Jump to content
Nich...

Data recovery programs

Recommended Posts

On average, every five years or so I'll have some problem, where I've either mistakenly deleted something and bypassed the recycle bin, or there's a file system glitch and my PC no longer thinks that something exists, and I'll go along and find an undelete program, and all is merry.

 

I've had one of the latter situations - moving a video file between folders caused Explorer to crash, which caused most of a media partition to disappear.

 

I think I understand how a lot of this kind of data recovery works, as far as it looks through the file table and finds recently deleted things, and they're still essentially there on the disk, subject to not being overwritten. In cases of, you know, the disk being dodgy, then I understand completely why you'd want to, essentially, back the deleted files up to a new location.

 

What I don't understand is why they can't just have the file table entries changed from 'deleted' to 'oh look it's really there'. I don't understand why I should have to go digging for a drive that, all things considered, may not even work properly because it was flood salvaged, so I can back stuff up onto before copying it all back, just because the file system glitch happened to take place on the largest drive in the system, and on the only drive with enough space to hold all of that data in the first place. Why can't it just be 'undeleted', in situ, on the device it was originally on?

 

I am meant to be working right now, not wasting an hour or so to set up a process that could take upwards of six hours. Surely there are programs that just work, rather than making you do a backup dance? I think I'd happily pay something reasonable, at this point, rather than relying on free software. If it can't just undelete the file in situ, then surely there's some way that the file system can be made to mark all of that data as protected, so you could at least write it to the empty space on that drive or partition? Or do I really not, afterall, understand how data recovery works?

Share this post


Link to post
Share on other sites

I think you have the gist of how file recovery works. But I'm not aware of anything that'll do as you're asking without some hoops to jump through, and time. Finding the data is actually pretty quick, but restoring it is not. I'm at a loss to explain why it takes so long to read/rewrite everything (much longer than a copy/paste), but so far I've not run into any software (paid or free) that recovers files without you pointing it in all the right directions and then waiting a day for the results.

 

BTW, my weapon of choice for years has been TestDisk and Photorec:

http://www.cgsecurity.org/wiki/TestDisk_Download

 

It can repair broken partitions and restore data. Its had roughly 50/50 success for us in repairing partitions, but is much closer to 100% for file recovery. Good luck, but shame that its a painful process. :-)

Share this post


Link to post
Share on other sites
Pc Inspector is a free program I have been using for years very successfully, to recover files for people. And its very fast as well. Edited by bowiee

Share this post


Link to post
Share on other sites

I guess I should point out that I ended up using http://www.piriform.com/recuva - ~6 hours to recover somewhere between two and three hundred gigabytes. It should have just done it's thing while I slept, but as it turns out it did it's thing while I worked overnight.

 

I did remember to disable the defrag service, and kill the associated process, but apparently not soon enough. I lost perhaps five or six dozen files because some TV show overwrote them, but the stuff I actually cared about replacing was trivial to redownload, being small files. I noticed a handful of JPEGs were corrupted, but again, relatively trivial to fix, so far. Will not be happy if I have to spend hours re-ripping content, tho', if AV files end up screwy.

 

I am still grumpy that, if it can't just check that the files are where the nulled file table entries say they are and just literally undelete them, it can't at least mark all of that data as a fake protected file and copy them directly to spare space on that drive, but c'est la vie, the flood recovered disks look like they'll get another couple of years as go-to disks for when live ones die.

Share this post


Link to post
Share on other sites

Working backwards, "it isn't that easy, why not?" I'd guess that it's because the files are no longer referenced in the file table. Recovery programs work by scanning the entire disk, and trying to find files that aren't mentioned in the file table.

 

Rob.

Share this post


Link to post
Share on other sites

Your idea would only work if there was no such thing as fragmentation

 

You have a table on the disk that says do not overwrite cells a5,c20,d4,e320,y12,k64,o640 because if read in that order it makes program hello.exe

If you delete the reference then the data in each cell will still be there but the computer has no idea how to read it.

 

It would be like going into jb hifi were all the dvd covers had been painted black and being told to find 5 movies that starred johnny Depp

Share this post


Link to post
Share on other sites

I would buy that explanation, drago, if it didn't put them back together anyway. If it scans the disk and finds the fragmented files and puts them back together on a different drive, why can't it just do that same thing... and re-create the file system and index it to all of the scattered clusters on the disk it's on?

 

To clarify, I'm not thinking it'd be some quick and simple process. Just less convoluted than copying it off and then back onto the disk it was deleted from.

Share this post


Link to post
Share on other sites

I would buy that explanation, drago, if it didn't put them back together anyway. If it scans the disk and finds the fragmented files and puts them back together on a different drive, why can't it just do that same thing... and re-create the file system and index it to all of the scattered clusters on the disk it's on?

What drago is saying doesn't make any sense to me either.

 

But the reason it can't just rebuild it is because it doesn't know if the underlying data is any good. Rather than a well kept filing cabinet, it would be more like a bowl of spaghetti full of links and interdependencies.

 

I'd guess that it's a very good reason why just-about-all of the file systems I know of do not allow this behavior; because it's unsafe and unpredictable. You could, conceivably, create a file system which only overwrites older-deleted files first, but that introduces a considerable amount of overhead. Suddenly it's tracking a hhuggee amount of files.

 

Rob.

Share this post


Link to post
Share on other sites

I understand that still being awake is going to affect my ability to think this through and try to get a handle on it, but I'm still not seeing the issue. I mean, yes, it could do some pretty funky shit to a file system if there was no checks and balanaces. But how is saying, "oh, these and these and these and those clusters over there make up the new doctor who season premiere, so we can safely copy it to x location on a different disk" meaningfully different, with the checking that goes on, to just making that file system entry on the disk that the data is hiding on? If there are crosslinked files, or large chunks of file that are missing, it is already going to sacrifice those files after it's initial scan(s) to rebuild the complete ones (as far as I understand it). I just don't get why that necessitates the source and destination disk being different.

Share this post


Link to post
Share on other sites

i really dont know. but i wonder how easy it is for the program to distinguish between empty space containing data and empty space that is safe to write to. if nothing else, i can see it being an advisable precaution to concentrate exclusively on read operations in the initial phase.

Share this post


Link to post
Share on other sites

i really dont know. but i wonder how easy it is for the program to distinguish between empty space containing data and empty space that is safe to write to.

I don't think you understand what Nich is asking about.

 

He doesn't want to write to random space. He just wants to modify the file table to say, "Hey, there's data in cells a5,c20,d4,e320,y12,k64,o640."

 

Afaik there's nothing sensitive in the filetable, even when you're recovering, but I'm more than happy to be corrected. I'm doing a lot of guessing here.

 

Rob.

Share this post


Link to post
Share on other sites

oh yes i know. but i dont know how big these file tables are and whether they themselves occupy a discrete length of 'fenced off' non-fragmented hard drive space.

Share this post


Link to post
Share on other sites

To compound the problem with recovery tools, defragging hard drives rearranges stuff to potentiallly empty places with recoverable data get replaced with data from another file.

Share this post


Link to post
Share on other sites
Have you ever met the problem about losing your files on your phone suddenly? I have once lost my contacts and messages on my Samsung Galaxy S3, and I get all them back with the help of an Android Data Recovery tool.


The Android Data Recovery program will assist you to recover not only SMS text messages , but also recover deleted photos from samsung galaxy and videos and contacts from Android phone or tablet. Which help safeguard your phone, set it up for easy recovery when it gets lost, and prevent your data from falling into the wrong hands.

Edited by zerenosa

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×