Info Software used by data recovery professionals

[fzabkar]

Software used by data recovery professionals

The following wiki was compiled by a data recovery professional. It lists the most popular logical data recovery software used by professionals.

https://old.reddit.com/r/datarecovery/wiki/software

These tools don't feature in most online "best data recovery tools" reviews or shoot-outs, and they generally have a much lower visibility than aggressively marketed, second tier tools.

UFS Explorer is arguably the gold standard in the data recovery business.

https://www.ufsexplorer.com/

The same developers also produce RAISE (US$25) which is an inexpensive option for home users.

https://www.raisedr.com/

DMDE is probably the least expensive tool (US$20 for standard version). Its free version can recover up to 4000 files of any size from any one folder per session. DMDE is also a disk editor. This means it can write to the drive, but not without the user's explicit approval.

https://www.dmde.com/

R-Studio is probably the second most popular tool used by the pros.

https://www.r-tt.com/

Its developers provide free tools for specific tasks.

https://www.r-undelete.com/ (R-Undelete)
https://www.r-undelete.com/free_photo_recovery/ (R-Photo)
https://www.r-studio.com/free-linux-recovery/ (R-Linux)

This free tool (by the makers of ReclaiMe) autodetects the parameters of a broken RAID:

http://www.freeraidrecovery.com/
https://www.reclaime.com/

It does not recover the actual RAID data, despite the suggestive name.

GetDataBack is another popular professional tool:

https://www.runtime.org/

 

[fzabkar]

DIY cloning tools recommended by data recovery professionals

When a storage device becomes unstable due to physical problems (eg bad disc heads, bad media, bad NAND flash), it is recommended to clone it, sector by sector, to preserve its current state and to minimise the stress that repetitive reading will cause. Regular cloning tools will continue to thrash a bad sector until the read retries are exhausted, thereby accelerating the failure of a weak disc head.

Two free cloning tools that understand how to work around bad sectors and bad media are ddrescue and HDDSuperClone. Both are now open source. HDDSuperClone is arguably the better tool because its author has an intimate understanding of the nature of hard disk "zones". HDDSuperClone also incorporates a firmware tweak to stabilise earlier WD HDDs. Both tools run under Linux because Windows' error handling renders it inappropriate for this task.

https://www.hddsuperclone.com/
https://www.gnu.org/software/ddrescue/

The idea behind these tools is to copy the storage device, sector by sector, either to another storage device or to an image file. The tools will execute multiple passes, endeavouring to clone the easy sectors on the first pass and leaving the more difficult sectors for subsequent passes. If there is a difficult patch in the media, these tools will skip over the patch and continue reading. HDDSuperClone has an advantage in that it tries to detect weak disc heads and then avoid any media which it thinks is associated with these heads. Ddrescue, on the other hand, is "media agnostic".

The author of HDDSuperClone provides a Live CD which can be run from a bootable USB stick. He has also provided a GUI and a detailed user manual. The Live CD obviates the necessity to install Linux on the user's machine.

If a storage device is physically healthy, then the previously mentioned data recovery tools can be used to clone it. For example, DMDE has a Tools->Copy Sectors function for this purpose. It would still be advisable to clone a healthy storage device to guard against accidental logical or physical damage.

 

[fzabkar]

File carving -- the last resort

When a drive is formatted, the file system's metadata are initialised. These metadata include file/folder names, file size, cluster location, location of file fragments (cluster chains), date/time stamps, etc. In cases such as NTFS, much of the original metadata still remain, and the original file/folder tree is usually recoverable. However, the outlook is not so clear for FAT file systems.

A FAT file system has one or more File Access Tables. This is a bitmap which tells the OS how to assemble the clusters that make up a particular file. The file's directory entry is still present somewhere on the drive, but the content of the FAT is zeroed when the drive is formatted. The directory entry contains the file's name, size in clusters (N), and the location of the first cluster. If the file is unfragmented, then the data recovery software can simply go to the first cluster and "carve" out N clusters. However, if the file is fragmented, then these fragments can only be stitched together using the information in the FAT.

Tools such as PhotoRec are file carvers, nothing more. They ignore the file system's metadata. That's why they should only be deployed as a tool of last resort. Regular data recovery software will first try to locate the files based on their metadata, and they will then supplement these results with a "raw scan", also known as "file carving". The software examines each sector and looks for particular signatures which identify the headers and/or footers of known file types. The files found during carving will be given names which appear to be random, but which often reflect the sector or cluster where they were found.

PhotoRec is sometimes useful when the major tools are unable to recognise a desired file type. For example, Canon's CR3 photo format appears to be one of these.

This resource shows the headers and footers associated with various file types:

https://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec

For example, a GIF image file may have a "GIF87a" or "GIF89a" header.

These headers ("signatures") can be viewed with a hex editor, eg HxD (freeware):

https://mh-nexus.de/en/hxd/

There is one tool (Klennet Carver) which is capable of intelligent file carving. However, it is very computationally intensive.

https://www.klennet.com/carver/

"If a small media like a memory card is formatted or has files deleted from it, traditional undelete tools often do not work. Klennet Carver is specially designed for this exact case - to recover fragmented files when file tables are completely destroyed. It examines content on the media and then tries to assemble files from their respective fragments. This is a long, complex, and imperfect process, but it provides significant improvement with high-resolution images and video files."