×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

What Data Recovery Tools Do the Pros Use?

timothy posted more than 4 years ago | from the besides-waterboarding dept.

Data Storage 399

Life2Death writes "I've been working with computers for a long time, and every once and a while someone close to me has a drive go belly up on them. I know there are big, expensive recovery houses that specialize in mission-critical data recovery, like if your house blew up and you have millions of files you need or something, but for the local IT group, what do you guys use? Given that most people are on NTFS (Windows XP) by the numbers, what would you use? I found a ton of tools when I googled, and everyone and their brother suggests something else, so I want to know what software 'just works' on most recoveries of bad, but partially working hard drives. Free software always has a warm spot in my heart."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

399 comments

for fat and ntfs (5, Informative)

keeegan (1526067) | more than 4 years ago | (#28181769)

Get Data Back works very well.

Re:for fat and ntfs (1, Informative)

Anonymous Coward | more than 4 years ago | (#28181821)

I agree - I have a lot of success with this package...

Re:for fat and ntfs (5, Informative)

darkvad0r (1331303) | more than 4 years ago | (#28181877)

For a free solution, check TestDisk [cgsecurity.org] .
It has saved my data many times.

Re:for fat and ntfs (1)

rinoid (451982) | more than 4 years ago | (#28183195)

I concur ... TestDisk just saved 4gb of pictures from unreadable cards.

I also use DataRescue but TestDisk just kicked it's bits.

Re:for fat and ntfs (4, Informative)

TheLinuxSRC (683475) | more than 4 years ago | (#28183243)

I could not agree more. Just last week I had a designer friend who accidentally deleted the partition his portfolio was on. We tried to recover the partition however the MFT had become lost/corrupted.

My first attempt to recover his data was with ntfsundelete, [ntfsundelete.com] however it did not recognize the partition at all. I next used Disk Internals NTFS Recovery [diskinternals.com] program (Commercial) with the same results.

Finally, I Googled a bit and found the testdisk/photorec [cgsecurity.org] package and used that. It took about 40 hours to recover ~225GB data. It was unable to recover filenames, however it did create new directories for each directory it found and recreated the files in those directories, albeit with arbitrary names. Most impressively it did recreate the files with the proper file name extensions. With some creative perl scripting I could have even renamed some of these files based on meta data in the files. This was not necessary in my case.

Re:for fat and ntfs (0)

Anonymous Coward | more than 4 years ago | (#28181947)

Whenever this question comes up on any online forum I post on, the answer is always the same: GetDataBack for NTFS

Just make sure, you back up the data to a different drive than the one you're trying to recover.

Re:for fat and ntfs (1)

PFactor (135319) | more than 4 years ago | (#28182113)

I second this. It great for recovering data from pretty much anything: flash drives, memory cards, hard drives. The primary caveat is that the drive itself has to be fully operational. If the drive cannot be mounted/connected (like if the drive electronics are fried) this program won't help you.GetDataBack just does a scan of the disk and offers to 'undelete' any file fragments it finds. Also, the bigger the drive, the longer it takes the process to complete. I suppose this is true of all tools that operate in this fashion so I can't say it's a con to GetDataBack. Also, there's a separate version for FAT and for NTFS.

Re:for fat and ntfs (-1, Troll)

Jurily (900488) | more than 4 years ago | (#28182255)

If the drive cannot be mounted/connected (like if the drive electronics are fried) this program won't help you.

Umm, duh? Anyone thinking otherwise should not be here.

Oh, and the recovery process took about 10 hours for a 600 Gb partition. It was worth every second. Shame they don't make those for Linux.

Funny you mention Linux (1)

memojuez (910304) | more than 4 years ago | (#28183211)

One user's hard drive was making the dreaded "click-click, whir-kerchunk" noises during start-up causing it to lock up.

I booted the desktop with an old Knoppix 3.4 Live CD and used SAMBA to copy her critical files to another windows computer. Every click and kerchunk of the dying harddrive only momentarily slowed the transfer of data.

I tried to do the same thing on an Ubuntu drive that had bad sectors, but the security on the files prevented them from being accessed.

Re:for fat and ntfs (0)

Anonymous Coward | more than 4 years ago | (#28182295)

I have a Cleric cast Resurrection on the hard drive.

Re:for fat and ntfs (2, Informative)

SputnikPanic (927985) | more than 4 years ago | (#28182475)

By necessity, I discovered and used this software just last night, and the data recovery process was smoother than I had anticipated. At one point when I was copying the salvaged files to a good drive, Windows took exception with one of the files and started barking one of its usual program-terminating error messages. I was afraid that I'd have to have GetDataBack reread the whole drive and start the whole process all over again, but the program was robust enough to avoid crashing. It just moved on to the next file and kept on going. It's not often that I pay for software but this was $80 well spent.

Re:for fat and ntfs (0)

Anonymous Coward | more than 4 years ago | (#28182643)

I used GDB for a long time, and still do occasionally. Nothing bad to say about it.

However, I find that X-ways' WinHex is even better for recovering file names/structures -- if you've got a big tree to work with, that's a lifesaver versus having to go through hundreds of sequentially-named directories. It's a professional product and they have forensic versions that allow you to preserve evidence chain, e.g. working with a image of the drive, read-only modes, etc.

