? I found a ton of tools when I googled, and everyone and their brother suggests something else, so I want to know what software 'just works' on most recoveries of bad, but partially working hard drives. Free software always has a warm spot in my heart."
Get Data Back works very well.
Lemon juice and heat!
Great minds think alike; fools seldom differ.
That they should have backed up.
GetDataBack has worked perfectly for me many times. Very easy interface, works on deleted files as well as formatted disks (provided the data you want to recover hasn't been overwritten, of course). Worth the $79, IMO.
ddrescue
But to be honest, if you've hit that point for an "enthusiast" user, then you're already on your last legs. If you ain't got a backup, forget it - the chances of getting one particular file you've lost might be good, the chances of recovering any significant amounts and being able to verify their integrity are bad.
Plus, with SSD's, flash, memory cards, etc. the chances of being able to recover *anything* from a faulty drive without professional equipment are fast approaching zero. Most USB Flash drives just "die" when they hit their write limits, rather than fail gracefully into read-only mode.
I'm not a pro in this department although I've saved a lot of partial data from hard drives for some friends (I'll be very interested in these comments).
... the downside is sometimes I'm surprised in what I save for people--p0rn is not worth my time.
I use a live CD of Knoppix which has really good system repair and troubleshooting. I also have another important tool which is an old Dell Intel motherboard that allows me to set the rotational speed of the drive. Example: my friend's laptop is giving him the click of death so I pop out the IDE drive and hook it up to a 2.5" to 3.5" connector and plug it into the motherboard with a working 1TB 3.5" slaved. On boot up, I hit the BIOS and set the speed as low as it can go or low enough like 1,000 RPM. Then I boot into Knoppix live CD and check to see if I can mount the file system. Knoppix seems to be able to mount a lot of partitions that other more stringent flavors of Linux don't. Sometimes it clicks from the get go and there's nothing you can do. But if it doesn't, then I set a script up to copy their most valuable directories first onto the working 1TB drive. I let it run all night or weekend and check the drive periodically for heat problems. People are surprised what you can save for them doing this
My work here is dung.
Back when most data recovery and disk utility applications didnt work on vista (and many still dont) I found one called r-studio. It managed to recover a whole lot of data of a damaged flaky 5TB Raid 5 array, which is pretty impressive considering it was the only application at the time that could even recognize it as a drive, all the others just call it a damaged volume.
As far as I know its still the only one that can do Raids, at least as far as I can find. It also allows many customization options of searches and donest over simplify things too much. It takes forever but it finds any potential damaged file systems and then lets you use whichever one you like to recover whichever files you like. It can also be used to recover deleted files.
As far as I recall its pretty cheap, at least compared to a few out there and worth a try. But with all recovery and security software, I find the information and their website extremely generalized and vague about what exactly you can do, so I always download the software first to make sure it can do what I want, which 90% of the time it cant, and then if it works I buy it. Its not the most legal practice but if they dont offer demos and wont be specific about what their software does its the only practical solution.
So Skulldilocks threw acid on the schoolchildrens' faces, cause somebody from the bible told her to do it!
For your health!
Pros make sure they have good backups. Pros tell their users "nothing on your laptop/desktop is backed up", make that corporate policy, and respond to virus infestations by re-imaging the victim's computers to make sure that everyone's too damn scared of Mordac the Preventer to keep anything on local storage.
dd if=/dev/sdb of=dump.img bs=512 conv=noerror,sync iflag=direct
Once a drive has started failing the first thing you want to do is get as good a copy of everything as you can manage. If it's a physical problem, especially if it's a damaged platter, then it tends to get worse as the drive is used. Get everything off and then work on the copy.
Tim.
God said, "div D = rho, div B = 0, curl E = -@B/@t, curl H = J + @D/@t," and there was light.
My favorite tools are a combination of the Trinity Rescue Kit linux boot cd and the Restorer tool.
It depends on the type of failure, but generally, I start with a ddrescue to get an image of the drive, especially if the drive is running bad sectors. Either I set the image to go to a secondary spare drive or I push it across the network. ddrescue is nice in that it doesn't bail when it hits those bad sectors, can run in reverse mode, and eventually it'll get as much as isn't corrupt on the drive into the image.
After establishing the image, the original failed drives go into ESD bags and aren't touched again unless they are to get shipped to one of the expensive clean room type places for their style recovery.
Most of the win32 drive recovery softwares out there can handle reading from an image file, so from here on out, I work with the images I took with ddrescue. Restorer has worked pretty well for me on getting things back from hard drives, CF cards, and even raid sets (figuring out the cluster sizes on the raid can be a pain if you don't happen to know them, but the software does support reassembling raid drives from the images you take of the single drives).
Most of the win32 packages out there have support for making the original images, but I haven't had as much luck with most of them when dealing with severely corrupted drives or with a large scattering of bad sectors. Either they take far too long to make it through the image or they end up failing to get by the bad sectors.
Regardless of what you end up picking, you don't want to use any of the recovery tools that advertise how they can fix the partition table and such on the drive, live . . . any recovery operation that thinks it is ok to 'fix' a drive with data on it you want to recover has the wrong mindset. The data is important, not making the drive work again.
