Best data recovery software.

[djxput]

I dont really want to take my drive in - sensitive data on there. I prefer to get the data off myself. Im not even sure how my drive got erased weird thing is there are still a few files still on it. Basically 2 TB of data I want to recover prefer with file names and file structure. (I'm thinking I had a short with my motherboard because this erase happened around the time when I was 'messing around with another drive and changing wires around'.)

I've tried a couple products already and purchased 1 but Im not getting the file names and I have no idea if I have all the files; would really help if I could get the names and structure.

Have tried easeUS and ontrack trying a free version of recuva atm ... ontrack seemed to find more files then easeus but again no file names or structure so its just random names with just a mass of files which really doesnt help much.

thanks

 

[Armageus]

If easeus fails then recuva is a waste of time imo (as Easeus recovers at a lower level than recuva).

Have you tried the drive in another machine with different cables, just to rule out both motherboard and cables.

 

[djxput]

If easeus fails then recuva is a waste of time imo (as Easeus recovers at a lower level than recuva).

Have you tried the drive in another machine with different cables, just to rule out both motherboard and cables.

funny I was thinking of that ... but would the drive show up as something totally different, meaning basically in properties show 3.56tb free out of 3.66 when it should have used 2-3tb worth? ... who knows. But ya I'm thinking of trying what you said.

 

[djxput]

funny I was thinking of that ... but would the drive show up as something totally different, meaning basically in properties show 3.56tb free out of 3.66 when it should have used 2-3tb worth? ... who knows. But ya I'm thinking of trying what you said.

I dont have a different computer but changed the wires around and tried different ports etc ... didnt make a difference with the drive still missing 95% of the stuff off of it.

 

[chili]

i have just successfully used stellar phoenix on one of my drives

 

[djxput]

i have just successfully used stellar phoenix on one of my drives

Did it preserve file names and or folders? - thats my main issue - so far have tried I think 4 or 5 or maybe even 6 of these recovery programs. Funny enough running stellar as we speak - seems to take 8-13 hours to run on this 4 tb drive thou ...
wierd thing is each of these has different amount of files and or names of certain files. So this is just a guess but I have about 1/5 of the files have names to but no folder structure etc ...

- funny thing is this all happened because I was trying to get things off a busted portable drive of my wifes meaning the casing part was broken not the drive but I must have shorted something to cause this mess or something because I certainly didnt delete anything off that drive (unless some virus did?)

 

[CaptainCrash]

You could also try GetDataBack for NTFS - I've had success with this where everything else has failed, and if it doesn't work you're looking at professional data recovery services IMO.

It's not free, but the trial version should at least let you know if your data is recoverable.

If it works you can thank me by promising not to say "must have," again, ever, or indeed "should have," "could have" or any other of these horrible constructs used by the ever-growing army of marching morons.

 

[chili]

Did it preserve file names and or folders?

yes it did, i did not do a deep scan as it seemed to find everything i wanted on the basic first pass. The drive was only 200gig and did not take very long for me.

 

[djxput]

Ive tried all the recovery software listed above and others and I think Im stuck with not knowing most of the file names and folders 90+%, ... unless I want to take it to a professional. Speaking of which ... could they get my data off with names and folders? (I still have no idea how this happened when the drive still shows its in good health etc)? And more importantly - when sending your information to a stranger how do we know our information is safe and what does that mean? Lets just say there are probably files I wouldn't want a stranger to have access one being a file that contains ALL of my passwords.

a bit of a conundrum, really want the files off that drive with their respective file names and folders but dont really want to 'share' it with a stranger. To be honest from what I gather using about 6 recovery programs it would take me a really long time to even figure out what some of these files are (20k files~ where there are no names and folders). Or even if I had all of the files.

anyone have any other ideas or programs that I should give it a shot. My drive somehow still has part of a folder where I kept tv shows on there but to be honest this is the least of my concern; everything else is gone and the recovery programs cant seem to get their file names. I did make a small mistake with one of the first recovery programs and I started putting the recovered information on the same drive. Was about 1.5 gigs worth of 2-3tbs. So this may have permanently messed up some files. But this still is not the reason I have no file names.

Really annoying ... Ive had some drives go bad on me in the past but this was along time ago and I was still able to get all the info off of them. I didnt think I would need to back up stuff since I keep a close eye on the health of my drives; let alone the space Id need for a backup - Im probably looking at about 8-10tb of data/files I have total. 2-3tb~ on the said drive which as far as I know has no issues?

My only guess is there there perhaps was some kind of short with either my motherboard or my wifes external drive that went bad which funny enough I managed to pull all the data off (I did this just a week ago and after noticed my drive with the missing files).

atm Im thinking of buying a 8-12 tb seagate drive start putting most of my files onto this new one and then using my other 4tb and start going through my 'bad' drive file by file with different programs to try to figure out what files I had and what I can save - this could take a really really long time. And I still may never know what I lost or recovery it all.

any recommendations?

 

[Armageus]

Ive tried all the recovery software listed above and others and I think Im stuck with not knowing most of the file names and folders 90+%, ... unless I want to take it to a professional. Speaking of which ... could they get my data off with names and folders?

Seems unlikely that even a professional could recover the directory structure.

