Data recovery for 2TB external HD after partition wiped all data?

Topic

New Reply

I am hoping someone here might be able to at least point me in some direction that might help me get my files back.

At the end of December, my less than 6 month old laptop had an issue and I needed to send it in to be serviced. I backed up what little was on it, as I had all of my data from the last 5 years on my external harddrive. I then wanted to factory reset my laptop of all information so I wouldnt be sending anything sensitive out. So instead of sitting there waiting for 12 hours for everything to delete, I googled how to factory reset Windows 8 (I still can’t figure out Windows 8) and while following the instructions through the menu, it asked me to create a recovery and forced me to select the external otherwise it would not proceed any further. It was done in 3 seconds and I thought something seemed off. When I opened My Computer to check my external, my heart sank when I realized it was showing the capacity as 32 GB and not the 2 TB. Everything was gone.

More googling later, I realized it created a partition on the HD. I was able to delete it, and after some advice from Yahoo Answers, found a recovery program to download and run a deep scan. Catch is, you have to pay $70 for it to actually recover your files. So I was able to see the files sitting there, but had to pay to get them back. So it runs the real scan to recover the files, and instead of seeing pictures in the folders, all I could see was that generic thumbnail graphic for pictures. Attempting to open the pictures yielded a “this file does not exist” type of error. I got back maybe a handful of actual pictures. My boyfriend had run the scan on his laptop initially (I even had to buy a second external HD to re-backup my laptop so I could send it in to be serviced) and said he had some files, so I thought he had everything recovered to his laptop since his scan was run first. So I had already copied my laptop files to the original, screwed up harddrive. (I now realize I’ve probably screwed several GB of lost data and won’t get that back..) I then spent weeks going back and forth with the company trying to arrange a time that they could remote access my laptop and try something else. After about 4 or 5 scans in total, they told me it wasn’t going to work, and refunded my money.

To make things worse, the laptop came back with more issues than I sent it off with, so I’ve been without a laptop for going on 3 months now.

I then decided to call some local businesses who offer data recovery. The first place I called gave me the number for a company called Gillware, because she said they “take it a step further” and didn’t see the point in me paying the local company $50 for a simple diagnostic only to find out they can’t help me. So I called Gillware and the lady there told me it would cost between $900-$1800 to recover data from a 2TB sized device.

Needless to day, I am distraught. All I really want back are my pictures from the last 5 years. Thankfully, I had all of my pictures from my pet that we had to put down 3 years ago. But, I really want my pictures of my current pet from the last 5 years because he is old- 11 years old now.

If anyone has some advice, I would really appreciate it. I got a suggestion to try to find some local companies or IT students on Craigslist who might be able to help me for a more reasonable fee. I’m just afraid that everything I try is slowly chipping away at any recoverable date that might exist.

Reply | Quote

Replies

If you have not written to the disk since the calamity there is a reasonable chance you can get your data back. Unfortunately, writing a new partition can make recovery less likely.
You may find Easus Data Recovery works – see this thread. http://windowssecrets.com/forums/showthread//166522-Lost-data-got-most-of-it-back

cheers, Paul

Reply | Quote

Paul,

Thanks for taking the time to respond!

EaseUs is actually the program I used before.

I haven’t written any new partitions (we only deleted the 32 GB one that got made that originally erased all my information), but I did stupidly re-copy my laptop files before sending it out, due to the fact that my 2nd external wasn’t in my possession that day and I had to make sure I had a copy of my laptop docs before I sent it out the next day. I realize that will likely have written over some information, but obviously I still want to save as much as possible!

I had a local IT guy call me back after I reached out for advice. He suggested I try MiniTool Power Data Recovery, but that unfortunately is $70 for the program as well. I had paid $70 for EaseUs as well, but I was just hoping to find something less expensive.

Thanks again! I really do appreciate your time!

Reply | Quote

Give Recuva from Piriform a try. There is a free version as well as a Pro, but the Pro is only $24.95. I’ve used the free version with very good results on pictures as well as other files.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

you have to pay $70 for it to actually recover your files.

This isn’t going to be any immediate help, but, for future consideration you might want to consider keeping 2 copies of all important data. For $70 you could easily purchase a 2nd portable HD. You could then use it for a cloned copy of the 1st portable HD. Don’t be discouraged if you find that cloning a large portable HD takes 10 hours or more. It could be an over night thing. The result ability to cope with tragedies is well worth the time and money.

I use more than 6 portable hard drives for my computer. I have a duplicate copy of each. You may be surprised to learn how many members in the forum have duplicate copies of their portable HDs.

Michael

Reply | Quote

1. The data is almost certainly still there and near 100% intact. Just don’t write to the drive.

2. Recuva mentioned above ought to see it and restore it for you.

3. If not, isn’t it worth the $70? But you seem to indicate you paid for the Easeus so what’s up?

Reply | Quote

I’ve PM’d you with details of a program you can use to see if it will do any better than what you have tried.