It's more expensive, but given the time required to do data recovery on a per file basis it's probably still a sound investment.

Re:for fat and ntfs (4, Interesting)

pushf popf (741049) | more than 4 years ago | (#28183055)

I've been doing consulting and software development for around 30 years, and when I was young and dumb, thought I could fix anything. Now I know better and have found that in this situation, the phrase "Wow, that's too bad. Where are your backups?" works nicely.

While there are all sorts of voodoo, data scraping bit-remunging apps available, at the point before you do anything you have no liability. After you "recover" the data, you're on the hook for everything forever.

All you need is for the customer to come back 2 years later and tell you they were sued into the dirt because something they were required to disclose was missing or incorrect and you'll wish you never took the job.

And even if they don't sue, there will be a never-ending stream of phone calls about broken documents, files they can't find and all sorts of other "un-tidyness".

And even if they don't call, there will be eternal uncertainty about the quality of the recovered data. Are their financials correct? What was that number that had the letters nearby really supposed to be?

My favorite drive recovery method is now BackupPC. You set it up, configure it for an appropriate number of incremental backups each day and let it fly. When a drive craps out, replace it, click the appropriate checkbox on the "Restore" page and press the "go" button. No doubt, no lawsuits, no untidyness.

Do-it-yourself Data Recovery is great if you like to putter with things and have lots of time and no liability (employees generally can't be sued by their employer) however when actual money is at stake, it's better to just send the drive out and let someone who is actually equipped and staffed to do the recovery handle the work.

To put things in a different perspective, how happy would you be if the county tried to sell your house for unpaid taxes because billy-bob "who's really good with computers" did their drive recovery and your tax payments were on one of the bad spots?

I tell the tools (5, Insightful)

Anonymous Coward | more than 4 years ago | (#28181793)

That they should have backed up.

Re:I tell the tools (3, Insightful)

Big Hairy Ian (1155547) | more than 4 years ago | (#28182925)

Agreed Although the number of times I've been called in when the back up was cocked because nobody knew what they were doing make me think this is a little harsh. Good lesson here kids just because the tape was in overnight doesn't mean there's anything useful on it.

GetDataBack (5, Informative)

sean_nestor (781844) | more than 4 years ago | (#28181807)

GetDataBack [runtime.org] has worked perfectly for me many times. Very easy interface, works on deleted files as well as formatted disks (provided the data you want to recover hasn't been overwritten, of course). Worth the $79, IMO.

Re:GetDataBack (1)

Alt_Cognito (462081) | more than 4 years ago | (#28181907)

If I had points, I'd mod this up. I've used this as well. It picked up some stuff for me that I had deleted, but I'm not going to complain about "too much" data recovered, and this sort of fits under the "nature of the beast" context.

Saved my bacon.

Re:GetDataBack (0)

Anonymous Coward | more than 4 years ago | (#28182091)

Agree, getdataback its excellent.

Re:GetDataBack (1)

ramblix2006 (996072) | more than 4 years ago | (#28182161)

I completely agree. I have tried many different recovery softwares and I always end up going back to GetDataBack. --Shareef Huddle

Well (4, Informative)

ledow (319597) | more than 4 years ago | (#28181827)

ddrescue

But to be honest, if you've hit that point for an "enthusiast" user, then you're already on your last legs. If you ain't got a backup, forget it - the chances of getting one particular file you've lost might be good, the chances of recovering any significant amounts and being able to verify their integrity are bad.

Plus, with SSD's, flash, memory cards, etc. the chances of being able to recover *anything* from a faulty drive without professional equipment are fast approaching zero. Most USB Flash drives just "die" when they hit their write limits, rather than fail gracefully into read-only mode.

Re:Well (5, Informative)

bonehead (6382) | more than 4 years ago | (#28182157)

Here's one that's saved my butt several times.

Often times when a drive fails it's not the physical mechanism that goes bad, it's something on the circuit board. If you can find an identical drive (should be pretty easy in a corporate environment, could be tricky for a home user), just carefully remove the board from the good drive and install it on the bad one. You'd be surprised how many times that "totally dead" hard drive will start working like new.

The software solutions are great for some situations, but they can't do anything if the drive isn't even visible to them.

None! (2, Informative)

Anonymous Coward | more than 4 years ago | (#28181845)

Real professionals never lose their data.

Re:None! (3, Insightful)

Anonymous Coward | more than 4 years ago | (#28182025)

Real professionals backup their data.

Re:None! (2, Insightful)

tiggertaebo (1480739) | more than 4 years ago | (#28182243)

I'm kinda hoping your trying to be amusing here, if you are though its gone under my humour radar today (and I apologise if I seem like an arse)

Yes most "professionals" will have backups of their data (which is what I presume you are alluding to) however it's not always the case that those backups will be literally up to the minute, and sometimes its just less hassle to recover any lost "recent" data then it is to just cycle to the last backup and deal with the shortfall. Also its not exactly uncommon for "professionals" to be asked to help recover data for NON-professionals.

Re:None! (1, Insightful)

Anonymous Coward | more than 4 years ago | (#28182671)

If you can recover any lost "recent" data in less than 20 minutes, then by all means do it.