Real professionals backup their data.
Spinrite has worked miracles in the past for me. It's brought back unbootable corrupted windows partitions back to life for me. Supposedly it also fixes physical defects in hard drives as well. It boots off of a image from disc. It costs $89.00 but it's saved my butt in the past.
Does the job when all hope is lost. I've used it many times for myself and clients. $89.00 and worth every penny. http://spinrite.info/
I agree, these days every home PC should be setup for RAID1 (RAID5 for workstations). However, RAID should *never* be a substitute for making backups to external media.
Life is not for the lazy.
If your a Pro you back up all your important data anyway, so it is a moot point. Likely you even have some remote back up. There are services out there. Use Google, it ain't hard. In a pinch you can just email yourself some attachments in Gmail. Not good for media files or anything large, but if you want to save some key documents or your tax returns etc... Privacy may be an issue, but if your really prickly about that, then just encrypt it (though make sure you can decrypt easily later).
If it is a friend or family member who has just lost everything: Look very superior, point at them, remind them they should have backed up, and how stupid it is not to do so, then laugh at them for a while. Once your eyes clear of tears, repeat. After 4 or 5 times maybe it might sink in, and you will have done them a great service. Send them a bill in the mail.
Harsh I know, but come on, this has been cannon for years, get with the program.
Honestly though most people's computers are totally full of crap. There are some things like Personal files, Photos, and the like that are irreplaceable, but most stuff is just media you can replace, or software you can replace, etc... and if it is important to you, then back it up for god sakes.
Seriously, if you save their data you are just re-enforcing and rewarding bad behavior.
Bah - learn to make house calls to fix computers. It gets you laid (as in : having sex with a real woman.)
The trick is, pay attention to the computer for a while (ignoring the woman.) Then set it off doing something that's going to take a half hour or so (defragging the hard drive or backing up to an external) and explain - well, that's going to take an hour ... what can we do that will keep me busy while that thing works? Then the clothes start flying off.
Hey, it could happen!
Glonoinha the MebiByte Slayer
As far as software goes, a combination of dd / ddrescue / strings / fdisk / grep / mount / and the r-studio suite from r-tt.com are what I use. Though, most of the time the drive is physically damaged, and it's not always inside.
For example, last week I had a laptop come in with no power to the drive. I examined the board with my eyes and my Fluke Multimeter and discovered that the power +5V on pins 41 and 42 wasn't reaching very far into the board and was basically disconnected at the first component. It looked to be a power-protection diode which had blown due to a surge. I was able to bypass it with a dot of solder, and once reassembled the hard drive powered on, I copied the data off. When the customer decided he didn't want to pay, well, I removed that solder dot before returning his drive to him without his data...
On 3.5" hard drives you'll often see a rectifier diode serving the same purpose, so when you run into a drive that doesn't spin up, check that out first. It's a small black component connecting the power to ground, and it shouldn't be passing electricity (but it will when it fails, so just pop it off to get your drive working again).
Other times a clicking drive can be fixed by just swapping out the board with an identical one from another drive. Sometimes, similar model number boards will work as well, but not often. It's a lot of fun trial and error. On the plus side, if the drive is totally fubar'd but still spins up, you can pop it open and do some hard drive spin art!
If you are working on a 2nd generation clone you can afford to take risks in restoring the filesystem. "Oh it that didn't work, fire up another clone and try something else".
ddrescue (and other damaged disk oriented cloners) lets you work on a copy (or in my preference: a copy of a copy). This preserves the original disk if it has to go to a specialist lab later.
SpinRite has also saved my bacon more than once but that's something run on the original drive: not done lightly.
(Warning: dd_rescue is not Gnu ddrescue and Debian Linuxes rename dd_rescue to ddrescue. dd_rescue is a similar but not identical).
Finally: I need to add Windows NTFS rescue (built in) impressed me last time I needed it. It trundled for many hours but at the end, I had a mostly intact copy of a filesystem on my 2nd generation cloned drive. The original disk had been a mess.
Even sadder, is I do this for a living - onsite, in home repair & installation - and the reality is they just whine about having to pay you for watching the progress bar. Pickup & dropoff involves so much less whining.
In cases like this, when you are bringing your system in to have someone work on a specific component (not the hard drive), I find it is hand to have a small "I don't care about this" drive that you can slap an OS on, then remove and set aside. Then if you ever need a repair, put it back and remove the one with your actual data on it. (Or once I knew someone that had 2 drives in their system - 1 for the OS and 1 for data. I suggested he remove the data one before bringing it in. And of course, they reformatted the one with the OS on it, even though he had requested doing nothing with the hard drive.) After having almost the exact same thing happen to a friend of mine a few years ago, that is what I did for his system, and what i recommend to anyone going to have the systems worked on by "geniuses" or "geeks".
"But this one goes to 11!"
When I repair a computer, I set the terms, not the customer. I would never agree to pay for an inflated damage cost, ever. As a matter of fact, I tell them flat out I am not responsible for any data loss that would occur. Not that I have ever lost anyone's data, but if I did I want it clear i am not liable for any monetary loss they would suffer. If their data is THAT important, they have multiple backups, right?
"But this one goes to 11!"