Whilst file data can be recovered by physically scanning the disk and looking for known file type headers e.g. open a JPEG file with notepad and you will see the identifier "JFIF" with the first few bytes, directory structure is stored in a reserved area called the MFT (Master File Table) - if this is damaged then it's unlikely anything can be done.

And more importantly - when sending your information to a stranger how do we know our information is safe and what does that mean? Lets just say there are probably files I wouldn't want a stranger to have access one being a file that contains ALL of my passwords.

Professional data recovery services don't generally care what data they are recovering (unless it's something illegal e.g. child pornography etc, that they are legally obliged to report), your password list is likely far less important than some of the other data they likely process (e.g. government, banks, large businesses etc)

 

[djxput]

Seems unlikely that even a professional could recover the directory structure.

Whilst file data can be recovered by physically scanning the disk and looking for known file type headers e.g. open a JPEG file with notepad and you will see the identifier "JFIF" with the first few bytes, directory structure is stored in a reserved area called the MFT (Master File Table) - if this is damaged then it's unlikely anything can be done.

Professional data recovery services don't generally care what data they are recovering (unless it's something illegal e.g. child pornography etc, that they are legally obliged to report), your password list is likely far less important than some of the other data they likely process (e.g. government, banks, large businesses etc)

thanks for your response - so from what I understand from your first statement if using about 6 of these programs that I cant get file names or folders that a MFT or master file table was probably damaged which contains all info for all the file names and folders is that how it works?

 

[Armageus]

thanks for your response - so from what I understand from your first statement if using about 6 of these programs that I cant get file names or folders that a MFT or master file table was probably damaged which contains all info for all the file names and folders is that how it works?

Yes - the MFT is a separate area of the disk - it's essentially a "phone book" that lists all the information about files/folders on the disk, how to find the files. If this is damaged essentially the data is still "there somewhere".

File data is stored separately and the majority of which is easily identifiable due to unique file headers - this is what is allowing the data to be recovered.

 

[Quartz]

directory structure is stored in a reserved area called the MFT (Master File Table) - if this is damaged then it's unlikely anything can be done.

That's not correct. There are two copies of the MFT in NTFS.

 

[Armageus]

That's not correct. There are two copies of the MFT in NTFS.

Nope the "MFT Mirror" is just a partial copy, that assists in finding the actual MFT data in the event that the MFT header becomes damaged.

Master file table mirror - $MftMirr - 1 - Guarantees access to the MFT in case of a single-sector failure. It is a duplicate image of the first four records of the MFT.

The data segment locations for both the MFT and the backup MFT, $Mft and $MftMirr, respectively, are recorded in the boot sector. The $MftMirr is a duplicate image of either the first four records of the $Mft or the first cluster of the $Mft, whichever is larger. If any MFT records in the mirrored range are corrupted or unreadable, NTFS reads the boot sector to find the location of the $MftMirr. NTFS then reads the $MftMirr and uses the information in $MftMirr instead of the information in the MFT. If possible, the correct data from the $MftMirr is written back to the corresponding location in the $Mft.

https://technet.microsoft.com/pt-pt/library/cc781134(v=ws.10).aspx?f=255&MSPPError=-2147217396
https://whereismydata.wordpress.com/2009/06/05/forensics-what-is-the-mft-mirror/

 

[bledd]

Just restore it from your backu.....

 

[Semple]

Just restore it from your backu.....

Although kind of reminds me i need to review what i'm backing up / where it's going. A task for the weekend.

 

[bledd]

https://www.veeam.com/windows-endpoint-server-backup-free.html

This is excellent and free backup software, just need to register (free). Takes whole system or volume images.

 

[Cassie W]

I've experienced several times of data loss, due to virus attack, sudden power off or mistaken operation. That's really terrible! So, I've formed the habit of backing up the vital files every now and then in case of sudden accidents. Thanks for sharing the recovery tools.

 

[jaybee]

You could also try GetDataBack for NTFS - I've had success with this where everything else has failed, and if it doesn't work you're looking at professional data recovery services IMO.

It's not free, but the trial version should at least let you know if your data is recoverable.

If it works you can thank me by promising not to say "must have," again, ever, or indeed "should have," "could have" or any other of these horrible constructs used by the ever-growing army of marching morons.

I know this is an old thread resurrected and user CaptainCrash's post above seems to have been the last he made to OCUK, but I just wanted to show my appreciation for the recommendation of "getdataback for NTFS".
I had spent a fair bit of time trying to bring back several hundred GB of lost images this week mainly using EaseUS deep scanning after a HDD went very quickly close to full death. Using EaseUS the first time I tried it, the folder structure was preserved and I could see everything but then suddenly it could only recover RAW files without any properties or names, just spewed out from anywhere on the disk. The majority of files were corrupt.

I didn't hold much hope but had one go with "Getdataback for NTFS" and I seem to have made a full recovery of everything I wanted, including the original folder structures, naming and full file properties. Nothing I have found is corrupt. Remarkable given that the drive fails smart and has huge raw error failures, locks up my machine when connected over SATA (usb fine) and claims to have no partitions in windows computer management. It also worked pretty quickly.

Don't go through the pain....backup your data.

 

[wedrum]

Yup I always use getdataback works very well