Data Recovery from unknown disk …

Data Recovery Software reviewed: iRecover, Recover My Files, Data Recovery Wizard and Wondershare Data Recovery.

So … Found one of my old hard disks today and decided to see what’s on it. It appears empty. As soon as Windows sees the disk it prompts me initialize the disk. Disk Management shows the disk as unallocated.

A closer examination of the disk using a disk editor.

Also:

Part II of this test
Part III of this test

But I am curious, and there must be something on there. So it is time for data recovery, I decide to run iRecover. iRecover detects 2 partitions, one FAT and a NTFS drive. I have no idea what happened to this disk in the past, it appears to be a system disk I used in a Dell laptop I no longer own.

So, what’s on the disk and what do I expect the software to find?

The disk was the hard disk in a Dell PC and it came pre-installed with Windows XP. Apart from the NTFS XP partition it contained a Dell Utility partition.

I will need to investigate further, but is clear that the partition table is destroyed. Also partition detection routines of various partition recovery utilities fail to detect the NTFS partition.

Partition detection routines of partition recovery and data recovery software are fairly simple: They limit themselves to detecting boot sectors. Boot sectors are easy to spot and information about the partition’s file system can be found in this sector. The software can determine the file system (FAT, NTFS etc.), the position of the volume on the disk, and it’s size.

As all partition scan, find partition tools and routines of tested software fails, it is safe to assume that the NTFS boot sector is not recognizable as such. In other words, it is not there, or it is corrupt.

Edit: I have looked at the disk using a disk viewer, report is here.

As the contents of the Dell Recovery partition is of no interest, I expect the software that’s being tested to detect the NTFS file system and to present a rebuild directory tree.

DIY DataRecovery iRecover, the benchmark

iRecover (see http://www.diydatarecovery.nl) finds about 250K of files. I select and restore about 10000 of them, a folder of Delphi source code. About half the projects open and compile, the other half shows various degrees of corruption. Now corruption can be actual corruption or it can be due to iRecover making mistakes. The first run with iRecover I didn’t give the program any hints, I just ran against the entire physical disk. But also with hints (position of the NTFS partition, file system NTFS, clustersize 4 KB) results are identical. It appears from the file and folder dates it’s a project I worked on in 2011.

Recover My Files, nope …

To judge the recovery quality of iRecover one of the data recovery tools I have installed is used: Recover My Files from GetData. The option “Recover Drive” is selected, the entire 74 GB or so disk is scanned and this is the result:

It appears only to detect the FAT partition. I try to discover settings where I can limit the area to scan (so I can limit it to the area behind the FAT partition, so it can pick up the NTFS file system, but can not find such a setting. I can not discover a lost partition search either. I can set file systems the software can look for, and I disable all except NTFS. Result is exactly the same, and even now it detects and displays the FAT16 partition.

Sounds harsh, but ‘Recover My Files’ appears to be useless in a somewhat more complex scenario.

Easeus Data Recovery Wizard. Too much information.

Next up, Easeus Data Recovery Wizard. More is better? Ehm, well … No.

First observation: Takes a huge amount of time to scan about 80 GB, I let it scan the entire disk again, just like with the other data recovery software. Data Recovery Wizard appears to be doing a file system scan, but also a RAW file scan.  And the latter I can’t seem to disable. Which I feel, sucks. I am okay with default settings for less experienced users, but as an experienced user I want to be able to tweak settings.

RAW scans tend to come up with loads of false positives (read: corrupt files) which pollute the recovered directory tree. RAW recovery is a last resort IMO, only to be used when a file system scan does not yield results.

All this shows when Data recovery Wizard shows it’s results: A whopping 543339 files are detected! So I spent the next 10 minutes trying to make sense of the results. The initial directory tree shows 5 drives or items: 2 lost NTFS partitions (no sizes given), one lost FAT16 partition, ‘Special Lost Files’ and ‘More Lost Files’. The last two, I assume are based on RAW scans. Randomly clicking about 100 of the generically named files, another drawback of RAW recovery, roughly 9 out of 10 turns out to be corrupt.

Random clicks on files in one of the 2 NTFS partitions only results in corrupt files. Many files can not be previewed at all and I wonder why: You should be able to display a hex dump for any file in your list. For some files the preview works, for others it doesn’t. The second NTFS partition appears to list the same folders and files. From both NTFS partitions I recover the same couple of 1000 files (same as I did using iRecover). For NTFS 1 all files are corrupt: Image files can not be opened and EXEs do not run. NTFS partition number 2 yields better results. The Delphi source code I open in the IDE compiles and runs (like it did with iRecover).

Data recovery Wizard passes the test, but …

Long story short: At first glance, 500K+ files seems impressive. The huge number of files can however be explained by the fact that:

1. ‘Data Recovery Wizard’ does a RAW scan by default that can’t be disabled (at least, I couldn’t find this option). As I mentioned before, a RAW scan is a last resort in my opinion as there are several drawbacks: RAW scans tend to deliver loads of corrupt files, plus files detected by RAW scans are recovered without the original file name.
2. It appears the software was unable to detect a single correct file system parameter set (eg. file system type, file system start, clustersize, that sort of thing), so instead of one NTFS file system, it displays 2.

As a result, the user has to wade through an ocean of files to locate the ones that can actually be recovered intact, which I consider undesirable. Assuming a couple of 100K files are actually present, there should be enough data for the software to determine an exact file system parameter set and there should be no need to present 2 file systems of which one is completely corrupt. In this case, less if more!

Wondershare Data Recovery. Does not cut it.

Wondershare Data recovery … Useless in this scenario, absolutely useless. Wondershare first wants to find the partition and starts the partition scan window. Tried the default quick scan, and ran again with that disabled, but no joy. Maybe a good enough tool to recover data from a formatted drive, but for the money you can get better.

To be continued ….