DIY Data Recovery from unknown disk … (2)

This article is a continuation of the article ‘Data Recovery from unknown disk‘ in which I examine a corrupt hard disk and try to find out what various DIY Data Recovery tools can recover from the disk.

Last updated: 19 Oct 2016 – MiniTool Power Data Recovery

In queue are:

In short: The disk appears to be empty. As soon as Windows sees the disk it prompts me initialize the disk. Disk Management only shows the disk as unallocated space.

So, what’s on the disk and what do I expect the software to find?

The disk was the hard disk in a Dell PC and it came pre-installed with Windows XP. Apart from the NTFS XP partition it contained a Dell Utility partition.

I will need to investigate further, but is clear that the partition table is destroyed. Also partition detection routines of various partition recovery utilities fail to detect the NTFS partition.

Partition detection routines of partition recovery and data recovery software are fairly simple: They limit themselves to detecting boot sectors. Boot sectors are easy to spot and information about the partition’s file system can be found in this sector. The software can determine the file system (FAT, NTFS etc.), the position of the volume on the disk, and it’s size.

As all partition scan, find partition tools and routines of tested software fails, it is safe to assume that the NTFS boot sector is nor recognizable as such. In other words, it is not there, or it is corrupt.

Edit: I have looked at the disk using a disk viewer, report is here

As the contents of the Dell Recovery partition is of no interest, I expect the DIY Data Recovery software that’s being tested to detect the NTFS file system and to present a rebuild directory tree. So I want to be able to see a programs folder, a Windows folder etc. in other words I want to directory structure as you’d expect it on a Windows drive.

What I don’t accept as a satisfactory result is a ‘directory’ tree where files with generic names (example ‘file0967.JPG’) are sorted by type in a tree structure (so called RAW File Recovery or File Carving).

HData Recovery Software – FAIL

Since HDataRecovery does not allow me to specify to search a specific area on the disk (where the NTFS drive is located) or the entire disk, and nor does it allow me to set a file system parameter set, I have no other option than to use the partition recovery option. It fails to detect the partition.

My verdict: Skip this software, it is a waste of time.

Data Rescue PC3 – Oh my gully, FAIL!

Prosoft Engineering used to produce such wonderful, DIY Data Recovery and even professional grade (Media Tools) Data Recovery Software so my expectations are high. But their current software fails to deliver what I expect of it: Get me a directory tree of the lost and damaged NTFS partition from which I can select and recover folders containing user data.

I have two options: Scan the disk for missing partitions, which fails to detect the NTFS partition.

The second option is to scan the entire disk which is in essence no more that a file carving or RAW file recovery option. In other words: Fail.

Ontrack EasyRecovery Home

Ontrack EasyRecovery software is one of the longest living DIY Data Recovery utilities around. The initial version was called Tiramisu (like the desert) and was originally not developed by Ontrack.

Is running now … Failed to detect partition, seems to be doing a RAW scan now. No progress status and interface became non responsive … doesn’t look so good … Will update when it’s done.

Ok, while I was initially afraid while using Ontrack’s EasyRecovery that I could add another ‘fail’ to the list, the end result proves me wrong. So, what was it that made me afraid? The software asked me to select a Media Type, eg. hard disk, memory card, RAID system, etc.. I then had to select a volume, I selected the volume-less disk and clicked Next at which point a ‘Recovery Scenario’ had to be selected. Search Lost Volumes was selected which eventually resulted a lot of potential volumes, but not the lost NTFS partition.

Aside: The huge list of volumes detected by the partition scan illustrates the point I made earlier on Partition Recovery Software. It obviously scanned for boot sectors, and even boot sectors for many diskette image files (for DOS boot disks) I kept on the hard disk were detected.

In the next screen however EasyRecovery allowed me to scan the entire physical disk, so it has a second chance to discover the NTFS file system.

