Data Recovery Guide

[Galdorf]

Sooner or later you will have customers that have important data that needs to be recovered there are 3 types of data recovery.

1) Recovery due to virus/trojan/batch file
2) User error format/file deletion
3) Bad sectors/failing hard drive or removable media
4) Corruption of fat/filesystem/partition
5) Removable Media bad sectors, scratches on cd's and dvd's


1

Some Programs can be used to recover data:
recuvra (http://www.recuva.com/) good for data files and free
GetDataBack (http://www.runtime.org/data-recovery-products.htm) Pay does a good job all around data recovery program
TestDisk (http://www.cgsecurity.org/wiki/TestDisk) open source

2

Some Programs that can be used to recover raw or damaged partition or sustained file damage from OS format/reload.

GetDataBack (http://www.runtime.org/data-recovery-products.htm)
R-studio (http://www.r-studio.com/)

For Pictures:
O&O Media Recovery 6 (http://www.oo-software.com/home/en/products/oomediarecovery/index.html) I find this is the best Picture recovery software out there, I have test a dozen this seem to be better at it than most.
PhotoRec (http://www.cgsecurity.org/wiki/PhotoRec) OpenSource.

3

Three is tricky the hard drive might fail that is why you MUST create an image to work from.

Norton ghost, Acronis backup sure they can make a backup image but the drive may fail or shut down due to data problems on master cylinder.

Best software for creating an Image does what is termed a Reverse image backup.

Media Studio Professional (http://www.prosofteng.com/products/media_tools_pro.php?PHPSESSID=835d3c46916e706c7015 9a4fb1ab9de9)
HD Duplicator (http://copyrsoft.com/index.php?option=com_content&view=category&layout=blog&id=25&Itemid=27&lang=en)

Although these may be expensive they pay for themselves in time they are more than just imaging software they communicate with the hard drive at a low level allowing you to image a drive that would shut down after a minute.

Free Programs:
Gddrescue (http://debaday.debian.net/2007/12/12/gddrescue-a-tool-for-recovering-data-from-damaged-media/)
While not as good as Media Studio Professional this will do the job with a little more work.
hddguru.com (http://hddguru.com/content/en/software/) - lots of free hd diagnostics and tool a great resource.

4

File system corruption (crosslinked files) the easy to fix you may have bsod in windows best way to repair this is to use chkdsk /r from windows recovery prompt

Partition Corruption: it is always best to create an Image of the hard drive sector by sector approach before attempting repair.
TestDisk (http://www.cgsecurity.org/wiki/TestDisk) OpenSource
Parition Table Doctor (http://www.ptdd.com/ptd-unlimited.htm)
Hdd Regenerator (http://www.dposoft.net/) imo the best hard drive utility out on the market worth every penny has VERY low failure rate forget SpinRite

5

Removable Media

CD/DVD
Sometimes cd's and dvd fail due to scratches on optical surface or top layer.

Dvdisaster (http://dvdisaster.net/en/index.html) OpenSource

Floppy Drive Recovery
Active@ Floppy Recovery (http://www.floppy-recovery.com/)
Spinrite (http://www.grc.com/spinrite.htm)

Hard Drive
Hdd Regenerator (http://www.dposoft.net/) imo the best hard drive utility out on the market worth every penny has VERY low failure rate forget SpinRite

Hardware Solutions:

Data Compass (http://www.salvationdata.com/data-recovery-equipment/data-compass.htm)
Deepspar Disk Imager (http://deepspar.com/products-ds-disk-imager.html)

Disk Duplication software and hardware on the cheap:

Hdduplicator Poland (http://www.hdduplicator.pl/)


Videos explaining hard drive recovery

Advanced Hard Drive Data Recovery Part 1 (http://www.youtube.com/watch?v=vCapEFNZAJ0)
Advanced Hard Drive Data Recovery Part 2 (http://www.youtube.com/watch?v=w2FGKD4u8TU&feature=related)
Advanced Hard Drive Data Recovery Part 3 (http://www.youtube.com/watch?v=jAUtv6kOCGE&feature=related)
Advanced Hard Drive Data Recovery Part 4 (http://www.youtube.com/watch?v=5xdboKrOllE&feature=related) -Reverse Cloning Explained
Advanced Hard Drive Data Recovery Part 5 (http://www.youtube.com/watch?v=MydSI4Jv2EI&feature=related)

More Information on Hard Drive Recovery

myharddrivedied.com presentations/ (http://www.myharddrivedied.com/presentations/)
Hard Drive Recovery White Papers (http://www.myharddrivedied.com/presentations/presentations_whitepaper.html)

[NYJimbo]

I thought there were 5 levels of data recovery.

[iisjman07]

Nice guide, might try out some of those apps. One thing I was surprised I didn't see was the unix tool 'dd'. It's a GNU Freeware data copier that can reverse copy, sector by sector.

[Kenhelms]

Nice list.

There is also Ontrack Recovery, encase, helix, access data FTK, paraben makes a couple.
Nuix,stepanet.

There is also the hardware dupicators that are much faster than the software imagers.

Most of this software is geared twords forensics, but what can be used for that can also be applied to some levels of recovery.

Rstudio is one of my favorites, so quick.

[Galdorf]

Media tools Professional is very good pay software for creating reverse clone it communicates with drives at low level it allowed me to clone drives with less errors and that keep shutting down.

So far it has paid for itself by not sending drive to a data recovery company so far it has worked wonders as long as the drive spins and heads can move i can recover data.

Funny thing is if i try to clone the drive normal way more bad sectors show up if i reverse clone the amount of bad sectors picked up is half or less.

Sometimes it may take a day on really bad drives but it does not hammer on bad sectors like other apps.

With insurance work i do a LOT of data recovery looking at buying some hardware soon so we get the money for data recovery on really bad drives.

[Galdorf]

I added some video explaining how hard drives work and about the importance of reverse cloning and why it recovers more data than normal cloning.

Hddguru now has many great free hd tools listing in download section so check them out.

[lgtechcomputers]

awesome post!

I have relied on Recuva and GetDataBack for my recovery jobs.
So far these have not let me down.

There's always backtrack which should have some forensic oriented tools also.

Thanks!

[MM PC Solutions]

Thanks, a good post. :)

Do you have any advice on "Not recognised" USB keys?

[pg07143]

Can anybody recommend a good book on data recovery? I am considering taking an online course but would like to do some reading as a primer.