Accidentally hit that delete button? Having a hard drive failure? Help is here. Let us take you through the steps to get that data back in your hands.
Data recovery software doesn’t have quite the same flash as anti-virus software. While new computers generally come bundled with some type of A/V application, there isn’t nearly as much attention paid to recovering lost data. Microsoft jumped into the AV fray by providing users with Windows Defender but they seem curiously absent when it comes to data recovery. Sure, there’s Recovery Console but that’s not much help when Windows itself can’t read from the drive in question. When you lose data, it’s a technology emergency – without any ability to dial 000. Let us be the calm-voiced 000 operator walking you through the steps you need to recover your data.
What Seems To Be the Trouble Here?
If you’ve deleted a file or formatted a drive and you want to retrieve some or all of the data, jump ahead to the “Now Infamous Software” section which details software that will help and consider yourself lucky. You have a drive that is still functioning and your computer knows it’s there. But, and this is vital, make sure you STOP using the drive immediately. Eject it, unhook it, power it down… whatever it takes to make sure your operating system doesn’t write tothe drive. If you don’t do this right away, your data will be much harder or impossible to get back.
If you’ve mutilated, mashed, dropped or drop-kicked your drive, and it’s making nasty sounds, then your best bet is to move directly to professional data recovery. Unless you’re a super guru, there isn’t anything you can do yourself.
Although it’s an infrequent occurrence, some drives just give up the ghost, through no fault of your own. If your hard drive is dead – no sound and no vibrations at all – check out our tips about electrical failures. We’ve got a trick or two that you’ll want to try before you start shelling out greenbacks for professional help.
If there doesn’t seem to be any physical problem with the drive, then you have two paths to choose. If your computer sees the drive but doesn’t recognise it as a functioning unit, it could mean that the file system has been corrupted. The whole drive might be askew or it might simply be the File Allocation Table that’s somehow gotten a bit sideways. As long as there is activity in the drive, that would be some vibration and some normal spinning noises, you’ll most likely be able to retrieve your data.
However, if you have a RAID setup and it isn’t recognised, or if you have more than one partition on a drive and your OS can’t see them all then you’re in a bit deeper. Start with the now “Infamous Software” suggestions to see if anything there can help.
Anything to do with RAID is reasonably complicated so it goes to figure that a RAID failure is equally as complicated; basically, don’t have unrealistic expectations of a free software application solving all of your RAID woes. Keep in mind, your RAID problem might be your hardware controller. (While we’ll mention RAID with each piece of software in this article, we’re dealing primarily with single drives here.)
A Quick Side-Note On Flash Drives and Alternate OSes
The bulk of this article applies to hard disk drives, not SSDs. The data recovery programs we describe here work pretty much the same on flash drives, SSDs and even floppies – the only difference being the mechanical/electrical problems. The beauty of SSDs is that they have no moving parts, making them far less susceptible to bumps and knocks than traditional hard drives. Additionally, we are concentrating on Windows, so if you’re using Linux, the physical problems are cross-platform however the software solutions are often not. Not to worry: we’ll let you know what works with your OS and what doesn’t.
Are You Sure? – The Mis-Click
Before you format a drive or delete a file, your OS will try to determine if you realise what you’re about to do. In spite of this, sometimes we make mistakes. Fatigue, confusion, stress can add up to a thoughtless mouse click and suddenly your blood runs cold.
For some of those moments, your operating systems’ failsafe, aka the trash bin/recycling bin, will be your saving grace. If you’ve accidentally deleted a file, check the trash bin first before you run off screaming. If it’s not there, try the free/cheap solutions listed in the now “Infamous Software” section.
We said it earlier, but it’s important enough to bear repeating: whatever you do, as soon as you realise something is amiss, stop using the drive. Once more: Stop. Using. The. Drive. Why? Well, your operating system writes data to your hard drive almost constantly, even if you aren’t saving files or processing any work. When a file is deleted, it’s still on the drive in a kind of limbo state. The markers telling the filesystem that the data there is a part of a specific file have been removed, so your operating system simply doesn’t see it anymore. Since your OS considers the space that the file took up as essentially open space, it will write over it at some point if you continue to use the drive in question. Once a file has been overwritten, it’s virtually impossible to recover.