Otherwise, tell me which is preferable to management:

1) Spending 20-30 minutes restoring the file from last night's backup
2) Spending 2-3 hours, hacking FAT tables on a PC

Restoring from backup is a known cost (of labor), whereas hacking file tables isn't. Could take hours, during which you are getting less real work done.

Re:None! (1)

Amouth (879122) | more than 4 years ago | (#28182685)

Backups by definition can't be real time - Mirrors can.. but you wouldn't need to recover data if you have a Mirror.

Out side of experienceing unknown failure of a backup you shouldn't be trying to recover anything.

When ever you design your backup strategy you have to define the amount of data that is willing to be lost - then design around that and your budget.

and i don't care what anyone says.. zero loss is never truly achievable.

I Like Knoppix with a Good BIOS (5, Interesting)

eldavojohn (898314) | more than 4 years ago | (#28181849)

I'm not a pro in this department although I've saved a lot of partial data from hard drives for some friends (I'll be very interested in these comments).

I use a live CD of Knoppix which has really good system repair and troubleshooting [wikipedia.org] . I also have another important tool which is an old Dell Intel motherboard that allows me to set the rotational speed of the drive. Example: my friend's laptop is giving him the click of death so I pop out the IDE drive and hook it up to a 2.5" to 3.5" connector and plug it into the motherboard with a working 1TB 3.5" slaved. On boot up, I hit the BIOS and set the speed as low as it can go or low enough like 1,000 RPM. Then I boot into Knoppix live CD and check to see if I can mount the file system. Knoppix seems to be able to mount a lot of partitions that other more stringent flavors of Linux don't. Sometimes it clicks from the get go and there's nothing you can do. But if it doesn't, then I set a script up to copy their most valuable directories first onto the working 1TB drive. I let it run all night or weekend and check the drive periodically for heat problems. People are surprised what you can save for them doing this ... the downside is sometimes I'm surprised in what I save for people--p0rn is not worth my time.

Re:I Like Knoppix with a Good BIOS (0, Offtopic)

Smidge207 (1278042) | more than 4 years ago | (#28182043)

I'm not a pro in this department although I've saved a lot of partial data from hard drives for some friends (I'll be very interested in these comments).

No kidding; I haven't done any math courses and I'm a working programmer. I just code all day retrieving shit from the database through some SELECT shit FROM BigPile and load some crap into the database INSERT INTO BigPile(shit) VALUES('lots of shit'). That seems to do the trick. Obviously this kind of programming is too advanced to my boss, so I'm considered somewhat of an expert in my office, (or I think so anyway...).

Re:I Like Knoppix with a Good BIOS (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#28182917)

I dunno about a lot of the geeks on here, but my personal pr0n collection is definitely the most prized in my drive family :) IMO those once in a lifetime shots you get of your friends drunk at a party, showing off their boobs, so you can tease them for the rest of their lives.. Honestly, is worth backing up more than any work I spent a couple days on, that I personally could easily reproduce.

dd (1)

goombah99 (560566) | more than 4 years ago | (#28182997)

once you have linux up and running the first thing I do is try dd with the "ignore error" setting. this way I cant get a copy of the bad disk onto a good disk. Now I've separated the recovery from corruption from the problems due to intermittency.

Software (0)

Anonymous Coward | more than 4 years ago | (#28181875)

Have had decent results with GetDataBack , R-studio, active@'s software in a few cases

ddrescue is convenient.

Trinity Rescue kit may help you.

I'd get people to make regular backups (force it if i have to) and then restore off the backup though most likely.

R-Studio (5, Informative)

CodyRazor (1108681) | more than 4 years ago | (#28181927)

Back when most data recovery and disk utility applications didnt work on vista (and many still dont) I found one called r-studio. It managed to recover a whole lot of data of a damaged flaky 5TB Raid 5 array, which is pretty impressive considering it was the only application at the time that could even recognize it as a drive, all the others just call it a damaged volume.

As far as I know its still the only one that can do Raids, at least as far as I can find. It also allows many customization options of searches and donest over simplify things too much. It takes forever but it finds any potential damaged file systems and then lets you use whichever one you like to recover whichever files you like. It can also be used to recover deleted files.

As far as I recall its pretty cheap, at least compared to a few out there and worth a try. But with all recovery and security software, I find the information and their website extremely generalized and vague about what exactly you can do, so I always download the software first to make sure it can do what I want, which 90% of the time it cant, and then if it works I buy it. Its not the most legal practice but if they dont offer demos and wont be specific about what their software does its the only practical solution.

Re:R-Studio (1)

mcvickj (544231) | more than 4 years ago | (#28183049)

Another nod to R-Studio. Two weekends ago I plugged in my portable hard drive via eSATA and Vista decided to run a CHKDISK on the drive and it did something to the drive where none of the files were being displayed. I started to really panic because I had almost 400GB of data on this portable drive. After some Google searching I found R-Studio. Ran the scan on the drive in demo mode and it found everything. I paid the $49.99 for the NTFS version and I was able to retrieve all of the data. The price was well worth it IMO.

My .02 (2, Interesting)

NES HQ (1558029) | more than 4 years ago | (#28181977)

Not to be a smartass, but...

For the folks (family and friends) that seem to think I'm a free computer repair store I told them to go buy a cheap USB hard drive and just set up a quick and dirty batch file to back things up nightly (or weekly, depending on how big their files are).

