How To: Data Recovery
Do you need to recover lost files, photos or documents? You're sure that a file was on your hard disk some time ago, but now it seems to have disappeared? Perhaps you archived some files or photos to CD or DVD to save disk space and now the disk is corrupt or unreadable? Or perhaps your computer won't boot up, and you don't have a backup!
If this is the situation then it may seem as if all is lost. But don't panic! Your data is almost certainly still on your hard drive somewhere, and can almost certainly be recovered. To get the best chance of a successful data recovery you just need to choose the right tool for the job. This article will help you find your way through the maze of data recovery software to find the right product for your particular recovery task.
Recover deleted files
Accidental deletion is the most common cause of lost data. Modern operating systems provide protection against accidentally deleting files. In Windows, it's called the Recycle Bin. It's basically a special folder to which files are moved when they are deleted. As far as the operating system is concerned files that are deleted to the Recycle Bin are not really deleted at all. If you think you have deleted a file, the Recycle Bin should be the first place that you look.
If you empty the Recycle Bin, or Shift+Delete a file, then the file becomes deleted as far as the operating system is concerned. The file disappears from any folder listing and the disk space occupied by the data becomes available for re-use. But the data is not physically erased from the disk. The disk space still contains the data. And it is not re-used immediately. What data recovery products do is find ways to locate this data so that the files can be undeleted or unerased.
When files are deleted, a lot of pointers to the data are still left lying around. Because of this, recovering deleted files can be treated as a special case as far as data recovery goes. It's a lot quicker than a full data recovery, which requires locating the contents of lost files with no additional pointers at all. Some data recovery tools will only recover deleted files. A separate article, How To: Recover deleted files, deals specifically with this more common but simpler case.
Recover lost files
If a file was deleted a long time ago, or if a drive has been formatted, repartitioned, restored from a backup or damaged by a destructive virus then a full data recovery will be necessary. The essential difference between this and a deleted files data recovery is that it is assumed that the existing file system will contain no information at all about the lost data. So the data recovery software scans the raw data on the drive looking for clues that your files existed.
If your data still exists on the drive then this type of data recovery will usually find it. However, it will find a lot of incomplete file fragments as well, which in most cases are useless. The data recovery software will also not be able to tell you the filename of any of the files it finds by this method, because that information comes from the file system.
You will need to do a lot of work hunting through the results of the data recovery to find the files you are looking for. So it helps to choose a data recovery product that can make this task a bit easier for you, by providing searching and filtering tools and a good preview function.
To recover lost files we recommend Partition Recovery for Windows. This has the best searching and previewing capabilities of any data recovery software we are aware of. To save some cost, if you know the file system that was in use on the drive containing the lost files, you can use FAT Recovery or NTFS Recovery, which have similar functionality to Partition Recovery but are limited to one type of file system.
Data Recovery Wizard is a simpler data recovery tool that can also perform a full lost file recovery. However it has more limited searching and previewing features than the products mentioned above.
For Apple Mac users, we recommend File Recovery for Mac. As with the Windows data recovery products, there's a free demo so you can see whether you can recover your files before buying it.
Lost volumes or partitions
If some of your drives or partitions have disappeared, either unexpectedly or due to a mistake with FDISK or a partition manager, they should easily be recoverable. Partition recovery tools work by scanning the disk looking for the tell-tale signs of the start and end of pre-existing partitions. They present a list of what they have found. You then select the option that matches the description of the partition that was missing, and the software reconstructs the partition using this information. Normally, all the files will magically reappear at the same time.
Even if a disk has been accidentally formatted, the chances of recovering the files that were on it are good. Formatting a disk destroys the root directory, so the names of the files and folders within it are lost. However, the root directory normally holds only a few system files (which are easily restored) and the top-level folders. Data recovery software can identify the data blocks that were used to store the top-level folder directory lists because they have a characteristic pattern. Since hard disk formatting is non-destructive, these top-level folders and their contents (including all the subfolders) can be recovered intact. All you need to do is supply the original folder names, and all your data is back!