For anyone else reading this, it’s for a free 1 year subscription for a Pro recovery program I got when I bought a particular product and haven’t used the product key.

Figured ladybugamk’s needs are greater than mine.

Reply | Quote

Shows how good the people on this Forum are.

Eliminate spare time: start programming PowerShell

Reply | Quote

FWIW my understanding (heavily influenced by years of trying to recover customers’ files from sick/mismanaged HDDs) is that overwriting existing partitions on an MBR HDD is reversible by using an appropriate program.

In several cases I have been able to recover over-written partitions on customers’ HDDs after booting from a BootIt Bare Metal CD. In a few cases when BootItBM didn’t work I was able to recover the user’s data after booting from an Active File Recovery CD, but that gets a bit “geeky”.

As previous posters have indicated, if you want to recover your files from the affected HDD then don’t write anything further to the drive; put it aside for later attention if/when you find out more about your recovery options.

Reply | Quote

if you want to recover your files from the affected HDD then don’t write anything further to the drive; put it aside for later attention

+1 This cannot be over emphasized. This is a great time to purchase a new portable for current use. Put your important one aside. If/when you get your data back, you will be in a great position to have 2 copies of your important data.
Ebay has great prices on those portables.
Michael

Reply | Quote

Somebody mentioned over-written partitions – meaning the creating of new partitions, which removed the old partitions, correct? Any cluster over-written means new info replaced old info — old info gone for good.

"Take care of thy backups and thy restores shall take care of thee." Ben Franklin, revisted

Reply | Quote

Somebody mentioned over-written partitions – meaning the creating of new partitions, which removed the old partitions, correct? Any cluster over-written means new info replaced old info — old info gone for good.

Only partly true. The partitioning description occupies only a tiny fraction of a disk’s surface, and only that tiny fraction is overwritten by the new partitioning description. Additionally, only to the extent that the new partition is written to is the preceding information overwritten. In other words, writing a few hundred MB’s won’t wipe out several GB’s of previously written data.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

that’s what I meant, any specific cluster containing user data which is over-written later by new info — old info gone forever. The making and unmaking of partitions rarely interfere with user data clusters. Just how does NTFS work compared to FAT32? Does NTFS have things similar to FAT32’s FAT/File Allocation Table and/or DIR tables?

"Take care of thy backups and thy restores shall take care of thee." Ben Franklin, revisted

Reply | Quote

that’s what I meant, any specific cluster containing user data which is over-written later by new info — old info gone forever. The making and unmaking of partitions rarely interfere with user data clusters. Just how does NTFS work compared to FAT32? Does NTFS have things similar to FAT32’s FAT/File Allocation Table and/or DIR tables?

Yup, it’s called the MFT (master file table) in NTFS. In Windows NT and higher, running the built-in defragmenter or another similar tool like Defraggler will show the blocks that are holding the MFT.

There are some basic similarities between MFT and FAT, but MFT is also able to store file permissions beyond just basic read-only and read/write.

Unlike FAT, NTFS is a journaling file system so a separate transaction log is used to hold changes to the MFT, data blocks, etc. until they are completely written to disk. If a write request is interrupted (e.g. power outage, OS crash, drive goes offline), a “dirty bit” isn’t cleared. This triggers an automatic recovery where the journal is scanned for incomplete transactions and the bad data blocks are rolled back to their previous state. With FAT, corrupted blocks can build up over time until the file system becomes unstable unless regular checks are done.

Reply | Quote

A couple of things to watch out for when dealing with data recovery:

Partition layout …

When trying to restore the original partitions on a drive that’s been inadvertently repartitioned, the capacity and vintage of the drive, the operating system being used to run the repair tool(s), the repair tools themselves and the BIOS affect the partition layout.

When drive capacities were smaller (2TB or less), using MBR was fine. For drives larger than 2TB, the newer GPT (GUID Partition Table) is used instead of MBR. For example, on a 4TB drive, only the first 2TB can be used if the partitioning scheme is MBR.

(For the geeks among us, here’s the math… most drives are natively 512-byte sectors or have 4096-byte sectors presented as chunks of 512-bytes for compatibility reasons. MBR uses a 32-bit value to address sectors. 32-bits = ~4 billion possible addresses. 512 bytes is ~0.000512 MB. 4 billion x 0.000512 = 2 TB.)

GPT is great, except that 32-bit versions of Windows don’t support GPT. So a 2TB drive could end up being partitioned using either MBR or GPT depending on the computer that’s being used. From a user’s point of view via a file manager, the drive partitions might look the same, but under the covers the partition scheme and sector alignment can be very different.

GPT also uses a portion of the disk outside of the master boot record to store additional partition info. With MBR, removing the partitions from a disk and then restoring the same partition layout won’t destroy any of the data blocks, but going from MBR to GPT will end up overwriting some existing data even if the new partitions aren’t reformatted.