I've told them to do this or there's a good chance that I won't be able to recover their files if their PC crashes. This is an easy solution, cheap, and requires virtually no end-user interaction. That last bit is especially important since I've found that they typically ignore even the easiest backup procedures (e.g. copy C:\My Documents to D:\).

As for the original question, I still do attempt file recovery for the stubborn ones who ignore my backup advice. I've had moderate success with various pieces of software. Just Googled "hard disk recovery software." Interestingly enough, different programs have recovered different data on the same HDDs...

Re:My .02 (1)

bonehead (6382) | more than 4 years ago | (#28182297)

Not to be a smartass, but...

For the folks (family and friends) that seem to think I'm a free computer repair store

I have way too many people like that in my life.

I imagine they all think my talents have been dwindling over the years. These days, more often than not, I just tell them that I wouldn't have the slightest clue what to do about their problem (even if it's an easy one).

When I was young and single, it didn't bother me so much. But now I have a wife and kids that I like to spend my free time with, so I've decided to discourage the behavior by simply being entirely useless anytime anyone calls with a computer problem.

These days you only get my services if you:
1) Live in my house
2) Raised me
3) Sign my paychecks.

Re:My .02 (1)

NES HQ (1558029) | more than 4 years ago | (#28182379)

Hah, I agree completely. I don't mind good friends and close family, but I get irritated when my best friend's wife's sister calls for tech support, when my friend's parents call for tech support, or when the uncle I see once every two years wanted me to completely analyze his website for SEO (not my normal field, BTW).

Anyway, I like your policy.

Re:My .02 (1)

bonehead (6382) | more than 4 years ago | (#28182607)

Oh, I almost forgot the most important policy.

In the rare instances that I do agree to help someone out, NEVER, under any circumstances do I do phone support. I'm not going to spend 10 minutes explaining to someone how to find the information that I need when I could see it in a split second if the computer was in front of me.

If you want me to work on your computer, and by some miracle I agree, then you will drop it off at my house, and I'll get to it at my convenience. It may be awhile. If you need it in the next day or two, try Geek Squad. If you don't mind waiting, I think I have some free time the weekend after next......

Re:My .02 (4, Funny)

Glonoinha (587375) | more than 4 years ago | (#28182843)

Bah - learn to make house calls to fix computers. It gets you laid (as in : having sex with a real woman.)

The trick is, pay attention to the computer for a while (ignoring the woman.) Then set it off doing something that's going to take a half hour or so (defragging the hard drive or backing up to an external) and explain - well, that's going to take an hour ... what can we do that will keep me busy while that thing works? Then the clothes start flying off.

Hey, it could happen!

Re:My .02 (1)

NES HQ (1558029) | more than 4 years ago | (#28182989)

Thank you, this almost made me spit my coffee out! Sounds like the plot of this movie I saw on HBO at 2 AM one ti... ah, nevermind!

Freeware does the job. (2, Informative)

L4t3r4lu5 (1216702) | more than 4 years ago | (#28181983)

Work your way through this [cnet.com] list. Unless you're a corporate entity with a large purse, it's probably going to be a freeware app they use too (unless they have a suite which covers many types of media and file systems). They make money from companies, not end users.

Further Info: I phoned a Tamworth, UK-based company (Google it if you're bothered) regarding recovering a file from a USB drive for a teacher where I tech. They asked what I did so far to recover the file, I said I'd run some freeware recovery tool. They told me that's all they'd do, as they don't make money spending any more than about 5 minutes on it. If that can't find it, and you don't have hundreds / thousands of pounds to spend on engineer time, it's the best you'll get.

Re:Freeware does the job. (2, Informative)

L4t3r4lu5 (1216702) | more than 4 years ago | (#28182079)

Hate to reply to my own comment, but some pointers;
  • Clone disks before you work on them.
  • Never work on the original disk
  • Never boot the original disk. Swapping can overwrite data which has been deleted permenantly.
  • "Deep" scans are a nightmare. Often the names are not restored, you get block-by-block groups of sectors instead of contiguous files, and converting them to any useable data structure is why these recovery firms can charge through the nose.

Pros avoid having to use data recovery tools. (4, Informative)

argent (18001) | more than 4 years ago | (#28182001)

Pros make sure they have good backups. Pros tell their users "nothing on your laptop/desktop is backed up", make that corporate policy, and respond to virus infestations by re-imaging the victim's computers to make sure that everyone's too damn scared of Mordac the Preventer to keep anything on local storage.

Re:Pros avoid having to use data recovery tools. (5, Funny)

jumpingfred (244629) | more than 4 years ago | (#28182281)

No the pro install nightly backup tools on the laptops. At least they do on mine.The backup software then uses heuristic algorithms to start the backups when the laptop is being used for meeting presentations in front of many people.

Re:Pros avoid having to use data recovery tools. (1)

Darkness404 (1287218) | more than 4 years ago | (#28182339)

That works just fine until a computer illiterate employee didn't back up their files, spent weeks making a file, the HD gives the click of death and your boss says how he read about recovering data from a broken HD and if you can't do it he can "find someone else".

Re:Pros avoid having to use data recovery tools. (1)

Lord Ender (156273) | more than 4 years ago | (#28182595)

And middle-management tells pros "we don't have budget for backup systems!"