To recover lost partitions we recommend DiskPatch or Partition Table Doctor for Windows. Alternatively you could use Data Recovery Wizard or Partition Recovery which can not only restore lost partitions but also also recover lost files from partitions that are unrecoverable. If you're a Mac user, try File Recovery for Mac.
Computer won't start up
If your computer won't start up at all then the partition table or boot records may have been corrupted. To repair them, create a recovery disk using DiskPatch and use its repair tools to rebuild the master boot record (MBR), boot sector and partition table. Another similar recovery tool is Partition Recovery Boot CD
To use Windows data recovery tools when the computer won't boot up, you'll have to take the hard drive out of the computer and either reconfigure it as a slave and put it temporarily into another computer as a second drive, or attach the drive to another computer using a USB-to-ATA adapter. Alternatively you could run Partition Recovery from the Data Recovery Boot CD.
Disk errors (bad sectors)
If your computer complains about read or write errors or bad sectors then it's a sure sign that your hard disk is failing. One option, especially if the errors are affecting important files, is to try to repair the drive using HDD Regenerator. If this is unsuccessful or you just want to transfer your files to a new drive as quickly as possible then the cloning feature of DiskPatch will get this done without wasting time attempting to read those unreadable sectors.
Recovering photos
Specialist data recovery software can speed up the process and improve the chances of success by searching just for specific file types. Using forensic techniques they can locate lost files on otherwise unrecoverable disks.
Photo recovery software will know, for example, that a JPG image file will start with the characters "JFIF". Following that is a header that gives more information about the file, such as its length. The software will scan the disk looking for a cluster that starts with "JFIF", determine the expected file length, and then read as many clusters as necessary to create a file of that length.
However, the recovered images will be corrupt if the file was fragmented. Because the data stream in a photo image file is essentially random, it isn't as easy to piece together a file from fragments in the way that you can for a text-based document. Because of this, the chances of success are probably no greater using a data recovery service than if you use good quality photo recovery software.
When choosing a photo recovery tool, note that it may be specialized as to the type of media it can handle, as well as the type of file. So, for example, Flash Recovery or Photo Recovery will recover digital images from your camera's memory card, but not those you burned to CD. For Apple Mac users, PhotoRecovery for Mac is an excellent equivalent.
For more about photo recovery see How To: Recover Photos.
Recovering Microsoft Office documents
Microsoft Office is widely used to create important documents. When a Word document or Excel spreadsheet that took hours or days to prepare becomes unreadable or disappears it can be a serious problem. However you will not be short of help, as an industry has grown up providing tools for Microsoft Office document recovery. When choosing software to recover Microsoft Office documents it is important to distinguish between tools that can repair files that exist but are corrupt or damaged and tools that can recover documents that have been deleted or lost.
If you need to repair a damaged Microsoft Office document then Cimaware's suite of Microsoft Office repair tools, OfficeFIX, is regarded as one of the best on the market and is frequently recommended by Microsoft MVPs in Microsoft Office support forums. If you have a single document to repair then the tools in this suite such as WordFIX and ExcelFIX are available separately.
If you need to recover a lost Microsoft Office document then Office Recovery is your best choice. This can be used to recover files created by all the main Microsoft Office applications. Again, there are versions to recover a single Office document type - Word Recovery, Excel Recovery, Outlook Recovery and Access Recovery - at a lower cost.
All of the Microsoft Office recovery tools mentioned are available for free trial, so you can assess the likely chances of a successful recovery before buying.
Recovering emails
Individual messages in your mail folders are not stored as individual files. Each mail folder containing multiple messages is a single file in the file system, so the techniques for recovering files cannot be used to recover lost emails.
Emails are stored as entries in a database file which represents an entire folder. When an email is deleted, it may be removed to a special deleted messages folder, depending on the preferences you set. This gives you a chance to recover deleted emails, just like the Recycle Bin for files. The space the email originally occupied is left vacant until the email program performs folder maintenance or compacting, which reduces the size of the database file by eliminating this vacant space. When the copy of the deleted email is purged from the deleted messages folder, the space it occupied in that folder is also left vacant until maintenance of that folder occurs.
