My r/datarecovery subreddit FAQ

By | April 7, 2020

For over 20 years I have been developing, been involved in development of and supporting data and file recovery software. Some very specific incidents sparked my interest in data recovery and then I wanted to find out how data was stored and lost on and from hard drives. The first tools I wrote were DOS tools and could do stuff like rebuilding partition tables and boot sectors. Today I am still as fascinated by this topic as I was over 20 years ago.

I dedicate some of my time helping people with data loss related issues in public forums such as Quora and Reddit. I see a lot of the same question being asked and the same mistakes being made over and over.  One of the central issues is, which data recovery software to use and data recovery software fails to recover my data. This post can be regarded as my FAQ for the r/datarecovery Reddit sub. I am creating this so I can link to it or copy/paste from it.

Unlike 20 years ago, today people have a lot (too many?) options to chose from, there are literally thousands of file recovery tools, all claiming to be unique and the best. Personally I am convinced that about 90% of those are not worth your time and money. The software I recommend in this FAQ are tools that are commonly used by professional data recovery techs to recover data from logical issues. Their Tech and Pro editions are used daily to deliver commercial data recovery services. Based on these daily and real world data recovery cases these tools are constantly improved.

This FAQ is a work in progress.

Disclosure: Some, but not all, of the below links are affiliate links. This means that if decide to purchase a product linked to, I will receive a small commission. The order in which I list the tools is random. So IOW the top one is not the one I regard ‘best’ or highest recommended.

Can I recover my data?

In general you can only recover data yourself if the drive is functioning without error. If you have reason to believe the drive may be physically damaged (because it was dropped, or fluid spilled over it, power surge, or it makes unusual noises etc.) it is advised you do not power up the drive even.

In general IF data recovery is possible this is due to the fact that the data (files) is not really deleted. However due to file system corruption or intentional actions (file deleting, formatting) pointers, meta data pointing to your files, are removed.

Often the data and even a good portion of this meta data is still available. File recovery software can scan the drive for this meta data and attempt to reconstruct the file system.

Even if all meta data is lost some data may still be recoverable, but information normally stored in the file system such as filenames and the directory structure can not be recovered.

Many of the available file recovery tools can do both.

SSD Warning: Consider that if you’re using an internal SSD and a modern OS, apart from ‘pseudo’ deleting files by modifying file system meta data, the OS also sends a TRIM command to the drive. In practice this means the data is truly deleted. In general assume that if you delete data or format a drive on an SSD, the data can not be recovered.

The r/datarecovery sub links to a very useful data recovery flowchart.

Create a clone or disk image

Before even attempting to recover any files, a data recovery professional will always first create a sector-by-sector copy of the patient drive. It is good practice that you do this too. The SubReddit links to a guide for using ddrescue.

Recommended data recovery tools

Consider that a drive may fail at any time during DIY recovery attempts! If the data is worth more than say $300 don’t take any chances. A professional data recovery lab with experienced technicians and professional equipment is by far your best option.

TL;DR IMO Reclaime is by far easiest to use. DMDE is most inexpensive but can be overwhelming if new to this. This is my personal opinion.

[Mac/Win/Lin] are possible host OS-es. Most of these tools support Mac, Windows and Linux file systems regardless the OS they’re operated from. Support file systems {FAT|NTFS}. Visit manufacturer website for full specs because I don’t list all supported file systems. FAT means all variants of FAT file system, EXT means all EXT versions.

These tools are capable of creating and processing sector-by-sector disk images. It is always recommend to create a clone or disk image. Ideally the drive you need to image is attached via SATA (NOT USB). If a disk is ill behaving due to for example many bad sectors it is recommended to use a tool like ddrescue or HDDSuperClone to clone the disk.

These tools (apart from GetDataBack) support multi-disk sets or RAIDs. You need to follow the appropriate procedures. Scanning separate member disks is of no use.

R-Studiowww.r-tt.com. Used by many pros for logical data recovery. Moderately difficult to use. [Mac/Win/Lin]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT}

GetDataBackwww.runtime.org. For some issues and file systems the goto tool for quite a few data recovery pros. Moderately difficult to use. [Win]{FAT|NTFS|HFS+|APFS|EXT}

UFS Explorerwww.ufsexplorer.com. Goto tool for many pros. Moderately difficult to use. [Win]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT|BTFRS|XFS}

DMDEwww.dmde.com. Another favorite for some pros. If you’re new to this, this tool can be quite overwhelming. Be warned that this tool can write to patient drive. [Mac/Win/Lin]{FAT|NTFS|HFS|HFS+|APFS|EXT}

FileScavengerwww.quetek.com. Not mentioned very often but definitely worth it IMO. Quite simple to use in standard situations. [Win]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT|BTFRS|XFS}

Evaluating results of a scan

In general it is advised to first run the demo / trial version. In most tools the file save option is disabled. Most tools can be upgraded to the full version without having to restart the tool. Most tools offer a session load feature so you do not have to scan again even after restarting the tool.

To evaluate scan results I suggest the following: Locate a folder containing larger images and preview say 20 of them. When recovering data from a formatted volume, pick non deleted ones. If the images look fine the tool has successfully determined vital volume parameters such as the cluster size. In general if those 20 are okay it is likely most files are.

DMDE: Does not have an image preview however, the trial allows you to save up to 4000 files (but not sub-folders).

Free data recovery software

There are two categories of ‘free’ tools:

  1. Many manufacturers of software advertise free software. In reality these tools are limited versions of software you need to pay for. For example the amount of data you can save is limited to 1 GB. As a rule of thumb it is my advise to avoid this type of software. Some free software such as Recuva is fully functional but may attempt to install additional software.

  2. Free and open source with no strings attached.

Some free tools worth mentioning

Testdisk & PhotoRecwww.cgsecurity.org , free and open source. These are command line tools and can be useful in certain situations. However these tools are not generic and all-round file recovery tools. Testdisk primarily is a partition recovery tool. It writes to the patient disk. PhotoRec is a file recovery tool that can recover individual files, however it does not recover file names or the directory structure. There are considerable drawbacks compared to commercial tools.

Recuvawww.ccleaner.com/. Free for non commercial use. This is primarily an undelete tool. It can also ‘unformat’ provided a volume was formatted with the exact same file system and parameters such as clustersize.

 

Leave a Reply

Your email address will not be published. Required fields are marked *