Assuming that I followed ladybugamk’s timeline correctly, her external 2TB USB drive has gone through the following changes since the problem started:

[*]A 2TB USB hard drive with files already on it was used as the target drive for Windows 8 to create a bootable recovery disk.

(Ladybugamk said that the drive was 32GB after the process completed, so we know that up to the first 32GB of the disk was overwritten. From personal experience, a barebones Windows 8 installation can create around 8GB worth of files for a recovery disk. OEMs will often include drivers and other software so it’s likely a minimum of 10GB of lost data assuming that only a quick format was done after the 32GB partition was created. Recovery programs often do full formats to check for bad blocks so it’s more likely that the entire 32GB was wiped.)

[*]After realizing that the 2TB USB hard drive had been repartitioned from 2TB to 32GB, the 32GB partition was deleted.

[*]Personal files were then manually copied from the laptop to the 2TB USB hard drive.

(This meant the drive had to be repartitioned and reformated again before the files could be copied.)

So we’re looking at repartition to 32GB -> format -> write recovery files -> delete 32GB partition -> repartition to 2TB -> format -> copy personal files from the laptop. That’s two repartitions, two reformats and two file copy sessions. Newer versions of Windows default to a “quick format” so the data on the remaining 2TB might still be there.

File fragmentation …

Most users don’t defragment external drives and also tend to work directly off of them so the chances of heavy file fragmentation is high.

NTFS defaults to 4K blocks which works out to 256 block per megabyte. So for every MB that’s newly written, potentially up to 256 lost files could be partially erased.

In her first post, ladybugamk said, “[…] So it runs the real scan to recover the files, and instead of seeing pictures in the folders, all I could see was that generic thumbnail graphic for pictures. Attempting to open the pictures yielded a ‘this file does not exist’ type of error. I got back maybe a handful of actual pictures.” Windows assigns a generic icon for images that have a valid file extension, but contain errors preventing Windows from generating thumbnails. This is often a sign of file fragmentation, causing some data blocks to be lost by the earlier reformatting and file copies.

Based on the timeline and symptoms so far, it doesn’t sound promising, but I still hope that ladybugamk is able to get her photos back. :unsure:

Chung

Reply | Quote

Look sudo15 has already generously offered a valid subscription to a recovery service. The OP will load it and examine what the recovery app can see for recovery. Likely everything. Once supplying the product key the recovery app will recover.

So the rest is pretty much moot other than to say the first step without such an offer is to see what the free recuva sees. Which is often a lot.

As for recovering partitions, etc., if it came to that I’d use the free testdisk (conveniently found on the bootable system rescue CD).

Reply | Quote

Look sudo15 has already generously offered a valid subscription to a recovery service. The OP will load it and examine what the recovery app can see for recovery. Likely everything. Once supplying the product key the recovery app will recover.

So the rest is pretty much moot other than to say the first step without such an offer is to see what the free recuva sees. Which is often a lot.

As for recovering partitions, etc., if it came to that I’d use the free testdisk (conveniently found on the bootable system rescue CD).

(@Fascist Nation: Your post above sounded like a reply to my earlier post #15, but I wasn’t sure. If you found my post unhelpful and/or upsetting in some way, I apologize. I was only trying to provide some technical info to go along with the other tips that were already provided by other posters.)

SystemRescueCD is excellent. TestDisk is also really great, and so is its sibling PhotoRec by the same developer.

Recuva is definitely worth trying since the free version covers the basics without limitations (PhotoRec might be too overwhelming for anyone more accustomed to a graphical interface).

Recuva, PhotoRec and other similar tools use a pattern-based file scraping technique for recovering files. They are excellent tools, but they can’t recover files that are overwritten multiple times (the file meta-data can be lost, but the data blocks must be intact): no pattern to match against = no recovered file.

Compressed image formats like JPEG and PNG make the recovery more difficult because small errors result in big data corruption. In those cases, if part of the file can be recovered, using a program like IrfanView might help to save at least part of a picture because it’s a lot better at dealing with corrupted images than the simple viewer built into Windows Explorer.

A catch with recovering partitions is if the partitions have been deleted and formatted more than once, which unfortunately happened to ladybugamk. There’s no backup copy of the partition table on a drive so a recovery tool scans a disk for recognizable file systems. If the markers that identify the ends of a file system and/or other meta-data are corrupted, there might not be enough clues to reconstruct the original partition table with an intact NTFS.

Chung

Links:[INDENT]Recuva (http://piriform.com/recuva)[/INDENT]
[INDENT]SystemRescueCD (http://sysresccd.org/)[/INDENT]
[INDENT]TestDisk (http://www.cgsecurity.org/wiki/TestDisk)[/INDENT]
[INDENT]PhotoRec (http://www.cgsecurity.org/wiki/PhotoRec)[/INDENT]
[INDENT]IrfanView (http://irfanview.com/)[/INDENT]

Reply | Quote

What about RescuePRO Deluxe http://www.lc-tech.co.uk/pc/sandisk-rescuepro-and-rescuepro-deluxe/ – perhaps it won’t do the job I thought it would as I’ve just come across this link.