Before compacting, the text of deleted emails has not been overwritten, and the emails are recoverable using specialist email recovery software. The deleted messages may be recoverable from the folder they were originally in, or from the deleted messages folder. After compacting, the contents of the deleted emails are overwritten by other emails, so there is little chance of successfully recovering them.
If a mail folder database becomes corrupted, the data content may still exist, but the structure of the file may be wrong so that the mail software cannot list the messages. Again, specialist recovery software is usually needed to locate the data and recover the messages.
Because different mail programs store data in different formats, you must use a data recovery tool that supports the mail software you are using. For Outlook Express or Windows Mail, Mail Recovery Express is effective and easy to use. To recover Microsoft Outlook files try OutlookFIX or Outlook Recovery. Mail Recovery is another option that can be used to recover email from several email clients including Outlook, Outlook Express, Windows Mail, Mozilla Thunderbird and The Bat!
Recovering music
Just as with photos and Office documents, the use of specialist music recovery software to recover lost MP3s, WMA files and so on has several advantages. These products know what the headers of MP3, WMA, OGG etc. files look like, and understand their internal format. They can find these files long after they were deleted, and can use ID tags in the recovered files to help identify the music.
For Windows users a good recovery tool is Music Recovery or Recovery for iPod, which is a skinned version of Music Recovery for iPod users. These programs have a built-in player, allowing you to identify the song and check that it can be recovered without corruption. If you're a Mac user then use File Recovery for Mac.
Failed drives
If a hard drive has failed then again the chances of recovery are good. It may be that only the controller has failed (the electronic circuit board underneath the drive) and the disk itself is perfect. The data may be recoverable simply by replacing the controller board by one from an identical make and model of drive.
In some cases, the damage may beyond the ability of the drive controller to cope with, even using special software, or the drive mechanism may have failed completely. Even then, it is usually possible for a data recovery specialist to recover the data from the disk, either by rebuilding the drive, or by taking the magnetic platters out of the drive casing and reading them using special equipment. But this kind of operation is expensive, and only worth the cost if the data is valuable.
RAID arrays
Many servers and even high-end workstations make use of RAID arrays (Redundant Array of Inexpensive Disks) to increase storage capacity and access speed or provide greater immunity to errors. RAID arrays built only for speed actually increase the probability of data loss: if there are four drives in the array then the chances of failure are four times greater.
There can be other causes of data loss associated with RAID arrays. If the configuration metadata is lost or corrupted then the disk controller does not know how to access the drives in the array. If a RAID disk controller fails, it may not be possible to replace it with one of the same type, and the replacement controller may not recognize the configuration data written by the old one. Similar issues can arise with software RAID (Windows Dynamic Disks) if the database is lost or corrupted.
In this event, you need a specialist data recovery tool that knows how to access an array of disk drives as a RAID array, overriding if necessary the hardware controller. RAID Recovery can automatically detect, reconfigure and repair damaged RAID arrays in many cases. If not, it allows you to specify the configuration. If one or more drives are too badly damaged for the array to be repaired then the product allows you to recover the data to a new storage location.
Encrypted files recovery
If you have used Windows Encrypted File System to encrypt files and folders then recovering these files if they are lost presents additional problems. Even moving these files and folders to another computer or downgrading Windows to an earlier version can make them unreadable.
Standard data recovery software will not help in this case. You need to use Encrypted File System Recovery software. This product can locate encrypted file systems and decrypt them using the same algorithms used by Windows itself, allowing the data to be recovered even if you are using a different version of Windows from the one used to create the volume originally.
CD and DVD recovery
Writeable CDs and DVDs are now a popular backup and archival media, especially for digital photo images which take up a lot of space on the hard disk. But as many people have found, it's easy to corrupt multi-session and rewriteable disks so that they can't be read at all by Windows. And they only made the one copy! However, the data can still be recovered with the aid of the right tools.
CDs and DVDs use different file systems than hard disks, so data recovery programs designed specifically for hard disks cannot be used. You need to use a specialist tool such as CD and DVD Recovery for CD and DVD data recovery. Data written to CD-R and DVD-R media cannot be fragmented, so as long as the disk is not physically damaged and can be read, the chances of recovery are good.
