12

Consumers test
hakin9 5/2007 www.hakin9.org/en 13
Choosing Data Recovery Software
hakin9 5/2007 www.hakin9.org/en
The choices of data recovery software range from free
to thousands of dollars. There are many differences
between open source and commercial software, and
data recovery is no exception. Cost will be the deter-
mining factor for many who are in need of software to
recover lost data. A good rule of thumb is to consider
what the data is worth to you before you spend money
on it. If you lost a bunch of mp3s or rars that can easily
be re-downloaded, then open source may be the way
to go. Is it a presentation that you worked many hours
on, or source code you forgot to backup? If so, then
you may need to look at commercial software that can
recover any type of fle, including partially overwritten
fles. Recovering partial data is better than recovering
no data at all.
The single most important thing to consider when
you inevitably lose your data is what are you trying to
recover. Are they Microsoft Word documents, Excel
spreadsheets, Quicken fles, executables, mp3s, gifs,
jpgs, psts, and so on. Most data recovery software
specializes in certain data types so knowing what you
want to recover will save a lot of time. There are recov-
ery programs that specialize in searching for specifc fle
types like Microsoft Offce documents, and do so with
ease and effciency. If you know what fle type you need
to fnd, then using one of these specialized programs
could prove invaluable.
Not only are there many data types, but there are
just as many fle systems. The most common fle sys-
tems will be FAT16/FAT32, NTFS/NTFS5, HFS/HFS+,
Ext2/Ext3, and possibly Reiser FS. You may even have
a RAID array that needs to be recovered, so consider
all of this while looking for data recovery programs. FAT
and NTFS fle systems will be most common on windows
systems, but you will often see these fle systems on
Linux drives and USB thumb drives for portability. Not
every data recovery suite is going to be able to read
all of these fle systems; therefore it is better to know
beforehand which fles systems you have. Some recov-
ery programs will recognize all types of fle systems, but
most are specifcally geared towards Widows and the
FAT/NTFS systems.
Once you know what types of fles and which fle
system you have, you can then start looking at pro-
grams to recover your data. When a fle is deleted from
a system, it actually still resides on the hard drive. The
OS thinks it doesnt exist, which is where the data
recovery program comes in. Generally, only a pointer
to the fle is removed so it is simple to recover deleted
fles since the original fle is still there, along with all its
metadata. As long as the system does not use the unal-
located space to write another fle, it is extremely easy
to recover fles. Most automated Windows GUI based
data recovery programs can recover deleted fles with
ease. Some are similar to just moving programs out of
the recycle bin, so watch out for those programs. All
the program has to do is scan a hard drive for fles with
no pointers, then BAM your deleted fles are recovered.
But what happens when part of that fle has been over-
written by another fle? Ah ha, that is where the boys
are separated from the men in the art of recovering
data.
Good data recovery software will also have the
ability to read the hard drive at the bit level and use
whatever metadata it fnds to identify the fle. There
may even be a database of fle signatures the program
uses to compare the fles to. Each fle has signatures in
the metadata to tell the OS what type of fle it is. Data
contained in the metadata includes fle permissions,
created, modifed, and deleted timestamps, as well
as a whole host of other information. Even if a fle is
partially written over, data recovery software should be
able to use this information to at least partially recover
the fle. While it may not seem like such a big deal to
recover only partial fles, just imagine how much time
will be saved if you are able to recover most of your
spreadsheet so you dont have to start over.
You are not always going to know a specifc fle
that needs to be recovered, so a program should have
a means to categorize the recovered fles and perform
specifc searches using the metadata. For example, you
may have several fles that need to be recovered so you
want to be able to tell the program x fle types and/or this
date range. Once it fnishes scanning your hard drive for
lost fles, there needs to be a mechanism in place for
parsing the data. Some software allows searches by key-
word and fle type at the very least. The most useful and
accurate searches will use regular expressions to parse
the data bit for bit. This is what forensic investigators use
and will most likely be the higher end and most accurate
data recovery tool.
Last, you need to look at the programs ease of use and
learning curve. Is it GUI based or command line? Depend-
ing on the ability of the program to actually recover data,
this is in large part a personal choice. All in all, there are
many factors to consider when looking at data recovery
tools. Knowing in advance what you need to recover will
help fnd a program specifcally tailored to ft your needs.
by Clint P. Garrison
MBA, MS, CISSP, QSA
Opinions
Photorec
I chose photorec to recover a hard disk that was acciden-
tally formatted from NTFS to EXT3.