Reply | Quote

What about RescuePRO Deluxe http://www.lc-tech.co.uk/pc/sandisk-rescuepro-and-rescuepro-deluxe/ – perhaps it won’t do the job I thought it would as I’ve just come across this link.

Hi Sudo15,

Is RescuePro the one that you PM’d to ladybugamk?

RescuePro looks very interesting. There aren’t a lot of details in how it works, but it appears to use the same techniques as Recuva and PhotoRec. When I get a chance I’ll run some tests. It would be interesting to see how they compare.

At the hardware level, flash media stores data very differently than magnetic media so not all tools will work on both media types. It makes sense that RescuePro’s webpage has the following note:

[INDENT]RescuePRO Standard and RescuePRO Deluxe are not for use on hard drives or RAIDs
[/INDENT]
Data scrubbing/shredding tools also have problems with flash media. Except maybe the cheapest flash memory, wear-leveling is a standard feature. The flash controller moves data around to even out wear across all available blocks. The operating system has no control over when and where data is moved, so even data that hasn’t changed in a while gets moved around to balance the number of write cycles. A data scrubber can’t reliably overwrite a particular block multiple times because the block’s address could be remapped at any time by the flash controller. In any given moment of time, there could be two identical copies of a block of data — one block is in use, the other is marked as “free”. A recovery tool could still access the old data that’s still stored in the “free” block. It’s great for data recovery, but bad for data privacy.

Recovering data from a RAID is a whole other problem. With luck, I’ll never have to deal with that again because it’s a drag.

Personally, PhotoRec is my go-to choice followed by Recuva because I use Windows, Macs and Linux so cross-platform support is important (PhotoRec even supports DOS :D). I carry a bootable FAT-32 formatted USB flash drive with PhotoRec and Recuva. With a few gigabytes of free space on the flash drive, there’s enough room to recover and hold at least a few important files in an emergency.

PhotoRec has a huge list of patterns that cover all of the most common file formats and then some (http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec). It looks like RescuePro also supports hundreds of file types but I couldn’t find a list to compare with.

Chung

Reply | Quote

Hi ladybugamk,

If Recuva wasn’t able to recover the pictures that you’re looking for, I found another program that might have better success:

[INDENT]Adroit Photo Recovery – http://photo-recovery.info/[/INDENT]

It’s a commercial program that charges $19.99 for a 7-day license or $49.99 without a time limit. The tool scans and shows all recoverable image files it finds for free, so you only pay the license fee to save the results.

Adroit uses a recovery technique that’s more adaptive than Recuva, PhotoRec and RescuePro. It’s based on heuristics and statistics about file fragmentation and image files to try and reconstruct the images. The authors that created the algorithm for a forensics research paper published in IEEE back in 2006 founded the company (Digital Assembly) that develops Adroit.

Good luck,

Chung

Reply | Quote

Yes, that was the program I’d passed on and it may be a while before ladybugamk gets because she’s waiting for the machine to come back.

As it says it’s not for use on HDDs does that mean it won’t do the job for ladybugamk ?

Reply | Quote

Yes, that was the program I’d passed on and it may be a while before ladybugamk gets because she’s waiting for the machine to come back.

As it says it’s not for use on HDDs does that mean it won’t do the job for ladybugamk ?

Hi Sudo15,

I took a closer look at the specs for RescuePro and it unfortunately won’t work for ladybugamk. RescuePro will only scan devices that are of a certain type and capacity. The standard edition is limited to media up to 64 GB and the deluxe edition tops out at 128 GB. The URL for the comparison chart:

[INDENT]http://www.lc-tech.com/documents/rescueprocomparison3.pdf[/INDENT]

I can’t think of a technical reason why RescuePro couldn’t work on a hard drive other than what appears to be built-in restrictions.

Even if RescuePro supported hard drives, it wouldn’t be practical for ladybugamk’s needs. I just noticed one of the system requirements:

[INDENT]Minimum of free hard disk space twice as large as the media you wish to recover
[/INDENT]

So ladybugamk would need to buy/borrow a 4 TB drive to try and recover her 2 TB drive… yikes! 😮

The company’s FILERECOVERY software will handle hard drives. The downside is that the license is via an annual subscription. For the standard edition, it’s £53.58 (about $80 USD) per year. The licensing cost makes Recuva and Adroit better choices for ladybugamk.

Chung

Reply | Quote

Thanks for the clarification, Gadget.

Hopefully either of those other two will do the job for her.

No wonder Cruzer are giving that program away for free.

NB – Looks like the smilies have stopped working again.

