File Recovery Software

Question

After using a lot of File Recovery Softwares, the only one that I found usefull was TestDisk with PhotoRec. But it lacks a GUI and is not suitable for recommendation to 'not advanced users'.

Please suggest a good File Recovery Software which is user friendly.

Usage Senarios: Someone formatted a hard drive? Filesystem corruption? Undelete a file?

A software which supports all these scenarios is an IDEAL Software. And just like most Ideal things, is unlikely to exist. Support for widely used filesystems like - NTFS, FAT and EXT are expected.

I am looking for "Formated HardDisk/Deleted Partition" and "Undelete a File". testDisk and PhotoRec can handle these situations well. I am looking for a GUI based alternative.

Basic Requirments:

• Filesystem Support - FAT, FAT32, NTFS
• Recover Deleted files from MemoryCard or PenDrive.
• Recover Deleted files from HDD on DeletedPartition.

A wizard driven approach is appreciated. And It should actually work. I have used software that shows the file names but after recovery, all the files are corrupt. Those very files, although with names messed up, were recovered by PhotoRec.

More features are appreciated but not necessary.

Answer 1

The sort of tool you are looking for is unlikely to exist. Understanding why is a big part of the issue.

File recovery is a very wide field. It includes things like:

1. Undelete a file
2. Oops, I formatted the partition
3. The filesystem is corrupt or disk is damged. What can I get off?

This excludes the more interesting/specialized cases like forensic analysis and the like. Additionally every tool out there is going to be filesystem specific. It is unlikely that a tool used to recover data from an ISO9660 CDROM will work on an NTFS hard drive. So for the general case, you won't find it. Sorry.

In the general case, it is also extremely important that someone who knows what to look for and adapt is running the file recovery. So advanced cases like damaged disks (and hence probably filesystem corruption) will in not be helpful in most cases. (Such tools exist for CDROMs though).

The complexity of recovering files also varies considerably by the filesystem.

For a simple undelete utility, I would probably recommend Recuva. It's well respected and easy to use. Unfortunately, it doesn't go beyond undelete scenarios.

Answer 2

Long story short, I've installed Ubuntu on one of the partitions on my external HDD where my personal data was saved. Installing Ubuntu means the partition was formatted from NTFS to FAT and added around 1GB of data.

However, I used File Scavenger Data Recovery Utility and it managed to restore my files that were on my HDD partition before installing ubuntu.

File Scavenger can recover data accidentally deleted, removed from the Recycle Bin and files on corrupted, deleted or reformatted partitions. Files are recovered with the original filename, folder path, and dates.

The process of searching and then recovering took in nearly 12 hours (1T HDD, 600GB partition, 180GB data recovered). While Scavenger was searching, it managed to find even older files that I wasn't in need to, therefore I had to select only the files which I wanted to recover (lucky me it was one main folder).

What I was quite happy about is that it managed to bring files with non-English text names. Means all of my files came again with their original names unlink other tools which brought my files in arbitrary file directories and names like __ _____ ____.pdf

A few percentage of the files were not retrieved (not important to me anyway) due to long file name, it seems those files were located into deep files hierarchy dir1/dir2/dir3/dir4.../img.jpg which prevented Scavenger from recovering it.

Answer 3

If it's not important that this software is free to use, I can suggest you Recover My Files. You can see its information in the below:

Website

Recover My Files

Main Features

• Improved partition recovery. Faster recovery speed and better validation of duplicate or invalid files.
• New file type signatures for File carving.
• Faster saving and loading of search results. Automatically validate search results.
• Create drive images in DD, E01 and AFF format.

Important Features

• Enable a user to accurately determine if their files can be recovered prior to purchasing a license. This is primarily achieved via the display window which shows the content of files found.
• It will not alter the contents of a drive being searched. Recover My Files is designed as a data recovery tool, NOT a drive repair tool. It will not write to or change the content of the original hard drive. If Recover My Files is not the solution, the user can seek a new solution without any change to the status of the problem drive.

What it can Recover

• Deleted Files (including files emptied from or bypassing the Windows Recycle Bin)
• Missing files lost through the corruption of a Windows file-system; Formatted Drives
• RAW Drives
• Corrupt Drives
• Unallocated Drives
• Missing Drive Letters
• Data lost through a Windows Operating System reset or reinstall.

Supported Media

• Hard drives, including external USB drives
• USB sticks, Thumb Drives, Pen drives or other USB media Camera cards
• Hardware and software RAID (JBOD, RAID 0,1,5)
• iPods, MP3 players and Dictaphones

Supported File-Systems

• Windows FAT12/16/32/exFAT, NTFS, file-systems
• Macintosh HFS, HFS+ file-systems

Supported Drive Image Formats

• DD or RAW
• EnCase®.E01
• Safeback® v2
• Forensic File Format .AFF
• SMART®
• VMWare®
• ProDiscover®
• Microsoft VHD
• Apple DMG

Answer 4

I recover data to earn my bread and butter and have developed file recovery and was involved in developing file recovery software. Currently my what I do mainly is photo recovery (memory cards) and photo repair.

