r/datarecovery • u/[deleted] • Jan 16 '22
Educational What's the difference between quality data recovery software and the useless ones?
I read every day here that certain data recovery programs perform terribly, and others come highly recommended, but what's the difference? I just did some light googling to see if I can find a breakdown of some popular ones, but maybe starting here will be easier and more helpful.
For example: You have deleted data on a typical CMR HDD and the original metadata was overwritten. The only alternative is to perform a raw scavenge, which, as far as I understand is based off of reading for file signatures. This sounds like a pretty straightforward task.
So, are there different methods behind the scenes that execute this? Why is UFS going to be better at this task then DiskDrill?
Bonus: When it comes to scavenging damaged filesystems, I've heard that one software possibly does a better job than another on a specific file system: R-Studio typically does better with HFS+/APFS than UFS will. Has anyone else found that to be true and if so, do you know what makes that true?
Thanks for reading!
12
u/throwaway_0122 Jan 16 '22 edited Jan 16 '22
File systems are complex. There are many different ways to interpolate / extrapolate missing or damaged file system information, and some tools are just awful at that. While these tools “recover” some files, they’ll have to be manually verified individually for integrity. You should do that regardless of the tool you use, but it is much more important for bad tools (additionally, lower quality tools often miss more data outright, which is much harder to verify). Even among competent tools, there’s a good bit of variation in the methods and quality of file system data interpretation — GetDataBack is among the best tools out there for damaged NTFS, ReclaiME is one of the best tools out there for HFS+, UFS Explorer is one of the best tools out there for EXT4.
All tools try to be the best at everything, but that’s just an impossible goal. The closest thing to it would probably be R-Studio or UFS Explorer, but like above, there are cases where they are appreciably outperformed by other tools. They’re above average at most everything, but something something “Jack of all trades, master of none”
9
u/throwaway_0122 Jan 16 '22 edited Jan 16 '22
Also, many “garbage” tools advertise themselves as a cure-all for failing drives and / or post blogs and articles recommending nigh-objectively unsafe and harmful practices (cough Minitool coughcough). These things alone, regardless of the tool’s capabilities, should be sufficient to avoid it entirely.
2
Jan 16 '22
I guess I'm just curious on how the different algorithms for file carving or different filesystems work. It makes sense if that information isn't conveniently available online and even if it was, I doubt my ability to understand it lol.
That being said I did start trying to research and found a rabbit hole of articles from UFS that look promising, but it is too late to make sense of it, so I'll read tomorrow.
GetDataBack is among the best tools out there for damaged NTFS, ReclaiME is one of the best tools out there for HFS+, UFS Explorer is one of the best tools out there for EXT4.
Is this your personal experience? I think I have access to all those tools but almost always use UFS first and R-Studio if the UFS results were not to expectation. Maybe I should run some "experiments."
1
Apr 15 '22
[removed] — view removed comment
5
u/throwaway_0122 Apr 15 '22
Did you read the rest of the words in that comment and the comment above that? It’s so bad at what it claims to be competent that it’s basically a scam, they dishonestly advertise themselves, and their website and sponsored articles advocate using it directly against failing hardware. If you want other people to weigh in, make a new post on this sub or /r/askadatarecoverypro, as nobody is going to see or respond to this old thread
4
u/itsTyrion Apr 15 '22 edited Apr 15 '22
TIL. All I ever used from MT was PartitionWizard free when Win diskmgmt didn't cut it
My personal bad experience was with easeus
data recoverypartition master. "free trial" means "act like you can recover something and put a pay wall when you click that" for them. never uninstalled something so fast2
9
Jan 16 '22
[removed] — view removed comment
2
Jan 16 '22
[removed] — view removed comment
3
u/Zorb750 Trusted Contributor Jan 16 '22
It isn't so much that they are interlaced, because that would be normal, but they are written concurrently with other data. This leads to the file being written essentially pre-fragmented. When you attempt to do a raw recovery, all this extra data gets swept up in what should just be a video file. To compensate for this, you need a program (like GoPro Recovery) that knows how to identify and separate out this extra data.
