For many, undelete, file recovery or data recovery software is all kind of the same thing. Even ‘professional’ reviewers use the terms loosely. And more often than not they tend to compare full blown data recovery software under review to other (free) software offering less options. Recuva from Piriform and also PhotoRec from CGsecurity are often used as benchmarks and referred to as free alternatives.
You could say that all software that is designed to make inaccessible data available again is data recovery software. Recovering a file that was deleted using normal operating system methods is performing a data recovery. And yet, recovering data from a corrupt file system does already require more ‘knowledge’ than a simple undeleter can offer. The simple undelete software doesn’t stand a chance when you need to recover data from a corrupt NAS device.
The danger is that, one could come to the false conclusion that if the free software can’t recover the data, that the data can not be recovered using file or data recovery software at all, and simply give up. Often it actually can be recovered by using a more capable (and often payed) solution.
Free Data Recovery Software dangerous?
Under certain conditions using free software may even dangerous! I have observed forum posts where Recuva users explained that Recuva mentioned a RAW file system needed to be formatted first! This is especially dangerous on a SSD as all data will be TRIM-ed and become unrecoverable.
To understand different situations that can lead to data-loss, you may want to read:
Classes of File Recovery or Data Recovery Software
There are numerous tools available, free and payed, that fall into this category. Undelete software is capable of restoring files that were deleted using the normal operating system procedure (assuming Windows here). As Windows does not really delete a file, it only ‘flags’ a file as deleted in the file system, deleted files are often recoverable. All the software has to do is scan the file system for these flagged files.
As long as Windows did not yet use the file entry again, and the clusters allocated to the deleted file aren’t used, chances are good that a file can be recovered.
Note that on a SSD deleted files may not be recoverable at all due to Windows sending a TRIM command to the drive. The TRIM command signals the disk itself that the space that was assigned to the deleted files is now ‘invalid’. The SSD now regards this space ‘garbage’ and it will no longer be available. When an undelete tool tries to access the area, the SSD will simply report zeros rather than the original data.
Recuva is what I would call an Undelete+ tool. It can recover files that were deleted using the normal OS procedure. But it can also recover files from an accidental format. That is, as long as you formatted with the exact same file system and parameters because it does not do virtual file system reconstruction. Virtual file system reconstruction is puzzling a file system back together based on the info that is gathered while scanning a disk. So, if you format a NTFS volume with FAT32, Recuva will try recovering files, assuming the file system is FAT32. And with the file system parameters as they were written to the disk by the last format operation. You will need more sophisticated software if you want it to detect that the actual file system is NTFS. If Recuva is unable to determine the correct file system parameters it will fall back to ‘RAW recovery‘. It will be able to recover un-fragmented files based on file characteristics. It will however be unable to determine the original filenames or the directory structure.
Almost there, Undelete++
A number of the commercial tools available today originally started as undelete software, and over the years evolved into more complete file recovery programs. They can often handle more complex scenarios if you give them a little help. Take the above example of a NTFS volume that was formatted with FAT32, you will need to tell it that it needs to scan for NTFS file system structures.
Also, in case the file system is corrupt (RAW file system), you may need to lend it a hand by telling it what file system you are looking for.
Another example, in case of a lost partition, you will first need to tell the software to scan for the deleted partition, then to recover the files, where it can again largely rely on it’s undelete+ capabilities.
Generic File Recovery Software, the real deal
Even professional reviewers tend to review this software as if it were undelete software and they test it as such. And although it may look the same, the techniques are so much more advanced. I’ll take Reclaime as an example, but other tools that fall into this category are for example R-Studio, FileScavenger and iRecover to name just a few. If this type of software is tested against a simple undelete scenario then indeed it will not perform significantly better than a simple undelete tool.
ReclaiMe looks very simple and could very easily be mistaken for an undelete utility, but this software should not be judged by it’s looks. ReclaiMe can be used to recover deleted files, but you also ‘throw it’ at a completely blank disk. If the disk contained 3 volumes, it will then automatically and without further user intervention reconstruct 3 virtual file systems from which you can select and recover files. This not something your typical undelete utility is capable of.
Also with more advanced file recovery software you’ll find:
- features to create and process disk images
- better handling of read errors
- the ability to process defunct RAID disk sets and disks from NAS devices.
Data Recovery Software
Data Recovery software is software which aids in accessing data that can not be accessed by normal means. So technically this includes both undelete and file recovery software but also software that is specially designed to handle ‘bad disks’. By bad disks I mean disks which cause software accessing the disk to hang due to read errors (bad sectors). Software for handling bad disks is often called disk cloning software. The software can either clone disk to disk, or disk to image file. This can be separate programs but the more advanced file recovery software often also includes a disk imaging feature.
Picking the right tool
As the terminology is blurry and ill defined, when looking for software to recover your data it’s best to ‘Google’ for what best describes the problem at hand.
So, if you accidentally formatted a volume you Google for example for “recover data from a formatted volume” or “how to unformat a volume”. If you deleted or lost partition, you search for “recover data from deleted partition” or similar. This will probably result in more to the point hits than searching for something as “file recovery software” for which the results may include file undelete software that has no idea how to tackle a lost partition.
Various ‘users help users’ forums do well in the Google search results. Unfortunately the advice given in various help forums, even by senior forum members, is too often plain wrong and dangerous.
As said, software reviewers tend to compare more expensive and more capable software to free options. There is nothing against that, if you do it right. So, clearly state the differences between the software being reviewed and the ones you compare to. Software reviewers typically run the software on an intact drive in which case the more expensive software and the free undelete software will produce similar results. As soon as you start comparing in more complex scenarios you will get to see huge differences. To a large degree it is true that you get what you payed for.
|Type of Software||What can it do?|
|File Recovery Software||Software to scan a file system and produce a list of recoverable files. Technically both undelete software as well as more advanced and capable software.|
|Data Recovery Software||Software that helps accessing data not accessible by normal methods. So all undelete, file recovery and disk cloning tools.|
|Undelete Software||Software specifically designed to recover files deleted using normal methods.|