What tools can aid you in data recovery
Data loss happens, but it’s no reason to panic. A great variety of data recovery tools is available for such occasions. Tools for data recovery are often considered to be complicated, confusing, and challenging. However, the truth is that they are not that bad – especially if you have a little bit of experience with them.
The point is that their scope is so broad that manufacturers struggled to find usable interfaces for all possible software categories. Consequently, one can find tools with overlapping features in many types of computer applications (file managers, OS installers, etc.). You must be aware of salesforce data recovery costto plan accordingly and make a budget.
You always need at least one tool from each category listed below:
1) File recovery/undelete utilities;
2) Imaging technologies;
3) Partition management;
4) Various miscellaneous tools (registry, boot records, etc.).
No matter what kind of data loss scenario you are experiencing, you will always need at least basic skills in one of these areas. For example, even if your hard drive is unreadable and won’t show the file system at all – you still might be able to recover some files with a raw disk editor or a hexadecimal editor. So let’s see what tools we have and how they work:
File Recovery Tools
There are 2 types of programs in this category: undelete utilities and file carving tools. Undelete utilities search for deleted files on a formatted disk (they can also help if partitions are accidentally resized/moved).file recovery software by Remo Software File carving tools try to reconstruct file systems by gathering files with byte signatures specific to certain types of data (JPEG, ZIP, etc.).
Undelete utilities
Recovers files from formatted disks and partially damaged file systems.
Recuva: very easy to use and quite powerful for its size.
Restoration: an excellent undelete utility with lots of configuration options. It supports many file systems and can also help recover partitions that got accidentally resized/moved, or damaged due to power outages.
PhotoRec: explicitly developed for recovering photos from digital cameras with memory cards (“digital forensics”). Most likely, the best choice for recovering files from FAT12/16, exFAT, NTFS, Ext2/3, and ReiserFS file systems.
DataRescue DD: explicitly developed for imaging corrupted disks with bad sectors (“digital forensics”). Useful when you need to recover badly fragmented files (file carving is not possible). It is useful for all types of file systems and available for Windows and Linux.
File carving tools
PhotoRec again. You can’t choose it as a primary tool because its target is specialty files only – but it’s still worth mentioning here because of its raw disk scanning capabilities. It can search inside the entire disk space for byte signatures specific to JPEG, GIF, AVI, MP3, etc., files. It can also search inside a single partition or a memory card.
Scalpel: file carving tool with an option to scan multiple disks/partitions at once (including network drives). It works on all types of file systems by searching for byte patterns in the entire drive contents.
The Sleuth Kit: one more tool designed specifically for digital forensics tasks. In addition to basic file system scanning, it has many useful features such as the ability to read Linux disk labels, log files, etc. It can also generate reports in HTML for easier post-analysis. It is available for Windows and Linux (free open source).
Imaging Technologies
These are very different programs that share one common feature – they copy the contents of damaged/unreadable disks to unpartitioned hard drives or image files. We can classify them as follows: 1) low-level copiers (raw data reading, direct memory access); 2) file system aware copiers (byte by byte copies); 3) partition table based copiers (similar to cloning tools).
Raw disk writing is the only option some tools provide; others combine raw reading with byte-by-byte copying.
dd: a potent and flexible tool that can be used for imaging disks with bad sectors or damaged file systems (although it’s not the best option). Works on all types of file systems. This is available for most platforms (Linux, OS X, etc.) but difficult to use for beginners.
Telnet Disk Writer: a simple tool that works only on an EXT4 file system – imaging an entire disk is not possible with this one; however, it’s easy to use and very fast because no byte-by-byte copies are involved.
FTK Imager: imaging utility developed by Access Data. It’s an interesting option because this company manufactures digital forensics hardware devices as well. This tool is available only for Windows so far but can be used on Linux via Wine emulator.
ILookIX: complete solution that includes the disk imaging program itself – “ILOOK Disk Imaging Utility” – together with a hex editor (“ILOOK Hex Editor”) and a registry viewer (“ILOOK Registry Viewer”). Different file systems are supported, including NTFS, FAT12/16/32, exFAT, etc.; disk imaging (including bad sector files) and partition table recovery are possible; images can be compressed for easy transfer to other systems. It is available only for Windows so far – but there is a plan to release a Linux version soon because the developers have noticed that malware authors tend to use them less.
Imaging tools are included because, in some cases, it’s much easier to rebuild a damaged file system this way than by using a hex editor.
Stellar Phoenix Data Recovery: application from the same company that makes “Stellar Phoenix Windows Data Recovery” – a tool for recovering deleted files from FAT, exFAT, and NTFS partitions, available only for Windows so far – but there is a plan to release a Linux version soon as well.
Partition table based imaging
This group contains tools that can create images of disks/partitions even if the file system is damaged, deleted, or otherwise unavailable. Linux version of “DiskInternalsUneraser” – a set of tools for recovering deleted files from FAT, exFAT and NTFS partitions. Imaging tools are included because in some cases it’s much easier to rebuild a damaged file system this way than by using a hex editor. It is available only for Windows so far – but there is a plan to release a Linux version soon (provided that there will be enough requests).