1

I am looking for a Windows tool that tries to find & recover all deleted files on a NTFS hdd (including healthy parts of partially overwritten files).

From my experience, results greatly vary.
What undelete software have you achieved the best recovery rates with ?

(freeware preferred, payware also acceptable)

0

3 Answers 3

3

I have used Recuva to recover deleted files on Windows boxes.

It generally works well. It's easy to use, and has a minimal learning curve.

My big complaint with it is that for years they offered a portable version. Without notice, they pulled the portable version from their website.

Hopefully someday they will come to their senses and release a portable version again. This is especially important for undelete software, since you don't want to have to run an installer that may write to the media on which you want to recover data.

2
  • thanks. +1. tip: you can extract the files from setup.exe with 7-zip. Other solution: Once installed you can copy the install dir to an USB stick: recuva.exe runs without installation.
    – summerrain
    Commented Jan 15, 2022 at 18:02
  • 1
    @summerrain You're welcome, and thank you for the tips! Note that it will not likely affect recovery, but IIRC, the non-portable version of Recuva will write to the Windows registry. That's not desirable for many people, but it can only affect recovery in the exceptionally rare case of those registry writes increase the number of clusters occupied by the registry and overwriting clusters containing data you want to recover. Commented Jan 16, 2022 at 3:44
1

getdataback for ntfs could be helpful. An other solution could be EaseUS Data Recovery Wizard. but don´t expect a 100% recovery from both. Also the files that can be recovered should be big enough, some small text file both programms were unable to recover.

0

I am looking for a Windows tool that tries to find & recover all deleted files on a NTFS HDD.

Disclosure: I recover data for bread and butter. IOW it's my job. I wrote NTFS file recovery tools myself a while ago.

NTFS and undelete type recovery

File undelete from NTFS is actually pretty straight forward and any half decent undelete / file recovery tool should be able to do this. So, in general different tools will give very comparable results.

For undelete type file recovery from NTFS we need..

  • MFT entry
  • The actual data

.. to be intact.

If we don't have MFT entry, the file recovery or undelete tool can not detect the file. Without the actual data we can recover the file but it will be corrupt.

Once a file is deleted in NTFS, it's simply flagged in the MFT entry. Also, if the file isn't sent to the recycle bin, the clusters allocated to the file are flagged as not in use in the NTFS Bitmap.

This means the MFT entry can be re-used at any point in time, as well as the clusters. It may be so that ..

  • the clusters are re-used while the MFT entry isn't -> file can be recovered but is corrupt.
  • the MFT entry is re-used while the clusters aren't -> typical undelete software can not detect the file
  • both are re-used -> the file is unrecoverable by any means

On a live, in use file system there's a good chance some component of the file we need to 'undelete' is overwritten and thus becomes unrecoverable. So, if the file is vital you need to prevent this from happening by taking the volume/drive off-line.

So, are all tools equal?

As I said, NTFS undelete is quite straight forward, we can scan the MFT and look for entries flagged 'not-in-use'. If a file is deleted the 'data-runs' aren't modified so it keeps pointing to all original clusters that were allocated to the file. Also, file entry points to parent folder, so IF we find the MFT entry we have everything to recover the file with original filename + parent folder(s).

A special case are the resident files: Small files that entirely fit into a NTFS file record (which is BTW 1024 bytes in size) as can be seen here:

example of resident file data in MFT entry

Anyway, I am arguing any half decent file recovery tool should be able to recover actually recoverable files where we have both the MFT entry and the clusters that were allocated to the file. At the same time, any tool will have a problem if for example clusters that were allocated to the file were (partially) re-used.

Still, we see differences where tool A does arguably better than tool B, example here: https://youtu.be/IpbrQBgRdEs. In this example one tool is commercial software that's used by data recovery specialists for logical data recovery, while the other is free for personal use.

Drives that support TRIM

Since more and more drives support TRIM (SSD, SMMR drives) we can not ignore the effect on recovery of deleted files. As a rule of thumb recovery of deleted files from trimming drives is close to impossible.

We may be able to detect files (the MFT entries themselves aren't trimmed), but the data clusters are: https://youtu.be/NyLQbxnPurc.

Only tiny files that are resident and that entirely reside in the MFT entry may be recoverable.

In case deleted data is needed for for example a forensic case:

My software recommendation

I personally use DMDE on a daily basis. It may not be for the faint of heart but it allows me to see what's going on at the file system level.

If you only need to recover a few deleted files, you can use the free DMDE demo. The free demo allows:

  • recovery of upto 4000 files per session. If you'd to recover more files, you have to re-open the drive.
  • another limitation is that it will only allow you to select one folder, so all files you need to recover should reside in the same folder. If they're not you need to re-open the drive for each folder.

So, IOW, if you need to recover 1000 files you deleted from drive:\mypictures\vacation2022, the free version is all you need.

To make DMDE detect and display deleted files (or better said files flagged as deleted) see: https://youtu.be/sKpUiRDpLM8

In short:

  • Select drive, click 'Open Volume'
  • Click All Found / Virtual File System
  • Select Pure FS and make sure 'deleted' is ticked
  • OK

Other tools data recovery labs tend to use for logical file recovery are R-Studio and UFS Explorer.

URL's:

This tool I made a while ago, but no longer maintain it. It lacks exFAT support and by no means I claim it's anything close to the best, but it's free and you're welcome to it: https://www.disktuna.com/fdrhelp/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.