How To: Recover lost data

Do you need to recover lost files, photos or documents? You're sure that a file was on your hard disk some time ago, but now you have lost it. Perhaps you archived some files or photos to CD or DVD to save disk space, and now the disk is corrupt or unreadable? Or perhaps your computer won't boot up, and you don't have a backup!

It may seem as if all your precious files are lost. But don't panic! Your data is almost certainly still on your hard drive somewhere. This article will help you choose the best method for restoring them.

Quick guide to the right recovery tool

For Windows users:

The DiskInternals Data Recovery Boot CD contains most of the above tools.

For Apple Mac users:

To get an understanding of the chances of recovering lost data, and an appreciation of how data recovery programs work, it helps to know a little bit about file systems. This article explains file systems in very general terms.

Recycle Bin

Modern operating systems provide protection against accidentally deleting files. In Windows, it's called the Recycle Bin. If you think you have deleted a file that you desperately need, the Recycle Bin should be the first place that you look.

The System Restore feature of Windows Millennium, Windows XP and Windows Vista is another useful tool that is often overlooked. However, it is usually of no help at all when you want to recover a deleted file. System Restore was developed specifically to restore system files back to an earlier state. It was intended to be used when a software update, installation or removal has an adverse effect on the system, and you want to roll things back to a point in time when everything worked. It would be very annoying if, when you did this, System Restore removed your latest letters, emails and other documents as well. So System Restore ignores file types associated with office documents, photo images, music files and other things that are of interest to you. It doesn't back them up in a Restore Point, so it can't restore them.

If you have lost an important program or system file, System Restore may be able to help. For other files of types that you create, it won't.

If your PC won't boot

If your computer won't start up then you may think that all your files are lost. However, the chances are very good that your files are still on the hard disk, and haven't even been deleted!

All you probably need to do in this case is read the disk using another computer, so you can copy the files you need to a safe place. One way to achieve this, if you're a bit technically minded, is to take the hard drive out of the broken computer, reconfigure it as a slave, and put it temporarily into another computer as a second drive. Alternatively you could attach the drive to another computer using a USB-to-ATA adapter.

If you aren't keen on the idea of taking computers apart then you can connect the faulty computer to a good one using a network cable and use a data rescue software such as Selkie Rescue.

If this doesn't work then the partition table may be damaged, preventing the rescue software from finding the data. In this case, we would recommend that you try Partition Recovery.

Recover lost files

If the files you lost aren't in the Recycle Bin and cannot be restored using System Restore, you'll need some do it yourself data recovery software. If a file has only recently been deleted or the Recycle Bin has recently been emptied then the data is still likely to be on the disk. In this situation an undelete or unerase tool like Uneraser for Windows or Data Rescue II for Mac should be able to restore it.

For the best chance of a successful recovery it pays to use the best recovery tools. Many of the data recovery products that are advertised work in a very simplistic manner. They search for old directory entries belonging to files that have been erased, and assume that the data is still in the same place it was when the file was deleted. However, the disk clusters that belonged to the file may have been re-used by other files, or they may have moved because the disk was defragmented. There isn't anything you can do to recover a file once the data has been overwritten, which is why it is important to stop using the computer as soon as you realise data has been lost, to avoid any more writes to the drive than have occurred already.

New! Data recovery boot CD

Now you can create a boot CD and recover lost files without risk of overwriting the hard drive. You can even recover data from drives that are unreadable. More information...

The more technically advanced data recovery programs use forensic techniques such as DiskInternals' Power Search Technology. This greatly improves the chances of recovering lost data files, even after a disk has been defragmented.

Data recovery products that use forensic methods typically find hundreds or thousands of potentially recoverable files, many of which are incomplete or invalid. This can make recovery a lengthy task, as you need to hunt through all of these files to find the ones you are looking for. To make this task as easy as possible, the DiskInternals recovery software for Windows incorporates two essential features. Filters can be used to refine the list of files displayed using content found in the files. And a preview feature lets you view photo images and play music files prior to recovery.

