Even with the latest hard drive technology, data
loss happens. The best defense is a solid and frequent backup
plan. We know that doesn’t always happen, though. When data loss strikes, we move quickly into panic mode, trying to
retrieve your important files. There are a variety of tools and services
now readily available that can help you get them back. We’re going to explore data recovery options, from
the mundane to the expensive, and weigh the pros and cons of each.
There are a couple critical
procedures to do before you can begin to recover data.
First: Turn off the computer the hard drive is in and remove the hard drive
from the computer. In many cases, continuous attempts to access the hard drive
can only make the situation worse by destroying data, or at the very least,
making a difficult job even harder.
Second: Purchase an external
hard drive adapter appropriate to the drive you’re working with. You can get external
adapters that will support the gamut of hard drive types for a low price,
and is easily one of the best disaster-recovery tools you can have in your arsenal.
If you’re in a hurry, you can find these adapters in stores, but they usually
only support one type of hard drive, such as desktop IDE, or laptop IDE only.
Third: At no time do you tell Windows
to format the drive, even if it strongly suggests that it’s a good idea.
Fourth: If your hard drive is making any sort of
clicking or grinding noises, skip to the last part of this article, professional data recovery, because it is the only step appropriate for your situation.
Failure to follow any of these guidelines will jeopardize your important data
further, or eliminate all chances of recovering it.
Many times data recovery is as easy as plugging the
hard drive into the external adapter and plugging that into another computer.
Numerous issues that prevent Microsoft Windows from loading, including a bad
boot sector or corrupt
system files do not prevent access to a hard drive. In these cases,
simply attaching that hard drive externally to another computer will yield the
ability to drag and drop files of your choosing at your leisure, just like you
would if the drive was connected internally on your own computer.
An externally-connected hard drive would show up here in Windows Explorer, just as though the drive were inside your PC. |
And when this is the case, move your files to the new computer
or burn them to disc, and do as you wish with the old hard drive. Many Windows
errors such as UNMOUNTABLE_BOOT_VOLUME, IRQ_LESS_THAN_OR_EQUAL, \WINDOWS\SYSTEM32\CONFIG\SYSTEM
or NTLDR Error indicate that the drive’s data is quite fine, but Windows is
merely incapable of booting. It’s always a good first step to see if this is
the case before scrambling for a suite of recovery tools.
Let us assume, however, that your data recovery scenario is not
so easy, and even after connecting the hard drive to another computer, Windows
reports that the drive is unformatted. Don’t panic! Your data is almost assuredly
still there, and if you followed the critical procedures outlined above, you’re
in a good position to get your information back. In cases such as this, when
the drive is reported as being an unformatted volume, it is generally indicative
that the Master Boot Record or
Master File Table are corrupt.
The MBR is required to initialize the disk and access data, and the MFT is the
listing of where each file is store on that disk. If either is corrupt,
the data is on the drive in a physical manner, but Windows has no particular
idea how to access it.
A fantastic tool in this situation is called TestDisk
by CGSecurity. It’s a simple DOS-like application that can rewrite partitions,
rebuild MFTs, and even repair invalid MBRs so you can get your data back. While
the tool seems intimidating at first, it’s actually quite simple to use. Follow
the pictures to undergo a standard data recovery attempt by launching TestDisk_WIN.EXE:
Here we choose not to create a log file. It speeds up the process this way,
and chances are you remember what you’ve done anyhow.
In this step, we select the hard drive that we want to recover. It’s easiest
just to select the drive that matches the capacity of the one you plugged in. In this case, it’s a 320GB drive, so
I selected the 320GB from the list.
In almost all cases, it is an Intel/PC partition. If you’re running Windows, select this option.
Selecting “Analyse” will perform a scan of the drive to see if there are any recoverable partitions with information.
After selecting analyze, it found a total of three partitions, two of them in an extended (3 and 5), with one bootable (1 *). Hit proceed to verify that there is information to be had from these partitions.
If the partition listing turns green, success! Your partitions are intact, and all the information is there.
At this stage in the game, there can be two outcomes; either,
as above, the partition table turns green indicating that the accessibility
of your disk can be restored, or no partitions are listed as safely recoverable.