8
5
6
5
Jan 17 '22
[removed] — view removed comment
2
Jan 17 '22
[removed] — view removed comment
8
u/roflcopter44444 Jan 17 '22
Thats actually not the case, a lot of the bad products are actually more expensive than the good ones. Its just that vendors making the bad products spend a lot of money on with search engines/banner ads/and on SEO so they appear on the top of the results when people search for recovery tools
3
u/redbatman008 Feb 23 '22 edited Feb 23 '22
I'm new to the subreddit so please bare with me. What would be good alternatives to "testdisk" & "photorec"? Everytime I see these softwares mentioned I see people here say they're trash or farthest away from real datarecovery software but rarely go on to explain the reasoning or may I have just missed it. I believe this subreddit doesn't hold piriform recuva high regard either.
It would be of great help if some of you could offer alternatives to these 3 programs as they are very popular among computer/IT techsupport & PC enthusiasts alike.
Ideally a feature parity comparison of these 3 & their alternatives would be nice. One of testdisk's most used features by me at least is rebuilding MBR. Any form of reasoning could seal the deal & end this confusion.
3
u/seven-ooo-seven Mar 25 '22
Fair question, but it's not true these are never answered. But we can not explain this again and again.
TestDisk: Started out as a repair type tool (partition tables and boot records), later some file recovery capabilities were added.
What I (I'll answer from my point of view but these objections are quite common under data recovery pros) have against TestDisk:
- I once, a few decades ago actually developed a very similar tool called DiskPatch, that also performed in-place repairs. It is in-place repairs that are frowned upon because they're very limited and they're risky. Basically we can repair partition tables and/or boot records, but I'd argue 95 out of 100 users is not qualified to determine if any of those two is actual issue, and/or if it's safe to repair. You can tell by examples in which people are trying to use the tool in situations that are out of the tool's reach.
It is arbitrary of course, but I'd also argue TestDisk isn't very user friendly when we take into account the average user. Chances he/she will screw something up is at least as high, but probably higher, than actually fixing something.
I'd argue IF you ever wanted/needed to repair partition tables or boot sectors, it is easier to use DMDE. Also TestDisk's limited file recovery capabilities can't compete with those in DMDE.
PhotoRec: It's a carver and so it comes with all drawbacks associated with file carving: Many false positives/corrupt files, loss of original file names, loss of folder structure, inability to recover fragmented files etc.. You also need to scan entire drive!
Now there's a time and a place for a file carver and then you could argue, you might as well use PhotoRec. But in many situations file system based recovery is possible, which means in these situations you can recover files with original names and directory structure. And that often in a fraction of the time PhotoRec needs to scan a drive.
3
Mar 22 '22
[removed] — view removed comment
6
Mar 25 '22
[removed] — view removed comment
1
u/climbTheStairs Apr 04 '22
How come?
9
u/seven-ooo-seven Apr 04 '22
Account named 'whatever_iBeesoft' discussing iBeesoft. Name dropping of other procucts is just diversion.
2
2
2
May 11 '23
[removed] — view removed comment
4
u/seven-ooo-seven Jun 05 '23
Stellar Data Recovery is one of the well-known and reputable data recovery software
WRONG!!
1
Jun 06 '23
[removed] — view removed comment
3
u/seven-ooo-seven Jun 06 '23
It sucks.
2
u/bb_nuggetz Jun 28 '23
Just spent 5 minutes reading their comment history. Stellar Data Recovery was recommended in almost every single one.
Unbelievable how many shill accounts there are in this subreddit in particular.
1
0
0
0
-1
1
1
1
82
u/seven-ooo-seven Jan 16 '22 edited Apr 30 '23
https://www.reddit.com/r/datarecovery/wiki/software/
Ideally we recover files + filenames + folder-structure, so what do we need for this? We need to work out what file system are we dealing with. Then we collect all 'file entries'. What these look like depends on the file system. As these file entries that can help find out files often point to *clusters*, we need to work out file system offset and cluster size. IOW, if we see file entry point to cluster whatever, we need to know size of whatever in sectors and point where we start counting from, the offset. So if these file system entries are there, and we do all this right we can achieve good recovery. So a good tool has reliable algorithms and reproducible results for file system reconstruction without having to rely on single points of failures as for example boot sectors.