When data is lost on a badly fragmented hard disk, recovery may only be possible by piecing together fragments of the file scattered across the hard drive. When this is the case a human data recovery specialist can do a better job than software. If an analyst sees that, for example, a Microsoft Word document stops half way through a sentence, he can search the entire hard disk for a cluster that contains what are likely to be the next words. Data recovery services are skilled at piecing together files from fragments of data, but their work is expensive. Your data must be worth a lot of time or money for it to be worth seeking their help. If you want to try doing this kind of data recovery yourself, get RecoverSoft Media Tools Professional

Recovering photos

Specialist data recovery software can speed up the process and improve the chances of success by searching just for specific file types. Using forensic techniques they can locate lost files on otherwise unrecoverable disks.

Photo recovery software will know, for example, that a JPG image file will start with the characters "JFIF". Following that is a header that gives more information about the file, such as its length. The software will scan the disk looking for a cluster that starts with "JFIF", determine the expected file length, and then read as many clusters as necessary to create a file of that length.

However, the recovered images will be corrupt if the file was fragmented. Because the data stream in a photo image file is essentially random, it isn't as easy to piece together a file from fragments in the way that you can for a text-based document. Because of this, the chances of success are probably no greater using a data recovery service than if you use good quality photo recovery software.

When choosing a photo recovery tool, note that it may be specialized as to the type of media it can handle, as well as the type of file. So, for example, Flash Recovery will recover digital images from your camera's memory card, but not those you burned to CD. For Apple Mac users, PhotoRecovery for Mac OSX is an excellent equivalent.

For more about photo recovery see How To: Recover Photos.

Recovering Microsoft Office documents

A common requirement is to recover lost Microsoft Office documents. Specialized Microsoft Office document recovery software has built-in logic that understands the structure of Office documents and can recognize fragments of them in order to recover lost files. Office Recovery is the product to use if you need to recover many different types of Office file. If you only need to recover lost Microsoft Word documents you can use Word Recovery or DOC Regenerator while for Excel worksheets, use Excel Recovery or XLS Regenerator. These products are available for free trial, so you can assess the likely chances of a successful recovery before buying.

Recovering emails

Individual messages in your mail folders are not stored as individual files. Each mail folder containing multiple messages is a single file in the file system, so the techniques for recovering files cannot be used to recover lost emails.

Emails are stored as entries in a database file which represents an entire folder. When an email is deleted, it may be removed to a special deleted messages folder, depending on the preferences you set. This gives you a chance to recover deleted emails, just like the Recycle Bin for files. The space the email originally occupied is left vacant until the email program performs folder maintenance or compacting, which reduces the size of the database file by eliminating this vacant space. When the copy of the deleted email is purged from the deleted messages folder, the space it occupied in that folder is also left vacant until maintenance of that folder occurs.

Before compacting, the text of deleted emails has not been overwritten, and the emails are recoverable using specialist email recovery software. The deleted messages may be recoverable from the folder they were originally in, or from the deleted messages folder. After compacting, the contents of the deleted emails are overwritten by other emails, so there is little chance of successfully recovering them.

If a mail folder database becomes corrupted, the data content may still exist, but the structure of the file may be wrong so that the mail software cannot list the messages. Again, specialist recovery software is usually needed to locate the data and recover the messages.

Because different mail programs store data in different formats, you must use a data recovery tool that supports the mail software you are using. For Outlook Express or Windows Mail, Mail Recovery is effective and easy to use. For Microsoft Outlook files, you need the rather more expensive Advanced Outlook Repair. Mozilla Thunderbird mail folders are plain text files, so the contents may be recoverable using a text editor.

Recovering music

Just as with photos and Office documents, the use of specialist music recovery software to recover lost MP3s, WMA files and so on has several advantages. These products know what the headers of MP3, WMA, OGG etc. files look like, and understand their internal format. They can find these files long after they were deleted, and can use ID tags in the recovered files to help identify the music.