Reply | Quote

…NB – Looks like the smilies have stopped working again.

Test :D:

No, smilies seem to be working.

Reply | Quote

Test :D:

No, smilies seem to be working.

It must be me then :rolleyes:

Oh no it wasn’t 😀

Wonder why your Big Grins are bigger than mine ?

Reply | Quote

It must be me then :rolleyes:

Oh no it wasn’t 😀

Wonder why your Big Grins are bigger than mine ?

Maybe because I’m an Aussie but you’re a Pommie? (joking).

Seriously, the “big grin”: you chose is coded “colon uppercase-D”, but the “big grin” I chose is under the “More” dialog and is coded “colon uppercase-D colon”. Have a play with it. 😀 :D: :):

Reply | Quote

Maybe because I’m an Aussie but you’re a Pommie? (joking).

Seriously, the “big grin”: you chose is coded “colon uppercase-D”, but the “big grin” I chose is under the “More” dialog and is coded “colon uppercase-D colon”. Have a play with it. 😀 :D: :):

Yes, I know about those but I’m an idle Pommie :D:

Reply | Quote

Yes, I know about those but I’m an idle Pommie :D:

Point taken (you said it).

Reply | Quote

I had a 600 GB HDD that Windows trashed, destroying about 6 partitions including 450 GB of data:-
Recuva did nothing for me;
MiniTool Power Data Recovery recovered files – wrongly.
Lazesoft achieved perfect recovery.

Most of my data was Macrium Reflect Partition Image backup files,
which included embedded hash checksums so that Macrium can test whether the backup archive is damaged.
Both Lazesoft and MiniTool Power Data Recovery were able to recover the same files with the same sizes and date stamps
BUT ONLY LAZESOFT results were successfully validated by Macrium – the Minitool results were rejected as being invalid.

Lazesoft Recovery Suite 4.0 Home Edition

A 27.3 MB download available from
http://www.lazesoft.com/download.html

Caution – redirects for hosting by CNET,
and clicking the wrong CNET button will get you something horribly wrong.
If you get a 27.3 MB download you have probably got what you wanted.

Regards
Alan

Reply | Quote

That sounds like a more positive program and hopefully it will work for ladybugamk.

Reply | Quote

I found plenty of reviews on data recovery tools that compared cost, user-friendliness, features and other factors, but none that covered the recovery rates. So, taking a few of the most promising choices recommended on this thread, I ran tests to see which ones had the best rate of success recovering lost files.

Test Environment

Oracle VirtualBox virtual machine running Windows 7. This was done so that the tests could be repeated consistently with each recovery program.

“Damaged” Disk

A 100 MB virtual hard drive is partitioned and formatted as NTFS (1 partition, “Simple Disk” layout).

In preparing the “damaged” disk the following steps were taken:

[*]Various JPEG images are copied onto the disk until Windows says it is full (~50 files between 2.5 and 5.5 MB).
[*]A few random images are deleted to make space for new images.
[*]More images are copied onto the disk until it is full again.
[*]Steps 2 & 3 are repeated three times in order to deliberately create empty gaps between disk clusters.
[*]One 1920 x 1080 PNG image is copied to the disk (“A.png”).
[*]Two JPEG images are copied to the disk (“B.jpg” and “C.jpg”).
[*]All of the JPEG images except B.jpg and C.jpg are deleted.
[*]The disk is formatted via Windows Explorer’s “Quick Format” option.
[*]Windows is shut down.
[*]The disk is disconnected from the virtual machine, marked “immutable” and then reconnected.

Step #10 was done to ensure that each recovery program got exactly the same disk. Because the disk was essentially read-only, no unexpected changes could be made.

Piriform’s Defraggler program was used to analyze the disk for fragmented files, specifically making sure that A.png, B.jpg and C.jpg were fragmented. The PNG image A.png was stored in 4 fragments, B.jpg was in 4 fragments, and C.jpg was in 2 fragments.

Test Results

(Although I posted about Adroit Photo Recovery, I didn’t include it in the test because there wasn’t a free version that can save the results so I could run checksums to verify the recovered files. Previewing images that can be recovered doesn’t guarantee that they’ll be 100% intact.)