Re:Pros avoid having to use data recovery tools. (0)

Anonymous Coward | more than 4 years ago | (#28182885)

if you have mission critical data, and do not have a backup system, then you are not a professional organization; you are a mom & pop shop.

just because you earn your paycheck by doing the "IT stuff" for a company does not make you a professional.

Re:Pros avoid having to use data recovery tools. (1)

eth1 (94901) | more than 4 years ago | (#28182947)

Yup... In this case, an ounce of prevention is worth several tons of cure. I was in this situation, and ended up using AD group policy to redirect everyone's My Docs to a server directory that I could back up. Then just make sure everyone knows that *everything* important has to go in there. Fortunately, most stuff defaults to saving there.

It only took one round of "oh no, I accidentally deleted X, and spent HOURS on it!!" "Was it in your My Documents?" "No" "Sorry, can't help." for everyone to get the hint.

Plus it means that any time someone messes up their machine, you can just tell them to get a coffee, and push a fresh image onto it.

Not true... (0)

Anonymous Coward | more than 4 years ago | (#28183139)

I've "accidentally" deleted many files that only had one copy over the years. If you are talking about recovering only a few specific accidentally delelted files, then the best tool is Restoration [cnet.com] . It's free too. Enjoy. (As for "disaster recovery," unless you are making regular backups or willing to spend lotsa $$ for a professional clean room recovery, FORGET IT.)

dd (5, Informative)

locofungus (179280) | more than 4 years ago | (#28182015)

dd if=/dev/sdb of=dump.img bs=512 conv=noerror,sync iflag=direct

Once a drive has started failing the first thing you want to do is get as good a copy of everything as you can manage. If it's a physical problem, especially if it's a damaged platter, then it tends to get worse as the drive is used. Get everything off and then work on the copy.

Tim.

Re:dd (3, Interesting)

greed (112493) | more than 4 years ago | (#28182949)

On the other hand, if it's a thermal problem, you may have to rescue in "chunks". I had a disk go that could only be used for about 10 minutes before it got too warm and shut down.

On the third hand, you may have something that looks like physical damage, but when you wipe the disk with zeros to confirm the fault and get ready for RMA-time, it all magically comes back. That's a sign you got corrupted data on the disk that the ECC couldn't deal with. (And probably that you've got a drive with questionable firmware, and is reporting the wrong kind of error: Fujitsu, I'm looking at you. Especially for not recording anything in the SMART counters.)

TRK - dd/dd_rescue/ddrescue, Restorer (5, Informative)

millisa (151093) | more than 4 years ago | (#28182017)

My favorite tools are a combination of the Trinity Rescue Kit linux boot cd and the Restorer [restorer-ultimate.com] tool.

It depends on the type of failure, but generally, I start with a ddrescue [gnu.org] to get an image of the drive, especially if the drive is running bad sectors. Either I set the image to go to a secondary spare drive or I push it across the network. ddrescue is nice in that it doesn't bail when it hits those bad sectors, can run in reverse mode, and eventually it'll get as much as isn't corrupt on the drive into the image.

After establishing the image, the original failed drives go into ESD bags and aren't touched again unless they are to get shipped to one of the expensive clean room type places for their style recovery.

Most of the win32 drive recovery softwares out there can handle reading from an image file, so from here on out, I work with the images I took with ddrescue. Restorer has worked pretty well for me on getting things back from hard drives, CF cards, and even raid sets (figuring out the cluster sizes on the raid can be a pain if you don't happen to know them, but the software does support reassembling raid drives from the images you take of the single drives).

Most of the win32 packages out there have support for making the original images, but I haven't had as much luck with most of them when dealing with severely corrupted drives or with a large scattering of bad sectors. Either they take far too long to make it through the image or they end up failing to get by the bad sectors.

Regardless of what you end up picking, you don't want to use any of the recovery tools that advertise how they can fix the partition table and such on the drive, live . . . any recovery operation that thinks it is ok to 'fix' a drive with data on it you want to recover has the wrong mindset. The data is important, not making the drive work again.

Re:TRK - dd/dd_rescue/ddrescue, Restorer (0)

Anonymous Coward | more than 4 years ago | (#28182407)

I also use ddrescue and the Rescue Kit. I have added Adroit Photo Recovery [digital-assembly.com] to recover fragmented photos from the disk images or memory cards.

foremost (0)

Anonymous Coward | more than 4 years ago | (#28182021)

check out open source tools for 'file carving' like foremost
https://wiki.remote-exploit.org/backtrack/wiki/Foremost

its open source and avail on backtrack live-cd's

Great little tool (0)

Anonymous Coward | more than 4 years ago | (#28182031)

This tool has saved me many times from various issues when it comes to Windows.

http://www.ntfs.com/boot-disk.htm

EASEUS Disk Copy (2, Informative)

dinkdinkdink (920721) | more than 4 years ago | (#28182051)

I have had success with the *free* EASEUS Disk Copy boot CD - http://www.easeus.com/download.htm [easeus.com] [easeus.com]. It will perform a bit for bit copy from the defective drive to a new organ-doner drive. I believe you have the option to continue the copy, even on erroneous sectors. On a recent drive in the early stages of failing, I was able to recover the entire disk after I did the bit-for-bit copy and then performed a error check/fix on boot-up. The standard Windows XP error check tool corrected all of the previously mangled bits.

