Data integrity after recovery

[Jtb1]

Hi,
we do a fair bit of data recovery and I am trying to find a programme that will check a file to see if it intact. Picture files are not to bad as I can view them as thumbnails and a quick check shows the good ones. Bit of a chore if there are thousands of them though. Can’t do the same with pdf or word etc. I would have thought such a programme existed but not found it yet. To be clear this is data recovery after a drive has become faulty and often it is RAW.
Any help would be appreciated thanks.

 

[Larry Sabo]

That question would best be asked on hddguru forum.

 

[lcoughey]

I prefer to get the original file tree and report the damaged files with bad sectors.

You may want to review the data recovery section in the resources or consider outsourcing your cases if your cases are often RAW file recoveries.

 

[Joep]

+1 What Luke says.

If you can reconstruct a file system and assuming no bad sectors there's no reason to assume you have corrupt files (after spot checking a few large JPEGs for example).

If you in addition to FS results include results from RAW scan and files marked deleted in file system, then you likely introduce corrupt files. But IMO there's no reason to include those in the first place if you have a good file system recovery.

Some tools are better than others in reconstructing a virtual file system. So if you get no file system and only raw results, trying different software may be a good idea. It's not exceptional that I can recover complete file tree after customer tells me he tried every file recovery tool he could find without success. So definitely outsourcing can be a good option too.

Again:

• If you resort to RAW (signature based) recovery corrupt files are a given. Avoid RAW recovery whenever possible. If the tool you're using does not resolve a file system, try a different tool. Still no joy, see if a data recovery specialist can produce a file system.
• When dealing with deleted files corruption is always possible even if the tool you use tells you 100% of the file is recoverable. Such tools use simplistic methods to guestimate the condition of a file and they can be wrong.
• If bad sectors are a factor it's like Luke says, determine what files were affected by those bad sectors. If you don't have tools that can cross reference sectors <> files then configure your disk imager to replace bad sector data with a pattern you can easily search for and identify 'bad files' that way. This implies you first clone or image the patient drive.
• Depending on media and specific file types, specialized tools may be available that can recover intact files where more generic tools can not.

Checking integrity of files isn't as simple as it sounds. Some tools exist for JPEG ('Bad Peggy' being one), ZIP files you could batch check with 7ZIP I think (and then perhaps Office files too as these are ZIP archives), I wouldn't be surprised if you can check MP4/MOV etc. using ffmpeg.

 

[labtech]

Do you clone the drives first with software that could report on bad sectors? If so, then you should have a decent idea of level of corruption.

If not cloning first, then that is where ambiguity arrives and further more, complaints from customers due to expectations being unmet.

Issues resulting from various ways of overwriting (file deletion, formatting, TRIM, new OS installation, etc) are different. That will come automatically with various degrees of corruption, with limited amount of data recoverable, if any. So, the expectations there should be managed upfront with the customer.