Give Me My Stuff Back! How to Recover Your Data (Mostly) Free and Easy

Posted 01/21/2011 at 2:39pm | by Brian Mahoney

23

Comments

Print

Fix File Tables Fast.

Sometimes a hard disk is fully functional but Windows can’t seem to recognize it as its own. There is the drive letter in Windows Explorer but Windows still asks you “The drive is not formatted. Do you want to format it now?” Sure, the drive may have been fine just a moment ago but something went horribly wrong. Whatever you do, don’t format the drive. (What did we just say? Don’t format the drive.) Instead, try out TestDisk.

TestDisk, available from CG Security,  is a deceptively simple bit of free software. We’re talking totally free, not crippled in any way, no gigabyte limit, no time limit but…no GUI either.

The file table can be explained this way. Imagine that you have a huge set of drawers, chockfull of things . You’ve spent time making a list of everything in the drawers, what the items are and a bit of information about them. The list tells you what drawers have room left in them and which drawers are empty. Then, horror of horrors, you lose that list.

Nothing has moved. Nothing is missing except the list that tells you where everything is. Without that list, the dresser appears to you the same way a drive looks to Windows. You know that it’s a dresser and Windows knows that it’s a hard drive but both you and Windows would have to start fresh and format (sort out all the drawers again),- unless you can find that list.

Ever wonder why FAT32 is named FAT32? 32-bit File Allocation Table, dude. The file table in NTFS is called the MFT (Master File Table); other file systems use different names. Regardless, TestDisk should help recover the file table from any of them.In the example above, if you’ve kept a copy of the list, you’re safe. Windows makes a backup copy of the file table, but you need a program such as TestDrive to retrieve the copy. Thankfully, this doesn’t take very long. 

The lack of a Windows GUI might be a bit disconcerting, but TestDisk is reasonably easy to use. (If you’re a  confused by some of the terms used on the screen, there is a very handy step-by-step outline available on the website.) TestDisk runs in a command prompt window and uses Linux drive letters (sda/sdb) instead of typical Windows letters (c:/d:), and the program uses arrow keys for navigation.

TestDisk lists the drive size, the free space as well as the manufacturer. Choose the drive you want to work on then move on to which partition you want TestDisk to look at. On this screen you’ll notice that TestDisk will work onWindows, Mac, Linux, Sun and good old Xbox partitions.

TestDisk is incredibly handy, simply because it works on just about any computer out there but as far as RAID goes, TestDisk works with Linux only. Besides recovering an errant file tables, this software will also repair boot sectors, undelete files and find lost partitions, irrespective of the file system used on the drive.

As part of the TestDisk package, you also get a copy of PhotoRec, a cross–platform file recovery application. Like TestDisk, PhotoRec uses a command line interface, but its strength lies in the fact that you can use it on many different operating systems. PhotoRec will recover your files, no problem, but you’ll have to sort through them individually to see what each one is. If you’re looking for one particular file or type of file this isn’t too bad but if you’re trying to recover a complete drive, we can see how this would be a royal pain.

Zapped Drive? Find a dupe

Every now and then a hard disk drive will fail because of a problem with the circuitry. If the circuit board fails, you can sometimes find an identical board which can serve as a replacement. Find the make and model number of your drive and scout out some auction sites or craigslist. You might get lucky by either finding an identical drive. Every manufacturer is different, of course, and the circuit board solution is not guaranteed to work on every drive out there. It’s worth a shot, however, if the lost data is important to you.

Your final option: Professional Data Recovery

If you remember the IBM ‘Click of Death’ from a few years ago, then you know that mechanical failure can happen suddenly, leaving you no recourse but to turn to professional data recovery experts. This is where you have to think long and hard about the data you’ve potentially lost. Obviously, business users, students, photographers/writers all have valuable data that must be recovered if a drive fails. In some cases, this data can be retrieved but at a significant cost. Is it worth it to you?

 In order to do their job, data recovery professionals require equipment, software and a clean environment which all cost money. Maintaining a parts inventory alone is massively expensive. Try to get an estimate. If it’s just a small mechanical problem, the costs might not be too high. Some companies have cheaper rates for students which helps… if you’re a student. The reality is the average Jill or Joe has to cough up substantial bucks to get their data back. Hey, that’s what it takes to employ the guys who do forensics for the 5-0, right?

How trustworthy are the professionals? The IPDRA (International Professional Data Recovery Association) member list will link you to a company near you that will take care of your lost data securely.  Consider this as a data recovery Better Business Bureau.

Watching Your Back

If you’re with us to this point, you might be pondering one important issue that we haven’t mentioned yet. While we’ve helped you figure out how to retrieve lost data, we’ve also shown you how simple it would be for someone else to recover your information. If you’ve sold a computer or tossed a flash drive in the bin at the local thrift store, some enterprising person could use Recuva or PhotoRec to snoop into your life. However, the really nice thing about Recuva, aside from its low, low price, is that you can use it to write over your drives and disks, making the data that had been on them completely irretrievable by any third party.

You can choose to write over the files just once or you can go Gutmann and scrub the disk thirty five times!. Your choices will vary, depending on the information that you’re trying to hide, of course. The NSA seven pass is pretty standard for wiping a disk but if you have time, or you’re incredibly anal, choose the Gutmann process.  We should note, though, that nobody but nobody has ever demonstrated the ability to recover data that’s been overwritten even once. Thirty-five passes is overkill.

If you just want to securely erase specific files so they’re unrecoverable, check out Eraser (eraser.heidi.ie).

Ounce of prevention

These days, there is no excuse, save laziness, for not performing regular backups. The products and steps we’ve outlined here are last ditch solutions that might help you get your important files back in your hands. If you’ve performed continuous backups to non-magnetic, non-mechanical media, then the worst that could happen is the loss of your most recent data.

If you’ve backed up your files to another hard disk drive, what’s to stop it from failing? You reach for your coffee and your external backup drive hits the floor. Backups are only as secure as the media that is used. If your photo files, documents or music are your meal ticket, then get them onto some DVDs and store them in several different locations. It’s always good to download the software mentioned here and back it up with everything else. That way you’ll have it handy when you need it. You could also run TestDisk and PhotoRec through their paces on a spare hard drive, just to get used to them. Then, when things get nasty, you’ll be ready to rock and roll.