A Quick Side Note on Spare Drives
Although it seems obvious, we’ll say it anyway: don’t try to recover files to the same drive that you’re trying to repair. That’s like cutting off a tree branch that you’re sitting on. If it’s a flash drive, use your computer’s hard drive to save the files. If it’s an external drive in question, make sure that you have sufficient room on another drive to cover the quantity of data that you’re recovering. And make sure that you aren’t running your computer from the same drive that you’re trying to repair. That just won’t work people! What will: either run the recovery software from an optical disk or flash drive, or take the OS drive out of the computer and put it into an external setup and retrieve the data from it.
The In-Famous Software Section
The Big Easy – Recovering Recently Deleted Files from a Photo Flash Drive
Flash drive and cards are everywhere; in your mobile phone, your digital camera and maybe your camcorder. Recovering files from these units is as easy as downloading some free software, installing it, and running it.
What kind of free software, you ask? Let’s start with Piriform’s Recuva, which has saved our bacon many times. And by bacon, we mean, data. Aside from being free, it’s also simple and quick. Install it, open it and tell it which drive you want it to scan. Recuva will do the rest, including recovery of the original filename if there is enough of that information left.
[imgclear]
On the left side of the GUI, you’ll see the filename, the path to it, when it was last modified, its size and whether the file can be recovered. Green, orange and red buttons next to the file name are a visual aid to quickly let you know what your recovery chances are for the file. If you’re lucky, you might be able to preview photo files on the right side.
Recuva will work with hard drives, flash drives, camera cards and MP3 players, but only on a Windows computer. It also works well with Outlook Express, Thunderbird and Windows Live Mail.
If you’ve formatted a drive, Recuva will find whatever files it can. If Word has crashed, sic Recuva on to the drive and you’ll be back typing the next great novel in no time at all. Recuva has two settings; the Deep Scan takes longer than the normal scan but should be able to recover more data. There’s even a portable version of Recuva that you can take with you on a removable drive, however, it doesn’t play well with RAID.
We used Recuva on a 4GB flash drive that had been used for data transfer between computers for over two years. Recuva was able to find and recover hundreds of files that other free programs, (specifically DiskDigger Data Recovery Wizard),were unable able to find at all. On a deep scan, DiskDigger found a few more files but due to the limitations of the program, only one gig of data could be retrieved for free. While Data Recovery Wizard also has the same one gigabyte limitation, Recuva has no such limitation. As long as Recuva is around, we’re wondering why anyone would go anywhere else for data recovery.
[imgclear]
Fix File Tables Fast
Sometimes a hard disk is fully functional but Windows can’t seem to recognise it as its own. There is the drive letter in Windows Explorer but Windows still asks you “The drive is not formatted. Do you want to format it now?” Sure, the drive may have been fine just a moment ago but something went horribly wrong. Whatever you do, don’t format the drive. (What did we just say? Don’t format the drive.) Instead, try out TestDisk.
[imgclear]
TestDisk, available from CG Security, is a deceptively simple bit of free software. We’re talking totally free, not crippled in any way, no gigabyte limit, no time limit but… no GUI either.
The file table can be explained this way. Imagine that you have a huge set of drawers, chockfull of things . You’ve spent time making a list of everything in the drawers, what the items are and a bit of information about them. The list tells you what drawers have room left in them and which drawers are empty. Then, horror of horrors, you lose that list.
Nothing has moved. Nothing is missing except the list that tells you where everything is. Without that list, the dresser appears to you the same way a drive looks to Windows. You know that it’s a dresser and Windows knows that it’s a hard drive but both you and Windows would have to start fresh and format (sort out all the drawers again) – unless you can find that list.
[imgclear]
Ever wonder why FAT32 is named FAT32? 32-bit File Allocation Table, dude. The file table in NTFS is called the MFT (Master File Table); other file systems use different names. Regardless, TestDisk should help recover the file table from any of them.In the example above, if you’ve kept a copy of the list, you’re safe. Windows makes a backup copy of the file table, but you need a program such as TestDrive to retrieve the copy. Thankfully, this doesn’t take very long.
The lack of a Windows GUI might be a bit disconcerting, but TestDisk is reasonably easy to use. (If you’re a confused by some of the terms used on the screen, there is a very handy step-by-step outline available on the website.) TestDisk runs in a command prompt window and uses Linux drive letters (sda/sdb) instead of typical Windows letters (c:/d:), and the program uses arrow keys for navigation.