We used this tool because of the urgency of the situa-
tion, with addition of stress from the client and having not
been prepared for the situation. We had not had experi-
ence with other utilities.
Choosing Data Recovery Software
12
Consumers test
hakin9 5/2007 www.hakin9.org/en 13
Choosing Data Recovery Software
hakin9 5/2007 www.hakin9.org/en
The utility works well for most situations, it is very easy
to run, and has a list of fles collected so far, even sorted
into a few categories (mp3s,doc,xls,txt,rtf,other,etcetera).
A full list may be acquired here. It even found some data
from three plus formats ago.
The only caveats one may fnd is that it takes about
twenty-three hours for an 5200 rpm eighty gigabyte hard
disk and that it may be discomforting to use a command
line. As well as the fact that some fles were corrupted
(mostly excel fles). One problem that appeared before
me was that I failed to recover a fnancial report, however
all other data was recoverable from the hard disk, and
I had backups for most other items.
I would recommend photorec to other users/
companies. This utility is reliable, though the best policy
is to keep backups often.
Final note: 8
by Justin Peacock
Custom built hardware
and software, and linux tools
We do commercial data reco's hardware and software,
that is why we chose these kind of tools. PC3000 was also
under our consideration, however the price was too high.
Our previous experiences were with Ontrack, GetDa-
taBack and a custom interface board. We needed access
to frmware and other things that consumer grade soft-
ware can't do. We decide to get this mentioned above.
Tool works fne. It was designed to our specifcations
so it meets them all. Advantages are the ability to access
drives faster, modify frmware if needed. Disadvantages
are that we have to hire programmers for any changes, so
it takes more time but this is not a big problem. Surpris-
ingly, we have not got any problems or breakdowns. We
wish it would last forever.
Its proprietary being a few years old I would recom-
mend a redesign with modernizations to it.
Final note: 8
by Chris Bequeath, owner Business Network Solutions
Stellar Phoenix FAT & NTFS v 2.1
The computer suddenly would not boot and had the error
message, damaged File allocation table. I changed hard
drives, having a clone of the C: drive, that was six months
old. After the system was running I was still unable to
access the one drive.
Stellar was good choice to recover my fles.
I had problems with lost fles several years ago and
used few other products. But I have tried Stellar Phoenix
and went right to it. My recent problem was getting the
program to recover the data it located.
I would recommend it to others and actually I have
already done it. I must say that I am pretty satisfed with
Stellar software and the technical support that I have
received.
Final note: 9
by G. Harris Stellar Client
R-studio
I need to recover data from my corrupt HDD. I came up
on a Google search and found a tool suitable for me R-
studio.
I do not remember exactly if I had other tools in my
mind. The biggest factors in this one were price, and that
the site had a working demo that could show me that it
would recover the data before I paid for the tool.
Previously, I had conducted data recovery of specifc
fles using hex tools and reading raw information from the
disk, using a Symantec tool. I cannot remember what that
tool was though. I changed it because of the volume of
fles that I was recovering. R-studio software is fne. Main
advantage is that it can save scanned disk images so that
you do not have to scan for fles again. Disadvantage:
comes in different favors, cannot recover fat32 drives
with NTFS version. Apart from that I did not notice any
serious problems.
I would recommend it to others as I was recommend-
ing it via my forum ever since I frst used it.
To sum up I can say that it works great, but has
limitations in that it comes in NTFS version or FAT
Figure 1. Photorec
Figure 2. Stellar Phonix FAT & NTFS v 2.1
14
Consumers test
hakin9 5/2007 www.hakin9.org/en
version, or Linux version, can get a suit but costs a lot
for one time recoveries.
Final note: 8
by Daniel Rainbow moderator of :
www.computerforums.org
GetDataBack for NTFS/FAT
I formatted my disk drive and actually got my data back,
but not the music, as it was garbled. I found GetData-
Back and it fullflled my expectations. I did not think
about other kinds of data recovery tools. I own one
for personal use, if I ever need it. Once I fnd a good
one, I don't go elsewhere. Any additional seeking is not
needed.
For me GetDataBack works alright. An advantage
is that it actually works. The disadvantage is the time of
process. It scans the surface. Another one is that the trial
does not work. You get a preview, but you need to buy it.
