Data recovery tools and techniques

[muttleymacclad]

Hi guys,

I do a lot of repairing and fixing pc's, laptops etc but i've never done any data recovery stuff yet.

What are the best software tools for recovering data (free or paid for), what hardware is useful, cables leads caddies etc? external usb to sata, ide etc.

I've done some reading but would be interested in DF's views and opinions.

ta in advance

mml

[Possy_99]

you should be able to pickup an adapter off ebay for £5-£10 which does 3.5"/2.5" sata/ide which will cover you for 99% of drives.. the rest is down to software.. there's a few out there - all do the same thing.. and probably all effectively about the same imo.


[Edit]
£7 to be precise... USB to SATA IDE Hard Drive Adapter Converter AC Cable on eBay (end time 15-Apr-11 17:44:05 BST) [filtered BIN/UK only]

[evilsatan]

Get a HDD docking station. I have one which takes IDE and SATA. Make sure it has a USB3 or eSATA connection for recovering larger amounts of files.

If you are just trying to copy data from a working drive then connect the drive to the docking station, boot from your HDD (not the docked source drive!). Once Windows loads access the source HDD in My Computer and copy files to your HDD, an external HDD, or burn directly to disc.

If the files you are trying to retrieve have been deleted/corrupted or the OS has been reinstalled then get software like Getdataback. You will have varying levels of success.

If the drive itself is not powering up or is clicking then there are several things to try. Firstly wrap the faulty HDD in a airtight/waterproof bag and put in the freezer, leave in there for a few hours. When you take it out connect it as explained above and power it up and start copying across data ASAP. The freezer trick will only work in some situations.

If the HDD has a mechanical fault and the freezer trick doesn't work then you will want to look at how important the data is. If it is very important then you ill probably need to use a professional company, this is likely to cost you hundreds of pounds. If the data is not worth that much then put it down to experience and remember to backup important data in the future!

[Possy_99]

the docking stations look nice I'll give you that.. but aren't they like £20-£30 quid.. I have right now below my feet the exact same design as I pointed in the ebay link.. does the job perfectly fine.. USB3 and eSATA are only any good if the PC which your using to do the recovery has USB3 or eSATA.. mine hasn't and to be honest at this moment in time I'm transfering around 30Gb from one drive to another and it's going to take about 40-50mins ish.. I don't think that's a long time.. in the mean time I will plod on with other jobs (and inbetween maybe post of DF)

when a customer asks for data to be backed up I advise them that there's no point in backing up the full drive as programs won't work anyway (as they have registry entries etc which won't work if copied in this manner) so I generally stick with user data.. for example the my doc's folder, desktop, favorites etc.. and thus I generally tend to find most people have very little.. the odd occasion you get folks with videos and music etc but we're not talking hundreds of GB's usually..

programs can be downloaded again.. and are not usually so straight forward as a simply copy'paste to backup.. stick with user generated data (photo's or work they've done) as this is the stuff EVERYONE wants to keep (as it can't be replaced)


[EDIT]
job done.. just over 56Gb copied in about an hour..

[Over Carl]

Recovery tools I use:

File system corruption - chkdsk

Data overwritten / drive on it's way out - getdataback for ntfs (fat version also available)

Virus - Backup data and scan this with MSSE, Kaspersky and McAfee then restore to a fresh build.

Also an interesting trick I've taught myself for outlook recovery - if you can find an old *.ost file, recreate a new user profile and link to exchange (profile must be same username, not certain about SID). Then unplug from network, reboot and move the old *.ost into place and you can access it totally perfectly. The tools I've found aren't free and don't seem to recover every single item.

[WotTheFook]

I have a 5 1/4", mains powered USB external drive case that I've fitted a removable drive bay into - sounds crap as ideas go, but is very useful if you need to swap a hard drive out for recovery purposes without installing it into your PC. I could do with a SATA version now.

Software wise, my recovery weapons of choice are Ontrack easy Recovery Pro, Easeus Data Recovery and GetDataBack, they will sort things out in 95%+ of situations, either singly or from multiple sweeps of the drive with each one.

Virus software - Trend Micro Housecall, Malwarebytes and Combofix get used a lot by me for systems that have been compromised by trojans and backdoor exploits.

I usually backup the My Documents folder and subfolders on any repair machine I am working on, so that it's not lost if anything bad happens. Old 10 and 20Gb XBox hard drives come in really handy for this sort of stuff.

[muttleymacclad]

Thanks very much guys.

@ evil, what model do you have? Startech seem to offer a few varieties.

@Possy, If you used Ghost or Acronis to image the whole drive then registry keys etc will be kept intact.

ta
mml

[evilsatan]

I have this one mate. You might find a better one now though, the one I have linked to will accept laptop and desktop IDE and SATA HDDs and has an eSATA connection, also has a memory card reader built in. USB3 would be better but you will probably pay a premium for that at the moment.

[Possy_99]

valid point muttley, but the majority of the time the reason I have to backup data is because the computer is riddled with spyware/viruses.. there's been a few times when I have decided to take up the challenge of going head to head with spyware etc.. and being sat there for ages doing various scans etc thinking "I could have formatted and reinstalled the os by now"

[WotTheFook]

^^^^
+1 to what Possy said.

Sometimes the trojans and rootkits are so badly embedded and the system is so screwed up, that all you can do is save out the Documents folders, along with any serial numbers for added programs like Office etc., save out the Outlook *.PST files and the like for e-mail and then format and rebuild the system.

[Zippeyrude]

get hirens for lots of recovery stuff.

One heavyweight program (not on hirens) is Ontrack EasyRecovery Pro, very effective in my experience

[muttleymacclad]

valid point muttley, but the majority of the time the reason I have to backup data is because the computer is riddled with spyware/viruses.. there's been a few times when I have decided to take up the challenge of going head to head with spyware etc.. and being sat there for ages doing various scans etc thinking "I could have formatted and reinstalled the os by now"

Fair point well made possy.

mml