[imgclear]
TestDisk lists the drive size, the free space as well as the manufacturer. Choose the drive you want to work on then move on to which partition you want TestDisk to look at. On this screen you’ll notice that TestDisk will work onWindows, Mac, Linux, Sun and good old Xbox partitions.
TestDisk is incredibly handy, simply because it works on just about any computer out there but as far as RAID goes, TestDisk works with Linux only. Besides recovering an errant file tables, this software will also repair boot sectors, undelete files and find lost partitions, irrespective of the file system used on the drive.
[imgclear]
As part of the TestDisk package, you also get a copy of PhotoRec, a cross–platform file recovery application. Like TestDisk, PhotoRec uses a command line interface, but its strength lies in the fact that you can use it on many different operating systems. PhotoRec will recover your files, no problem, but you’ll have to sort through them individually to see what each one is. If you’re looking for one particular file or type of file this isn’t too bad but if you’re trying to recover a complete drive, we can see how this would be a royal pain.
Zapped Drive? Find a Dupe
Every now and then a hard disk drive will fail because of a problem with the circuitry. If the circuit board fails, you can sometimes find an identical board which can serve as a replacement. Find the make and model number of your drive and scout out some auction sites or craigslist. You might get lucky by either finding an identical drive. Every manufacturer is different, of course, and the circuit board solution is not guaranteed to work on every drive out there. It’s worth a shot, however, if the lost data is important to you.
Your Final Option: Professional Data Recovery
If you remember the IBM ‘Click of Death’ from a few years ago, then you know that mechanical failure can happen suddenly, leaving you no recourse but to turn to professional data recovery experts. This is where you have to think long and hard about the data you’ve potentially lost. Obviously, business users, students, photographers/writers all have valuable data that must be recovered if a drive fails. In some cases, this data can be retrieved but at a significant cost. Is it worth it to you?
In order to do their job, data recovery professionals require equipment, software and a clean environment which all cost money. Maintaining a parts inventory alone is massively expensive. Try to get an estimate. If it’s just a small mechanical problem, the costs might not be too high. Some companies have cheaper rates for students which helps… if you’re a student. The reality is the average Jill or Joe has to cough up substantial bucks to get their data back. Hey, that’s what it takes to employ the guys who do forensics for the 5-0, right?
How trustworthy are the professionals? The IPDRA (International Professional Data Recovery Association) member list will link you to a company near you that will take care of your lost data securely. Consider this as a data recovery Better Business Bureau.
Watching Your Back
If you’re with us to this point, you might be pondering one important issue that we haven’t mentioned yet. While we’ve helped you figure out how to retrieve lost data, we’ve also shown you how simple it would be for someone else to recover your information. If you’ve sold a computer or tossed a flash drive in the bin at the local thrift store, some enterprising person could use Recuva or PhotoRec to snoop into your life. However, the really nice thing about Recuva, aside from its low, low price, is that you can use it to write over your drives and disks, making the data that had been on them completely irretrievable by any third party.
You can choose to write over the files just once or you can go Gutmann and scrub the disk thirty five times!. Your choices will vary, depending on the information that you’re trying to hide, of course. The NSA seven pass is pretty standard for wiping a disk but if you have time, or you’re incredibly anal, choose the Gutmann process. We should note, though, that nobody but nobody has ever demonstrated the ability to recover data that’s been overwritten even once. Thirty-five passes is overkill.
If you just want to securely erase specific files so they’re unrecoverable, check out Eraser (eraser.heidi.ie).
Ounce of Prevention
These days, there is no excuse, save laziness, for not performing regular backups. The products and steps we’ve outlined here are last ditch solutions that might help you get your important files back in your hands. If you’ve performed continuous backups to non-magnetic, non-mechanical media, then the worst that could happen is the loss of your most recent data.
If you’ve backed up your files to another hard disk drive, what’s to stop it from failing? You reach for your coffee and your external backup drive hits the floor. Backups are only as secure as the media that is used. If your photo files, documents or music are your meal ticket, then get them onto some DVDs and store them in several different locations. It’s always good to download the software mentioned here and back it up with everything else. That way you’ll have it handy when you need it. You could also run TestDisk and PhotoRec through their paces on a spare hard drive, just to get used to them. Then, when things get nasty, you’ll be ready to rock and roll.
Maximum PC brings you the latest in PC news, reviews and how-tos.