Needless to say, I bypassed it.
I have not used it that much for it to die on me, so
I did not notice any big problems with functioning of this
software.
I would recommend it to others.
Final note: 7.5
by Marc-Andre moderator of :
www.computerforums.org
Stellar Phoenix FAT & NTFS v 2.1
I had really huge problems with the disk surface (there
was no mechanical noise). Defrag hung and then the
laptop would not boot. There was no mechanical noise
at any time during recovery, but there were a lot of read
re-tries. Now I have the data, I reinstalled the disk in the
laptop and used the Toshiba recovery disk to try to rebuild
the drive, but the disk was not recognised. I have ordered
a new disk.
Before current tool I used RTT R-Tools Technology
R-Studio. But fnally get Stellar which enable me to solve
my problems.
I didn't have any diffculties with Stellar. It simply
works fne. I would recommend this software to others
without any doubts.
Final note: 10
by I. Fisher Stellar Client
DigitByte Studio CD/DVD
Data Recovery 1.0.618
I chose DigitByte Studio due to corrupted fles on my
DVD (music and short videos). I knew that there are many
more tools, but I needed to recover my fles fastly and this
was one of the frst which I was considering and had good
opinions so I bought it.
I was using one software before that, but do not remem-
ber the name. It was quite a long ago. Its capability to recover
fles was in average level, ultimately I was not satisfed.
In the beginning, I had few problems with installing but
it was because of my computer, not the software. Now
everything is alright. It works good. The main advantage
is that the process of recovering is going very smoothly,
without any errors. However duration, is quite long com-
paring to other tools.
I would defnitely recommend DigitByte Studio to eve-
ryone who have problems with their CD or DVD. It has all
Figure 5. Stellar Phoenix FAT & NTFS v 2.1
Figure 4. Get Data Back for NTFS/FAT
Figure 3. R-studio
15 hakin9 5/2007 www.hakin9.org/en
Choosing Data Recovery Software
features needed to get back your lost data. And the price
is reasonable.
Final note: 9
by Matthew Robinson student
Recover My Files
I had a lot of data on my HDD. Mostly photos, videos
and PDF. Accidentally one of my roommates deleted all
fles. In the beginning I was very angry with him cause
these things were very important for me, but I thought
that all or majority can be recovered, so I started to look
for a suitable data recovery software. I saw that Recover
My Files has a good comments so I downloaded a trial
version. I was dissapointed because it did not seem to
recover all fles! What is more, it lasted long hours to
scan all my drives in search of deleted fles. I thought
that my adventure with this tool will be fnished but my
colleague told me that full version is capable to restore
my lost fles.
I purchased full version. It worked. I have not got
any problems with installation or whatever. I was able
to revover almost all of deleted data, although it took
some time to do it... But ok, I was satisfed with the
result. The main advantage of a full version is its high
capability to fnding and recovering fles (comparing to
trial version!). Disadvantage is, as I wrote, lasting of
process.
I would recommend full version of Recover My Files
to others, but do not try trial version, if you want to save
your time.
Final note: 7
by David Calmeter student
Data Rescue II and Data Rescue PC
I am an IT professional who needs a reliable data
recovery tool that allows me to recover data from client
computers as well as my own. Prosoft programs that
I have site licenses to use at my offce and at client
locations include Data Rescue II and Data Rescue
PC. I have used the software tools to recover data
that was accidentally erased and to extract fles from
hard drives that have failed or were on the verge of fail-
ing. On Macs, I will use CopyCat X in addition to Data
Rescue II.
In years past, I have had mixed success using
Norton Utilities to recover data from PCs. These days,
I prefer to rely on Data Rescue PC to recover data from
Windows computers because its self-booting disc can
start and recover data from systems that Norton cannot
help.
I have been satisfed with the results I obtain from
the two programs. I recognize that I am not going to be
able to recover all data 100% of the time and that severe
drive failures require running Data Rescue overnight or
longer. I recently ran Data Rescue II on my Mac and
completed a thorough scan of my 250GB drive in less
than an hour. I have not experienced any breakdowns
with these software, so I defnitely would recommend
them to others.
Final note: 9
by Dale Komai President of Macsolvers, Prosoft Client l
Figure 8. DataRescueII
Figure 7. Recover My Files
Figure 6. DigitByte Studio CD/DVD Data Recovery
1.0.618