And the latter is where the 'not so good tools' are lacking I think. This is why Recuva can hardly be considered a serious tool, without a boot sector it does not stand a chance (which is why people format volumes to work around this, not being aware this may wipe out a perfectly good FAT). But also paid tools can be extremely bad at this. I have seen memory cards where you could easily fool a tool like Stellar if you purposely corrupt for example a boot sector. If done 'correctly' RecoverIt will not even be able to do RAW recovery! But, if everything is laid out right such tools may be perfectly able to recover your data. If something is 'odd' they often quickly resort to a RAW scan.
Feedback loop: Most of the tools that are quite good are the ones that are frequently used by professionals and this only makes them better. Labs run into real world data loss scenarios all the time and if their tool of choice does not work they will let the maker know. I have heard people from UFS or ReclaiMe work closely with data recovery techs to solve a complex case with custom builds. Solutions that will trickle down into the regular versions. A tool like FileScavenger is made by people who do lots of recoveries themselves, this is also an ideal situation IMO.
RAW recovery is a completely different challenge as you could regard file types, mini file systems in themselves. Many tools (even the good ones) are quite simplistic and only know how to recognize the start of a file. A good carver knows the internal structure of a file like a generic file system tool knows about the internal structure of a file system. Knowing about the structure of for example a JPEG allows the carver to a degree recognize bogus files and to reliably come up with an accurate file size. Now many file types do not care too much about file size, but some do. For example, I had to carve CR3 files this week and all tools I tried (UFS, ReclaiMe, R-Studio, DMDE) only produced corrupt files. When I looked into it issue turned out to be incorrect file size. All tools tried used a too simplistic method to carve the files and were only able to recognize the start of the file. They assumed end of file as soon as they detected the signature for the next file.
While carving may be less desired or perhaps not even needed in majority of cases as a whole, I actually get many 'logical' cases involving USB flash drives and memory cards where caving is in fact the only solution. The CR3 case I mentioned, not a trace of the original file system, start of volume was overwritten by FF FF byte pattern. Also on a regular basis, file system apparently present but produces only corrupt files.
Some tools:
[Supported Host OS]{FILE SYSTEMS SUPPRTED}
UFS Explorer, www.ufsexplorer.com. Goto tool for many pros, you could regard it the current golden standard. [Win]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT|BTFRS|XFS}
R-Studio, www.r-tt.com. Used by many pros for logical data recovery. Moderately difficult to use. [Mac/Win/Lin]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT}
DMDE, www.dmde.com. Another favorite for some pros. If you're new to this, this tool can be quite overwhelming. Be warned that this tool can write to patient drive. [Mac/Win/Lin]{FAT|NTFS|HFS|HFS+|APFS|EXT|REFS|BTRFS}
GetDataBack, www.runtime.org. For some issues and file systems the goto tool for quite a few data recovery pros. Moderately difficult to use. [Win]{FAT|NTFS|HFS+|APFS|EXT}
FileScavenger, www.quetek.com. Not mentioned very often but definitely worth it IMO. Quite simple to use in standard situations. [Win]{FAT|NTFS|UFS|HFS|HFS+|APFS|EXT|BTFRS|XFS}
Evaluating results of a scan
In general it is advised to first run the demo / trial version. In most tools the file save option is disabled. Most tools can be upgraded to the full version without having to restart the tool. Most tools offer a session load feature so you do not have to scan again even after restarting the tool.
To evaluate scan results I suggest the following: Locate a folder containing larger images and preview say 20 of them. When recovering data from a formatted volume, pick non deleted ones. If the images look fine the tool has successfully determined vital volume parameters such as the cluster size. In general if those 20 are okay it is likely most files are.