[INDENT]Lazesoft Recovery Suite

[/INDENT]
[INDENT=2]URL: http://lazesoft.com/lazesoft-recovery-suite.html
supported operating systems: Windows installer, standalone bootable WinPE or Linux live system[/INDENT]
[INDENT=2]version: 4.0.1
installed size: 96 MB
files recovered:[/INDENT]
[INDENT=3]Fast Scan: 0[/INDENT]
[INDENT=3]Undelete: 0
Unformat: 20 JPEG
Deep Scan: 22 JPEG[/INDENT]
[INDENT]
PhotoRec

[/INDENT]
[INDENT=2]URL: http://www.cgsecurity.org/wiki/PhotoRec
supported operating systems: portable app for DOS, Windows, OS X, Linux[/INDENT]
[INDENT=2]version: 6.14
installed size: 5.5 MB
files recovered: 42 JPEG, 1 PNG[/INDENT]
[INDENT]
Recuva
[/INDENT]
[INDENT=2]
URL: http://www.piriform.com/recuva[/INDENT]
[INDENT=2]supported operating systems: Windows installer or portable version (http://www.piriform.com/recuva/builds)[/INDENT]
[INDENT=2]version: 1.51.0.1063
installed size: 3.6 MB
files recovered:
[/INDENT]
[INDENT=3]Fast Scan: 0
Deep Scan: 22 JPEG

[/INDENT]
[INDENT]Wise Data Recovery
[/INDENT]
[INDENT=2]
URL: http://www.wisecleaner.com/wise-data-recovery.html
supported operating systems: Windows installer[/INDENT]
[INDENT=2]version: 3.51.188
installed size: 3.3 MB
files recovered: 18 JPEG[/INDENT]

LRS, Recuva and WDR weren’t able to recover any fragment of the PNG file. PhotoRec wasn’t able to recover the entire file, but was able to get the first fragment (60% of the image = 1920 x 649).

For the JPEGs, the results were much more varied:

[*]LRS’ “Unformat” tool recovered 20 of the deleted images, while its “Deep Scan” tool was able to recover two additional images. Neither of its tools were able to completely recover the fragmented B.jpg and C.jpg files — both tools recovered 20% of B.jpg and 0% of C.jpg.
[*]Recuva, interestingly, recovered the same number of images, but instead of recovering just a fragment of B.jpg and C.jpg, it was able to recover the thumbnail image that is often created by digital cameras and stored with the full size image. It skipped over any image that could only be partially recovered.
[*]PhotoRec was able to recover the most files overall, but half the files were thumbnails that matched the larger full size images, so technically it recovered 21 unique images. Not sure why it skipped over the fragmented B.jpg and C.jpg files while recovering at least part of A.png.
[*]WDR’s results were also very interesting. Although it recovered only 18 JPEG files, it was the only one that also recovered the correct file names. Considering that the files on the test disk were deleted and then the disk was reformatted, that’s impressive.

Each time a partition is formatted as NTFS, the MFT (master file table) in NTFS can end up in a different location in the partition. The more times a partition is reformatted (even with just a “Quick Format”), the greater the chances of valuable data being overwritten.

As a final test, the disk was reformatted with the “Quick Format” option disabled. A full format writes zeros to every cluster in the partition. As expected, none of the recovery tools were able to extract even a fragment of a single image file. (One of the many great advantages of virtualization… because the test disk was set as immutable in VirtualBox, a shutdown is all it takes to revert any changes.)

Summary

So, it turned out to be close as far as the number of images recovered (18 to 22 each). None of the recovery tools alone did a better job than the others.

If the goal was to get back as many pictures as possible (regardless of resolution), then a combination of PhotoRec and Recuva did the best job. Combined, they were able to recover at least part of the fragmented files along with complete thumbnails (A.png, B.jpg, C.jpg).

LRS paired up with PhotoRec or Recuva wasn’t quite as good as PhotoRec + Recuva, and combining all of them didn’t increase the number of images recovered.

Thoughts…

As the test results confirmed, when magnetic media is overwritten even just one time, software recovery tools alone are often not enough. More advanced (and expensive) techniques using magnetic force microscopy (MFM), atomic force microscopy (AFM) and/or scanning tunneling microscopy (STM) are required. With the right equipment and software, even data from a disk with holes drilled through it can still be recovered. (I used to handle IT support at a place that had quite a few state-of-the-art equipment including laser scanning microscopes, electron microscopes, and atomic force microscopes… cool stuff!)

One advantage LRS has over the others is the ability to create a bootable CD and/or USB flash drive for standalone operation (it uses a choice of Linux or WinPE for the operating system). This makes it ideal if you only have one computer and the lost data is on the internal drive.

It was nice that WDR was able to recover the file names, but it’s really not that important considering that most people don’t actually rename their photos. Look on just about anyone’s digital camera and/or smartphone and you’re likely to find hundreds or thousands of files with names like “100_5678.jpg” and “2015-03-13 14.15.16.jpg”. A much better option is to use one of the many free Exif tools to update the file names and correct the time stamps using the internal metadata.

Given the size of each program and the simpler interfaces (i.e. fewer options to select from), I’d use Recuva first, followed by PhotoRec if I wanted to try to recover more files, and then maybe LRS for any file types not covered by Recuva and PhotoRec.

That’s all for now,

Chung 😎

Reply | Quote

What a nice review. Thank you!

Zig

Reply | Quote

A lot of expertise on this forum! I feel for anyone losing otherwise non-replaceable data.

