I recover data to earn my bread and butter and have developed file recovery and was involved in developing file recovery software. Currently my what I do mainly is photo recovery (memory cards) and photo repair.
I'd like to start explaining how in certain situations a raw scanner like PhotoRec can be successful while a fancy commercial tool isn't:
File system based recovery
Most of those fancy tools will try to reconstruct a 'virtual file system', complete with filenames and folder structure. So most file systems have certain structures to store things like the filename, file size, a 'parent' and a pointer to the actual file data. Finding those isn't rocket science, and so as long as those file system structures are present it is often possible to create a folder tree complete with filenames etc..
If these structures can not be found then only a carver (like PhotoRec) may work but I'll get to that later.
However, for the pointer I mentioned to work certain meta parameters need to be correctly determined! File systems divide the file system into 'blocks' in many file systems referred to as 'clusters'. These clusters have a certain size (like for example 8 sectors) and so we can convert any cluster number to an actual LBA sector address. But for this to work we need to know:
- clustersize
- start of the data area from which we can start counting
If one of these two is incorrectly determined a tool may very well be able to construct a folder file list, but each time we recover a file, the recovered file is corrupt. The pointer may correctly refer to a cluster, if we start however counting from the wrong point, or we get the the cluster size wrong, we get some arbitrary data.
Normally these values (file system offset and clustersize) can be easily read from the boot sector BPB, however file recovery software should not rely on this single point of failure, it may after all be data loss caused by the boot sector being corrupt in the first place!
Even if we have the correct clustersize and offset to start counting, a corrupt file allocation table in the case of a FAT based file system may prevent a file to be recovered using such a file system based recovery tool where a raw scan tool like PhotoRec can potentially recover the file. Below files were recovered using file system based tool from a FAT32 memory card where FAT was corrupt. As we can see all files are corrupt. Using a raw scan tool 95% of the files was recovered intact!
RAW or signature based recovery
PhotoRec is a tool that detects files based on a file signature and for the most part it ignores file system parameters.
For the most part because file system offset and cluster size are still useful:
A raw scanner scans the drive for signatures, for example FF D8 FF to locate JPEG files. These signatures tend to be close to the start of the file and since files start at cluster boundaries we can reduce the amount of places to look for a signature if we know cluster size and file system offset. If these are unknown we can look at sector boundaries but the scan will be slower.
We immediately run into the drawbacks of the method:
- FF D8 FF is not an exclusive byte sequence we we may see false positives
- For many file types we can not reliably determine end of file
- Fragmented files can not be recovered easily
A tool like PhotoRec scans for many file types. Now suppose it detected the start of a JPEG (FF D8 FF) but now runs into byte sequence 49 44 33 which happens to be the signature for an MP3 file but can also be some random byte sequence inside JPEG data.
A raw scanner may now decide it has found the next file and therefor close the JPEG which is incompletely recovered as a consequence.
So we see file system based recovery has advantages and drawbacks, but so has raw or signature based file recovery. In general I'd always first try file system based recovery as it offers many advantages such as recovery of filenames and folder structure and depending on file system even fragmented files can be easily recovered.
So, best file recovery software ..
First of all the best file recovery software is the one that is very good at file system reconstruction but also offers raw recovery as a fallback option.
All software I recommend is used by actual data recovery engineers in labs for logical file recovery. Because it is, this software greatly benefits from feedback based on many real world data loss scenarios. Also, all this software is 64 bit so it can handle millions of files and supports multi disk configurations (RAID and NAS).
The consumer version of a tool like R-Studio is the exact same as the more expensive TECH version, just some features that you may not need have been disabled. The consumer version of ReclaiMe uses the same engine as the professional version but the interface is completely redesigned for ease of use and makes decisions automatically where the Pro version allows more tweaking.
Both R-Studio and ReclaiMe also do a raw scan but handle results slightly different: If ReclaiMe detects a file by both file system and raw scan, it will remove raw scan result for this file. R-Studio allows you to recover both.
My recommended file recovery software:
[OS Support] {File System Support]
R-Studio. Used by many pros for logical data recovery. Moderately difficult to use, website is r-tt.com (else you may find entirely different product by same name). [Mac/Win/Lin]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT}
GetDataBack. For some issues and file systems the goto tool for quite a few data recovery pros. Moderately difficult to use. [Win]{FAT|NTFS|HFS+|APFS|EXT}
ReclaiMe. This is the end user version that’s based on the Pro version used by pros. Super easy to use. [Win]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT|BTFRS|XFS}
UFS Explorer. Goto tool for many pros. Moderately difficult to use. [Win]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT|BTFRS|XFS}
DMDE. Another favorite for some pros and yet very inexpensive! If you’re new to this, this tool can be quite overwhelming. Be warned that this tool can write to patient drive. [Mac/Win/Lin]{FAT|NTFS|HFS|HFS+|APFS|EXT}
FileScavenger. Not mentioned very often but definitely worth it IMO. Quite simple to use in standard situations. [Win]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT|BTFRS|XFS}