One point to note is that the scan does not display progress, it simply asks the user to wait until the scan finishes. The user interface also became somewhat unresponsive during the scan, I was unable to move it. It somehow also prevented me from taking a screenshot (ALT+PRT SCRN) simply didn’t do anything. During the scan, it did show it was building a file recovery tree that suggested the software dong a RAW scan (while I remembered disabling that option earlier) as it was creating folders titled ‘Audio’, ‘Archives’, ‘applications’ etc. which is rather typical for RAW file recovery software.

So, how did it do?

After the scan had finished I browsed the folder tree the software created and to my delight I discovered ‘orphaned’ folders which were assigned block numbers. This suggests the software detected files using file system structures, and it did.

Too much data?!

More so, I discovered folders which had names assigned like ‘NTFS BS at block …’! It now did discover NTFS boot sectors! And I found a partial NTFS file system and folder tree when I expanded the folder! Not all folders as they were found by iRecover were there, but many of them at least.

Others I found back after some searching in the various ‘Block …’ entries. So, original folder contents were recoverable with file names intact. EasyRecovery suffers somewhat from the ‘disease’ we saw with Easeus Data Recovery Wizard earlier, which also presented an overload of data for the user to sort out. This could point to a weakness to some degree in combining and connecting the various file system components detected by the software. So rather than connecting a folder to the file system Root, it creates a folder that’s not connected to the Root but to a block number in which the file system structures were found.

All in all, Ontrack EasyRecovery performed better than most software tested up to this point, still both the process and the recovery results are more complex than it was using DIY DataRecovery iRecover (see first part of this Data Recovery Software test).

MiniTool Power Data Recovery

Looks like we’ve got another good one here. I am still running the Lost Partition Scan option, but the scan progres window looks quite promising: It is not just looking for partition boot sectors, but for a wider range of file system structures such as NTFS File records. Which already reveals a more intelligent approach than some of the others.

Yes, nicely done Power Data Recovery. It shows me the NTFS partition although it has reduced the size to 74 GB. If I open the volume it shows me the directory tree as it should.

TenorShare Any Data Recovery Free Any Data Recovery: FAIL

The free version is just bait. I see it being spammed all over the place, but it is basically nothing more than an undeleter, not serious data recovery software. I’ll try the ‘Pro’ version.

Install, and run. Nothing. Well, it is somewhere, but it is not usable:

Danger, Will Robinson! As long as you do not uninstall Tenorshare, above service starts automatically, each time you start Windows. Why on earth would a data recovery tool need to do that?! I don’t like it one bit, don’t know about you. If I were you, I wouldn’t install it in the first place.

Coolmuster Data Recovery

Another that gets spammed a lot on quora.com for example.

I select Partition Recovery (I tried the other options as well, don’t worry) as the descriptions says it is for lost partitions. I click Next.

Then I get to a screen where there is nothing I can do to select the physical disk containing the lost partition. It wants me to select a volume. My volume is deleted, that’s the whole point. I can not select PhysicalDrive1 and continue.

Ok. Next.

Asoftech Data Recovery

This is another Quora.com spammer. In case you are wondering why I test this one. As soon as I start the program it closes with the message that I need admin rights. I need to right click and run as administrator. This is so 1999. Programmer apparently never heard of manifests that can be used to automatically prompt the user for admin rights. But ok, I can live with that. No biggy.

The manufacturer of this software wants $39.95 for this software. Which IMO is criminal.

As you can obviously tell by looking at the screenshot I will not be able to recover lost partitions from the physical disk 1. But I decide to run it anyway.

After a while I decide that it is probably done. There no status report in any form, nor did it tell me that it has finished scanning. But the hard disk is quiet. And CPU usage for ‘Data Recovery Tool’ is 0% most of the time.

And the results are ….

Asoftech shows me some thumbnails I guess. They are so small I can not view them. The second half of the screen shows me about 50 files. For comparison I run DiskTuna Deleted File recovery.

I think Asoftech asking $39.95 for this tool is nothing less than a rip-off.

Continued in Part III …