its the mechanical failures (2)

circletimessquare (444983) | more than 4 years ago | (#28182061)

that keep the expensive guys in business

if all data loss were just a matter of awesome software, then wonderful. but frequently you are dealing with mechanical failures like the write head crashing onto the platters, death of the controller, failing motor, etc.

no software is going to fix these things. then its to the $100/hr guys in the clean room

Free Software always has a warm spot in my heart! (0)

Anonymous Coward | more than 4 years ago | (#28182069)

Boot up your favorite LiveCD and have a spare hard drive handy

dd if=/dev/hda of=/dev/hdb conv=noerror,sync

Of course, hda and hdb may vary depending on what you've got under the hood.
When all is said and done, your spare hard drive is a great replacement.

Pros restore from backup. (0)

Anonymous Coward | more than 4 years ago | (#28182103)

See subject line.

Data recovery for pros (0)

Anonymous Coward | more than 4 years ago | (#28182121)

Leather straps, thumbscrews, jumper cables... there's plenty.

Spinrite works miracles (4, Informative)

stenchcow (1554779) | more than 4 years ago | (#28182129)

Spinrite [grc.com] has worked miracles in the past for me. It's brought back unbootable corrupted windows partitions back to life for me. Supposedly it also fixes physical defects in hard drives as well. It boots off of a image from disc. It costs $89.00 but it's saved my butt in the past.

Re:Spinrite works miracles (0)

Anonymous Coward | more than 4 years ago | (#28182587)

As much as it sounds like snake oil (software that fixes physical defects? wtf?) I have also found it to be good at getting data back from drives that are starting to develop bad sectors.

Re:Spinrite works miracles (3, Informative)

Glonoinha (587375) | more than 4 years ago | (#28182887)

I was using Spinright back in the 90's - it was awesome then, but I wasn't aware they are still around.

I endorse the package from the 90s and if it is the same guys I'm tempted to endorse them today.

Re:Spinrite works miracles (1, Informative)

Anonymous Coward | more than 4 years ago | (#28183169)

I can agree with endorsing SpinRite. It is currently in version 6, and development on it continues. I've used it to restore raid arrays, desktop and laptop drives, and every time it has worked well enough to get the drive working to have the data moved off of it.

Best $89 tool I've purchased in a long time.

Also, for uber-critical backup data, always throw in some PARity recovery data, as an added layer of recovery security. I've had PAR files save my ass from damaged optical backups.

Re:Spinrite works miracles (4, Informative)

NetRanger (5584) | more than 4 years ago | (#28183041)

Same here. At $89, SpinRite is a bit on the pricey side, but I have recovered data from hard drives that I thought I had zero chance of saving. I figure since it saved hundreds of dollars in labor -- several times -- it was worth every penny. Especially in those circumstances where your highly paid datacenter techs thought it was a great idea to construct a RAID 5 from all identical hard drives from the exact same manufacturer lot. Sucks when two of those drives experience the exact same fault within a few minutes of each other. Fortunately I was able to whip out SpinRite and save the day, because otherwise we were looking at days and days of restoring from incremental backup tapes.

It's an ancient-looking DOS command-line utility, but I definitely give props to Steve Gibson for keeping SpinRite up to date to where it works on modern hard drives. $89 versus days and days of overtime pay for IT guys -- it certainly made me look pretty good come performance review time.

Re:Spinrite works miracles (0)

Anonymous Coward | more than 4 years ago | (#28183207)

SpinRite definitely works wonders. I've had recover data for myself, friends and family many times over. Well worth the money.

RStudio (1)

horatio (127595) | more than 4 years ago | (#28182137)

I used to use Norton Tools, until it was bastardized by Symantec. I have had good luck in the last couple of years with RStudio (http://www.r-tt.com/). I used it to recover the pictures from a wiped SD card. I wish I hadn't once I saw the photos, but that isn't the software's fault. Looks like there is a free version for use on ext2/ext3 filesystems.

Confused by the question (0)

Anonymous Coward | more than 4 years ago | (#28182217)

s/the pros/you guys/

There are no recovery pros in local IT groups.

I'm hardcore though... (0)

Anonymous Coward | more than 4 years ago | (#28182227)

Notepad ;-)

Midnight... (1)

AioKits (1235070) | more than 4 years ago | (#28182239)

Black jump suit, glass cutter, crowbar, can of black spray paint, butterfly knife, pack of smokes, maybe a giant burlap sack with a green $$$ printed on the side because if it said 'data' it might look suspicious...

TestDisk (1)

sirsky (53613) | more than 4 years ago | (#28182253)

No one has mentioned TestDisk yet??

http://www.cgsecurity.org/wiki/TestDisk [cgsecurity.org]

I've used this plenty of times, restoring 'blank' hard drives (especially USB drives who's partition tables were corrupted) and file recovery works great with NTFS, as well as most other filesystem types...

Re:TestDisk (1)

Mysticalfruit (533341) | more than 4 years ago | (#28183079)

I've used testdisk more times than I can count. I've also used photorec on numerous devices large and small.

Ironically, we haven't had much luck with the commercial stuff.

We've also got a silly python script that will run the "file" command on each file and sort them into the appropriate piles.