I have a closely related question that might save me from being in that position. I have a 4 tb 2 disk Western Digital “MyCloud” system setup with Raid 1. My understanding is that Raid 1 stripes the data in such a way that if one of the disks goes belly up all the data will be recoverable from the other disk. And further that if the system itself dies the disks can be easily removed and put in a PC or other external chassis for data recovery.

Am I correct in my understanding?

(I also have a 1 tb attached to the WD system via USB to duplicate the most important data – as if I had anything so important it needed so much redundancy. )

Reply | Quote

A lot of expertise on this forum! I feel for anyone losing otherwise non-replaceable data.

I have a closely related question that might save me from being in that position. I have a 4 tb 2 disk Western Digital “MyCloud” system setup with Raid 1. My understanding is that Raid 1 stripes the data in such a way that if one of the disks goes belly up all the data will be recoverable from the other disk. And further that if the system itself dies the disks can be easily removed and put in a PC or other external chassis for data recovery.

Am I correct in my understanding?

(I also have a 1 tb attached to the WD system via USB to duplicate the most important data – as if I had anything so important it needed so much redundancy. )

Hi wiiiindy,

Which model of My Cloud model is it? (I’m wondering if it’s a pair of 4 TB disks or or a pair of 2 TB disks.) It sounds like you have one of the NAS units because the more basic units don’t support backups to a USB drive.

RAID 1 sets up a mirror, so disk 2 is a clone of disk 1. Usually one disk is considered the “primary” where all reads/writes are directed. The “secondary” disk is only written to until the primary disk fails, at which time data is then read/write to the secondary disk. Because the disks are just duplicates, either one can be removed and plugged into a PC to access the data. Unless there’s corruption and/or damage to the disks, no data recovery tool is needed.

The two-disk My Cloud units also support RAID 0 and JBOD…

RAID 0 stripes data across both disks so the total storage capacity is the sum of both disks. Because reads and writes go to both disks, it provides faster speeds than RAID 1. The downside is that if either drive fails, the entire array can be lost. Data recovery is complicated because files can be split across both disks (it’s like file fragmentation on a single disk, but worse). Adding to the difficulty is that different brands of RAID controllers each have their own algorithms for storing data — a pair of disks formatted in one RAID 0 enclosure might not be compatible with another enclosure from another company (this also applies to RAID 5, RAID 6 and RAID 10 arrays).

JBOD (just a bunch of disks) treats each drive separately. If the My Cloud supports direct USB connections, it behaves like a USB hub with each disk appearing as a separate USB drive. If the My Cloud offers network access, then each disk is just a separate volume on the server.

Chung

Reply | Quote

Chung, Yes it is a 2 disk NAS with total 4 tb.
And Jerry – the MyCloud IS my backup with a second copy of financials and some other important stuff on a USB external drive attached to the NAS. So with Raid 1 I have 3 backup copies of the original data on my PC hard drive. I also save the financials and some assorted other stuff on a flash drive which periodically goes into our safe deposit box at the bank. So I understand the importance of backups. 🙂
Most at risk but still backed up – photos and music – also the least important.

BTW – maybe of interest to some – we had a house fire some years ago bad enough that the roof was taken off and the interior stripped to the studs for rebuilding. lost most of our furniture and clothes but my desktop PC hard drive survived with NO LOSS OF DATA! Not that I recommend trying it. (Dell XPS).

Reply | Quote

Chung, Yes it is a 2 disk NAS with total 4 tb.
And Jerry – the MyCloud IS my backup with a second copy of financials and some other important stuff on a USB external drive attached to the NAS. ,,,,

If it is a two disk setup (2 x 2TB) with 4TB then it is likely not RAID 1 but RAID 0 unless they used two 4TB drives (which seems very unlikely to me).

As was said, RAID 1 is not meant for backups. If before a drive fails it writes bad data that data would be then written to the other drive as well. That said it may work as a backup…it is just a really bad practice. That is what they make automated backup software for.

Now if the RAID 0 setup has failed you are screwed on recovery—hence the reason I tell people to steer away from such external drives especially since they are sold to people to be used for backups. I am sure by now there are others, but the only RAID recovery app I am familiar with is:
https://www.runtime.org/raid-recovery-windows.htm
https://www.runtime.org/nas-recovery.htm

Reply | Quote

Not sure what you are saying. 1st, it is Raid 1 – 4 tb total – 2 tb usable. 2nd, the whole point of an external for backup is so you can disconnect it and not lose anything if your internal goes bad for any reason (including malicious intent). Whether the external is a Raid system or a single disk or an online service I don’t see how it is unsuitable for backups. Or are you thinking the Raid is my main disk and I am depending on the raid to keep everything safe without copying it anywhere else? If so then I would agree with your point.