For Windows users a good recovery tool is Music Recovery or Recovery for iPod, which is a skinned version of Music Recovery for iPod users. These programs have a built-in player, allowing you to identify the song and check that it can be recovered without corruption. If you're a Mac user then use Tune Tech for iPod.

Formatted and damaged media

Even if a disk has been formatted, the chances of recovering the files that were on it are good. Formatting a disk destroys the root directory, so the names of the files and folders within it are lost. However, the root directory normally holds only a few system files, which are easily restored, and the top-level folders. Data recovery software can identify the data blocks that were used to store the top-level folder directory lists because they have a characteristic pattern. Since hard disk formatting is non-destructive, these top-level folders and their contents (including all the subfolders) can be recovered intact. All you need to do is supply the original folder names, and all your data is back! The tools we recommend are Partition Recovery (or you can use NTFS Recovery or FAT Recovery if you are certain which file system the drive used.)

If a hard drive has failed then again the chances of recovery are good. It may be that only the controller has failed (the electronic circuit board underneath the drive) and the disk itself is perfect. The data may be recoverable simply by replacing the controller board by one from an identical make and model of drive.

If the disk is damaged, then recovery of at least some of the data should be possible, since it would be an unusual failure that wiped all the data from the disk. Windows has a fairly low tolerance of disks with unreadable sectors. Specialist data recovery software, often running at a lower level using a Linux kernel or MS-DOS, can try various tricks to try to read unreadable data, or at least get past the bad blocks that may be preventing Windows from getting at other files. A good example of such a product is HDD Regenerator which can rejuvenate a drive with bad sectors in about 60% of cases.

Most of the products mentioned in this article run under Microsoft Windows or Mac OS X and have easy to use graphical interfaces that allow them to be used by non-experts. In most cases they can recover data successfully. Sometimes, however, it can be advantageous to use data recovery software that addresses the hard drive controller directly, and provides options to examine the raw data on the drive. If you know a bit about hard drive technologies and file systems then you should be able to use RecoverSoft Media Tools Professional. It is a powerful data recovery toolkit and is used by many professional data recovery services.

In some cases, the damage may beyond the ability of the drive controller to cope with, even using special software, or the drive mechanism may have failed completely. Even then, it is usually possible for a data recovery specialist to recover the data from the disk, either by rebuilding the drive, or by taking the magnetic platters out of the drive casing and reading them using special equipment. But this kind of operation is expensive, and only worth the cost if the data is valuable.

RAID arrays

Many servers and even high-end workstations make use of RAID arrays (Redundant Array of Inexpensive Disks) to increase storage capacity and access speed or provide greater immunity to errors. RAID arrays built only for speed actually increase the probability of data loss: if there are four drives in the array then the chances of failure are four times greater.

There can be other causes of data loss associated with RAID arrays. If the configuration metadata is lost or corrupted then the disk controller does not know how to access the drives in the array. If a RAID disk controller fails, it may not be possible to replace it with one of the same type, and the replacement controller may not recognize the configuration data written by the old one. Similar issues can arise with software RAID (Windows Dynamic Disks) if the database is lost or corrupted.

In this event, you need a specialist data recovery tool that knows how to access an array of disk drives as a RAID array, overriding if necessary the hardware controller. RAID Recovery can automatically detect, reconfigure and repair damaged RAID arrays in many cases. If not, it allows you to specify the configuration. If one or more drives are too badly damaged for the array to be repaired then the product allows you to recover the data to a new storage location.

CD and DVD recovery

Writeable CDs and DVDs are now a popular backup and archival media, especially for digital photo images which take up a lot of space on the hard disk. But as many people have found, it's easy to corrupt multi-session and rewriteable disks so that they can't be read at all by Windows. And they only made the one copy! However, the data can still be recovered with the aid of the right tools.

CDs and DVDs use different file systems than hard disks, so data recovery programs designed specifically for hard disks cannot be used. You need to use specialist programs for CD and DVD data recovery, such as CD & DVD Recovery. Data written to CD-R and DVD-R media cannot be fragmented, so as long as the disk is not physically damaged and can be read, the chances of recovery are good.

Related products