One time I used Me (2, Informative)

TinBromide (921574) | more than 4 years ago | (#28182335)

I had a drive where the file system was shredded, so I loaded the drive into FTK Imager (its free, about halway down the page) [accessdata.com] , did a search of the raw space of the drive for the file name I needed, found the relevant $i30 reference (its in there), [scribd.com] jumped to the relevant sectors on the disk using ftk imager's goto command , carved out the hex with ftk imager's copy hex command, dumped it into a hex editor, and saved the file under the extension. It worked perfectly.

Uphill, both ways, in the snow.

This is the ultimate last resort if you absolutely, have to, get a file back.

EnCase (1)

shadowknot (853491) | more than 4 years ago | (#28182371)

Although it is primarily used as a forensic analysis tool Guidance Software's EnCase [guidancesoftware.com] is excellent for data recovery and there is extensive support for many filesystems and operating systems. It's darn expensive but if you are really looking to get data back on a large scale then the long-term investment may be worth it.

dd, testdisk, foremost (1)

mpapet (761907) | more than 4 years ago | (#28182451)

The chain of tools I used barely a month ago goes like this.

1. dd to get whatever can be had off the hardware and into a disk image.
2. testdisk recovers partition information to make the images mount-able.
3. foremost to recover files. Pay attention to the conf file. There are *lots* of options that will discover all kinds of files in various condition.

As someone who just went through this with my laptop, the last two things to remember:
-You will need tons of disk space to work with the disk images and all of the files foremost recovers.
-check your backup files very, very often. Bacula worked beautifully, but somehow the tar archives it created were corrupt.

Cannot beat RAID (1)

beodd (16440) | more than 4 years ago | (#28182561)

When worst comes to worst there is nothing better than having a RAID. I personally run a RAID5 at home but drives are cheap enough that is should be easy to set up a mirror on any workstation. Most motherboards these days support mirroring strait from the bios but even if it does not windows will do it in the OS as well. It is also my understanding that Linux supports all raid levels in software.
Now days it is also common place to see laptops with room for multiple drives. There is no reason at all to not have some sort of raid these days, especially if there is critical data on the drive.
As for OS corruption a raid will not prevent this but there are built in services for configuration "restore" points as well as drive snapshots that will be able to restore a system to a functional state from a "Safe Boot". There really is no reason to use any special software to "Recover" a system if it is configured in a manner that is redundant and secure.

Joshua

Re:Cannot beat RAID (3, Informative)

DigiShaman (671371) | more than 4 years ago | (#28182769)

I agree, these days every home PC should be setup for RAID1 (RAID5 for workstations). However, RAID should *never* be a substitute for making backups to external media.

Re:Cannot beat RAID (1)

Glonoinha (587375) | more than 4 years ago | (#28182921)

Backup is better than RAID.
Also - RAID 5 is great if you smoke a drive. What happens if you smoke your RAID controller? I've seen it happen.

Re:Cannot beat RAID (2, Interesting)

beodd (16440) | more than 4 years ago | (#28183147)

I agree, RAID is not perfect but as for restoring data from a failed drive via some sort of recovery software will be useless in the case of multiple failures.
I work on large SAN/NAS arrays and there is never any full proof way of getting data back. Even if the OS is backed up to tape there is always the chance that the parity will fail, exc.. Most raid controllers are capable of detecting existing RAID configurations so replacing a card should no be that big of a deal. I will give you that it is never full proof and I have even seen data loss on a raid from swapping controllers.
The most awesome safest configuration I have ever seen was a SAN with dual channel drives connected to dull array controllers in a MESH SAN network. The SAN hardware is capable of dynamic RAID 50 with global hot spares. Then on top of all that the entire configuration was mirrored off-site via dark fibre then weekly full backups and daily incremental backups. Oh, and each workstation was connected to the MESH with 4 fibre controllers. There was no single point of failure in this configuration. Was a honor to work on that array.

Re:Cannot beat RAID (2, Interesting)

beodd (16440) | more than 4 years ago | (#28183311)

Oh, I forgot, It also had scheduled snapshots on the LUN so it could be recovered to any point at any time.. Was such a beautiful thing..

Depends (2, Informative)

Sycraft-fu (314770) | more than 4 years ago | (#28182563)

We usually start off with a bootable XP CD. Often there isn't anything really that messed up, and you can read the data that way with no problems. There are a couple of free programs, the names of which I can't remember off the top of my head, that do a fine job for "undeleting" files.

If it won't read in that, the next step is usually Knoppix. You can tell it to force mount a bad partition. Now that is a mixed blessing since sometimes the data you'll get is garbled which is why you try something else first. However, barring any serious problems, it'll usually mount and read.

If both of those have problems, the next set it the tools from the drive manufacturer to check for physical problems. You set those to do a full scan. At this point, there are three possible results:

1) It runs to completion, no errors. Means the physical disk is fine, it is all a logical data problem. Now go back to bootable Windows and run a checkdisk. Reason we didn't do this earlier is the moving of data checkdisk does can screw things up worse if there are physical problems.

2) It runs to completion, errors found and corrected. Back to Windows or if that doesn't work Knoppix to try and read the disk again. Usually it'll read, checkdisk it if not.