In the case of the former, hitting P will show you a list of
files, to verify that you are restoring the proper partitions. If you are sure
those are the correct files, hitting enter and Write! at the
next screen will apply the changes. A reboot of the PC is necessary to activate
the repairs, and you can move files safely to and from the drive. It might even
be prudent to run CHKDSK X: /R on the drive from a command prompt (Start ->
Run), where X: stands for the letter of the drive. If, however, you fall in
the latter category, there is another method you might try. Head back to this
screen and hit Advanced:
On each partition, select the [ BOOT ] option inside TestDisk; repeat the procedure in the next image for each partition.
At this stage, for each partition you move through, TestDisk might
report that the boot sector status is bad. If this is the case, you
must select [ Rebuild BS ] and [ Repair MFT ] for each partition,
and wait it out. These steps are very time-consuming, but thankfully most recovery
procedures don’t require them. When the boot sectors and MFTs are repaired,
you can reattempt the recovery process outlined at the introduction of the testdisk
section.
With any luck, and in either scenario, we were able to rewrite
the partitions, reboot, run checkdisk, and open our files with restored and
unfettered disk access. If TestDisk seems a little daunting, or fails to yield
results, try the next section which details Runtime Software’s GetDataBack
for NTFS.
TestDisk Pros:
- Free!
- Fast
- Versatile
TestDisk Cons:
- Complicated to use
- If the MBR or MFT are irreparable, it’s difficult to recover data.
- Does not always detect the recoverable partition
- Can’t recover information from raw sector reads
Runtime Software’s GetDataBack
for NTFS, at $79 USD for a copy, is not necessarily inexpensive, but in
the world of recovery procedures and software, that’s amazingly close to free.
GetDataBack is a program that accesses information on the drive at a raw level;
even if the MFT, MBR or partition is corrupt the scanning methodology it employs
bypasses the typical conventions of file access to look at the data itself.
To provide an analogy, it’s a clerk that disregards the labels and indices in
the office filing cabinet, and looks at all the papers manually to see what’s
inside. Even if the labels and indices are lost, those files are still there,
and that’s how GDB works; it builds a snapshot of the contents, and lets you
recover information from a convenient UI. The downside, however, is that the
scanning process can take a very long time if your drive or partition
is very large. Even 100GB hard drives can take in excess of an hour to scan
for a recovery image, and you might imagine how long it takes on even bigger
hard drives.
A crucial step is that you do not install this program on the
drive you’re recovering; this assures that you’re not overwriting information
you need. Very important!
When opening the program, the easiest option is “Use Default Settings.”
In this window, select the physical hard drive you’re recovering; like TestDisk,
match the drive based on size. 298GB is the 320GB HDD I’m using.
|
Once you hit next above, it’ll start scanning the drive for data. In this image,
GDB is looking at the drive at the raw level, looking for indications of data, not merely looking at a file
table that says files are there.
In 99% of the cases, you need only hit “Next” at this screen.
Here we see a complete list of recovered files, even ones that have been deleted!
The entire partition was successfully recovered, even though it was completely inaccessible before.
When the recovery snapshot is created, selecting files in the
explorer-style window and hitting Copy inside GDB will present a Window
that allows you to pick the destination of your recovered files. Simply select
the hard drive connected internally to the PC you’re working from, export the
files safely, and go on your way!
GetDataBack Pros:
- Accesses raw data; doesn’t rely on repairable MFTs or MBRs
- Very simple to use
- Perhaps more thorough than TestDisk in extreme situations
GetDataBack Cons:
- Not free: $80 to own
- Very slow to recover files
The last option in data recovery is a professional recovery service.
When the pieces of software above fail, or you have a disk that’s producing
clicking and grinding noises, the only option is a professional recovery
service. Unlike end-users, they have several pieces of software and techniques
that are far and away superior to what is available to us. In this case, a great
service called OnTrack. Unfortunately,
their services are so expensive that it requires quote-by-email to
even get an approximation of the price required. While this may seem extreme,
some individuals may have information so important that OnTrack may be a viable
option.
Thankfully, though, most data recovery cases are simply an issue
where the files are still present on the disk, but the ability to access
the file has been damaged. Remember to get that external adapter, and never
write to the hard drive you’re recovering from. Follow these simple tips,
and you should get your data back in a hurry. Remember to institute a solid
data backup procedure afterwards.
Articles RSS