I'd like to start explaining how in certain situations a raw scanner like PhotoRec can be successful while a fancy commercial tool isn't:

File system based recovery

Most of those fancy tools will try to reconstruct a 'virtual file system', complete with filenames and folder structure. So most file systems have certain structures to store things like the filename, file size, a 'parent' and a pointer to the actual file data. Finding those isn't rocket science, and so as long as those file system structures are present it is often possible to create a folder tree complete with filenames etc..

If these structures can not be found then only a carver (like PhotoRec) may work but I'll get to that later.

However, for the pointer I mentioned to work certain meta parameters need to be correctly determined! File systems divide the file system into 'blocks' in many file systems referred to as 'clusters'. These clusters have a certain size (like for example 8 sectors) and so we can convert any cluster number to an actual LBA sector address. But for this to work we need to know:

• clustersize
• start of the data area from which we can start counting

If one of these two is incorrectly determined a tool may very well be able to construct a folder file list, but each time we recover a file, the recovered file is corrupt. The pointer may correctly refer to a cluster, if we start however counting from the wrong point, or we get the the cluster size wrong, we get some arbitrary data.

Normally these values (file system offset and clustersize) can be easily read from the boot sector BPB, however file recovery software should not rely on this single point of failure, it may after all be data loss caused by the boot sector being corrupt in the first place!

Even if we have the correct clustersize and offset to start counting, a corrupt file allocation table in the case of a FAT based file system may prevent a file to be recovered using such a file system based recovery tool where a raw scan tool like PhotoRec can potentially recover the file. Below files were recovered using file system based tool from a FAT32 memory card where FAT was corrupt. As we can see all files are corrupt. Using a raw scan tool 95% of the files was recovered intact!

RAW or signature based recovery

PhotoRec is a tool that detects files based on a file signature and for the most part it ignores file system parameters.

For the most part because file system offset and cluster size are still useful:

A raw scanner scans the drive for signatures, for example FF D8 FF to locate JPEG files. These signatures tend to be close to the start of the file and since files start at cluster boundaries we can reduce the amount of places to look for a signature if we know cluster size and file system offset. If these are unknown we can look at sector boundaries but the scan will be slower.

We immediately run into the drawbacks of the method:

• FF D8 FF is not an exclusive byte sequence we we may see false positives
• For many file types we can not reliably determine end of file
• Fragmented files can not be recovered easily

A tool like PhotoRec scans for many file types. Now suppose it detected the start of a JPEG (FF D8 FF) but now runs into byte sequence 49 44 33 which happens to be the signature for an MP3 file but can also be some random byte sequence inside JPEG data.

A raw scanner may now decide it has found the next file and therefor close the JPEG which is incompletely recovered as a consequence.

So we see file system based recovery has advantages and drawbacks, but so has raw or signature based file recovery. In general I'd always first try file system based recovery as it offers many advantages such as recovery of filenames and folder structure and depending on file system even fragmented files can be easily recovered.

So, best file recovery software ..

First of all the best file recovery software is the one that is very good at file system reconstruction but also offers raw recovery as a fallback option.

All software I recommend is used by actual data recovery engineers in labs for logical file recovery. Because it is, this software greatly benefits from feedback based on many real world data loss scenarios. Also, all this software is 64 bit so it can handle millions of files and supports multi disk configurations (RAID and NAS).

The consumer version of a tool like R-Studio is the exact same as the more expensive TECH version, just some features that you may not need have been disabled. The consumer version of ReclaiMe uses the same engine as the professional version but the interface is completely redesigned for ease of use and makes decisions automatically where the Pro version allows more tweaking.

Both R-Studio and ReclaiMe also do a raw scan but handle results slightly different: If ReclaiMe detects a file by both file system and raw scan, it will remove raw scan result for this file. R-Studio allows you to recover both.

My recommended file recovery software:

[OS Support] {File System Support]

R-Studio. Used by many pros for logical data recovery. Moderately difficult to use, website is r-tt.com (else you may find entirely different product by same name). [Mac/Win/Lin]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT}

GetDataBack. For some issues and file systems the goto tool for quite a few data recovery pros. Moderately difficult to use. [Win]{FAT|NTFS|HFS+|APFS|EXT}

ReclaiMe. This is the end user version that’s based on the Pro version used by pros. Super easy to use. [Win]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT|BTFRS|XFS}

UFS Explorer. Goto tool for many pros. Moderately difficult to use. [Win]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT|BTFRS|XFS}

DMDE. Another favorite for some pros and yet very inexpensive! If you’re new to this, this tool can be quite overwhelming. Be warned that this tool can write to patient drive. [Mac/Win/Lin]{FAT|NTFS|HFS|HFS+|APFS|EXT}

FileScavenger. Not mentioned very often but definitely worth it IMO. Quite simple to use in standard situations. [Win]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT|BTFRS|XFS}