3) It errors out and gives a a diagnostic code meaning serious, unrecoverable errors. We are now at another juncture:

a) The data is really important. At this point, time to send it off to a specialist. Gillware.com is who I like. Pack it up and mail it off, you probably get your data back along with a bill for $300.

b) The data isn't critical, but we'd like to recover it. Run what I call "the magic disk destroyer." It's a program called Spinrite. It is a VERY aggressive recovery program. Because of that it is either going to get the disk readable, or fuck it up so bad nobody will be able to. Hence my nick name for it. Put the disk somewhere that you can have a fan blow on it, fire up Spinrite, and let it go for a day or two. See what happens.

Add one vote for Handy Recovery (1)

eyal0 (912653) | more than 4 years ago | (#28182615)

Two years ago one of my hard drives started making strange noises like a grinding motor. When trying to read some of the bits on the disk, the hard drive would fail for a minute or two before giving up.

I used Handy Recovery. It scans the drive and gives a file explorer similar to the one in WindowsXP. Recovery is easy. I've also been able to recover files from an old file system even after formating a disk and putting files on the new filesystem.

I realize that many tools exist. Are most able to recover files from disks with PHYSICAL malfunctions? That seems important.

A collection of small apps... (2, Informative)

xtracto (837672) | more than 4 years ago | (#28182659)

I agree with others about GetDataBack... it indeed is a good app.

Sometimes however, people have come to me with a hard drive with a FOUND.000 directory full (sometimes about 10GB) of CHK files... for that I recommend:

http://www.ericphelps.com/uncheck/ [ericphelps.com]

It is free and does a good job recognizing the supported files

Also, it is worth getting something like mplayer or VLC and try to manually open the biggest CHK files to see if they are some kind of media file.

Additionally, a Hex editor like xvi32 can be helpful to give a fast glance at the header of the file and see what is it... maybe reading the folder with a Linux distribution (which gets the description of the file based on the content rather than the extension) could also help... but for other more obscure things, a hex editor is good (of course you need to be familiar with several headers... yay I feel 1337!)

dd, file scavenger (1)

LoRdTAW (99712) | more than 4 years ago | (#28182745)

I have used file scavenger (windows) with great success. File scavenger has restored files from disks that were unreadable or disks that come up as un-formatted. Even if you accidentally reformat the disk and write some data to it file scavenger will find what ever has not yet been corrupted and copy it to where ever you want it to go. Files that cant be recovered are still written to the backup disk but are given a zero byte size. You can then search for zero byte files and see what was unable to be recovered. Also files that are found but cannot be identified are copied to a "lost and found" folder. These might have been deleted files or partially overwritten files. Its pretty cheap too, about $35 USD.

The other day I recovered a friends 160GB USB disk (formatted NTFS) using file scavenger after it suddenly came up as unformatted. Every file was restored since the disk had not been tampered with. I then zeroed out the disk using dd under Linux and ran badblocks to see if there were any bad sectors. None were found and I formatted the disk, copied the data back to it and returned it to him. I also keept a backup on my system for him.

Under Linux I have used dd to grab an entire disk structure from a dying disk (clicking but working) to a server. Then restore the dd image to a new hard disk. I have yet to need to recover any lost data from a Linux system but I hear TestDisk is one of the best. It can locate lost super blocks and undelete files from NTFS, FAT and EXT2. R-linux is also good for ext2/3 recovery.

Pros before Hos... (5, Insightful)

DarthVain (724186) | more than 4 years ago | (#28182821)

If your a Pro you back up all your important data anyway, so it is a moot point. Likely you even have some remote back up. There are services out there. Use Google, it ain't hard. In a pinch you can just email yourself some attachments in Gmail. Not good for media files or anything large, but if you want to save some key documents or your tax returns etc... Privacy may be an issue, but if your really prickly about that, then just encrypt it (though make sure you can decrypt easily later).

If it is a friend or family member who has just lost everything: Look very superior, point at them, remind them they should have backed up, and how stupid it is not to do so, then laugh at them for a while. Once your eyes clear of tears, repeat. After 4 or 5 times maybe it might sink in, and you will have done them a great service. Send them a bill in the mail.

Harsh I know, but come on, this has been cannon for years, get with the program.

Honestly though most people's computers are totally full of crap. There are some things like Personal files, Photos, and the like that are irreplaceable, but most stuff is just media you can replace, or software you can replace, etc... and if it is important to you, then back it up for god sakes.

Seriously, if you save their data you are just re-enforcing and rewarding bad behavior.

What Data Recovery Tools Do the Pros Use? (0)

Anonymous Coward | more than 4 years ago | (#28182955)

On our "recovery shop" we use a microscope, a piece of paper and pencil.

Our 2000 monkeys^W recovery experts guarantee your data wil be recovered in 1 month, no mather the size of your drive :)

SpinRite 6.0 (1, Informative)

Anonymous Coward | more than 4 years ago | (#28183017)

SpinRite 6.0 has worked for me very well for many years now. It's slow, and has very very entertaining graphics. Under 2MB ISO.

simple.. but not free. (2, Informative)

Piffer76 (1042180) | more than 4 years ago | (#28183127)

In the past I've used SpinRite to check the disk for errors, and it's been a life saver twice. But in the case where there's nothing wrong with the physical drive, which is probably the case most of the time, I've had great success with R-Studio. My 2 cents. -P
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...