Reply | Quote

Not sure what you are saying. 1st, it is Raid 1 – 4 tb total – 2 tb usable. 2nd, the whole point of an external for backup is so you can disconnect it and not lose anything if your internal goes bad for any reason (including malicious intent). Whether the external is a Raid system or a single disk or an online service I don’t see how it is unsuitable for backups. Or are you thinking the Raid is my main disk and I am depending on the raid to keep everything safe without copying it anywhere else? If so then I would agree with your point.

Hi wiiiindy,

If I counted correctly, you’ve got 4 copies of all the files you value plus a 5th copy of selected files stored offsite in a bank deposit box. Personally, I think you’ve got the backups covered (… except unless you live right next door to the bank and there’s a risk of a large sinkhole :)).

Ideally, you’re also using either WD’s backup software or something else with version control to provide the ability to roll back to previous versions to help with data recovery after malware like CryptoLocker. Any malware that deleted and/or tampered with your files could eventually affect your backups.

I wasn’t able to confirm via WD’s product manuals if there is any kind of checksum feature to detect possible “bit rot” (http://en.wikipedia.org/wiki/Data_degradation). With larger capacity drives, the higher data density increases the chances of it happening. In a RAID 1 setup, if the primary drive were to have bit rot it would be quietly duplicated to the secondary drive.

Chung

Reply | Quote

I’ve never used RAID, I heard great and notSoGreat things about RAID. What I did was make partition images on separate drives, and took ’em offline unless backup time again.

"Take care of thy backups and thy restores shall take care of thee." Ben Franklin, revisted

Reply | Quote

RAID is good for disk hardware failures but doesn’t obviate the need for data backups. RAID is of no use for recovering from malware infections and the occasional “opps, I deleted the wrong files or folders” type of errors. RAID is also only good for single point of errors and doesn’t cover the remote possibility of both disks dieing due to a lightning strike or fire. If the data is truly non replaceable, you need an backup strategy that includes off site storage like the cloud as well as multiple copies.

Jerry

Reply | Quote

So, taking three of the most promising choices recommended so far on this thread, I ran some tests to see which one had the best rate of success recovering some lost files.

Chung,
Thanks for the very well written post. It is much appreciated.
For the record, both PhotoRec and Recuva are available in portable form. They can be found at the Portable Freeware collection.
It should also be noted that if the original photos were on the C: drive prior to copying to the portable, then some of those deleted originals may actually be recovered from the C: drive. I once ran Recuva on my C: drive looking for a certain deleted file. Since I didn’t know the file name, I looked for everything. It was shocking how many K’s of files it presented for recovery.
Michael

Reply | Quote

Chung,
Thanks for the very well written post. It is much appreciated.
For the record, both PhotoRec and Recuva are available in portable form. They can be found at the Portable Freeware collection.
It should also be noted that if the original photos were on the C: drive prior to copying to the portable, then some of those deleted originals may actually be recovered from the C: drive. I once ran Recuva on my C: drive looking for a certain deleted file. Since I didn’t know the file name, I looked for everything. It was shocking how many K’s of files it presented for recovery.
Michael

Thanks Michael. The ability to recover old files from the C: drive is what makes me want to use a file shredder. :B):

The very first time I needed data recovery I didn’t know where to start. So many tools that really only handle “undeletes” (which are actually very easy to do) while the good ones don’t get enough attention. Windows Secrets is likely to be around for a long time so hopefully other forum users will find the review helpful.

Speaking of portable apps, the PortableApps.com suite uses Wise Data Recovery (http://www.wisecleaner.com/wise-data-recovery.html). It’s also available for free so I’ll run the same tests and update my earlier post.

Chung

Reply | Quote

…and to think before I came here into Windows Secrets that the only RAID I knew of was:
bug spray

"Take care of thy backups and thy restores shall take care of thee." Ben Franklin, revisted

Reply | Quote

Hmm. You are right Chung. Counting the hard drive in the PC makes 5. LOL When you total them up seems a bit over done. Especially since I don’t really worry about the bit creep like a should. Space is so cheap that I just sync the files once a day to the NAS. I’ll have to get cracking on backup software that has that capability. thanks for the tip. I’ll have to beef up my wife’s backup’s too. She only has one copy besides her internal drive.

Now if only I had the money for a firmware implemented Raid 6 array with multiple attached optical writers for archiving….

Reply | Quote

RAID 5 is all you need as long as you monitor the array. If you don’t monitor it, no amount of RAID is going to help.

cheers, Paul

Reply | Quote

I think all this chat about different drives etc. should have been put into its own thread as it’s probably way off what ladybugamk will need if she comes back after getting her machine back from the shop.

Reply | Quote

mea culpa. I’m outta here.

Reply | Quote

mea culpa. I’m outta here.

…you, me, others, got conked with a can of play-RAID 🙂

"Take care of thy backups and thy restores shall take care of thee." Ben Franklin, revisted

Reply | Quote

…you, me, others, got conked with a can of play-RAID 🙂

I suppose you’ll be Bugging off now :D:

Reply | Quote