Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am new to data recovery software. Many have a scan step, like Recuva. I wonder if scanning a partition by data recovery software will modify the partition? I learned that never modify data on a partition if planning to recover its previous data. Thanks!

share|improve this question

2 Answers 2

up vote 2 down vote accepted

You’re wise to worry, the last thing you want to do is to write anything to a drive that you are trying to recover from.

Obviously whether a program writes to the drive or not depends on the program itself, but generally speaking, developers of data-recovery programs are aware and intelligent enough to know not to write anything to the source drive (at least not without asking the user). That’s not to say that some dummy couldn’t throw together a program and make a foolish design mistake, but if you stick to tried-and-true programs like Recuva, PhotoRec, and their ilk (anything that’s a few years old and has reviews available), you should be fine.

There’s a few things to look out for however:

  • If the program is in the least complex (i.e., has multiple options and settings), pay close attention to them so that you don’t inadvertently write to the drive.

  • Make double-sure your destination folder (where the recovered files are saved) is on another volume.

  • Watch out for file-systems scans (like the sort done by chkdsk). Some programs may attempt to fix file-system errors which of course is undesirable until after all recovery attempts are completely finished.

share|improve this answer
    
Thanks! For tried-and-true software, (1) When trying to restore the data on a partition to a different partition, will the first partition be written? (2) when restore directories and files, is it possible to restore the whole path? In my case, my entire partition has been emptied at one time by some unclear reason. I would like to recover all the original data on the partition, and the original directory structures on that partition. –  SteveO Sep 12 '12 at 2:12
    
(1) No, the recovery program simply copies the data from the source volume to the destination volume as a file. There’s no reason it would need to write anything to the source. (2) It depends on the program. Some restore directory structure and filenames, others do a “deep scan” of the disk itself to find lost files of specified types, and thus have no information about file or folder names. (3) In your case, you need an undelete/unformat/deep-scan tool since file/folder information may be lost (depending on how the partition was emptied). –  Synetech Sep 12 '12 at 5:14

Everything Synetech is true. However, there is still a risk (albeit small) that a recovery program, while scanning, could inadvertently alter a disk targeted for recovery.

This could happen due to a programming error, oversight, or even external interference/radiation. And don't forget potential issues caused by other programs or processes running concurrently or the operating system itself.

Standard practice outlines the use of a device, whenever possible, that write-blocks at the physical level to prevent inadvertent writing to the disk or media. Some exaples of physical devices include FastBloc, Tableau, and WiebeTech.

The next best alternative would be to create a physical bitwise copy of the media and run your scan/recovery on the copy and not the original.

share|improve this answer
    
Thanks! What does "Standard practice outlines the use of a device, whenever possible, that write-blocks at the physical level to prevent inadvertent writing to the disk or media" mean? –  SteveO Sep 12 '12 at 1:27
    
Everything Synetech is true. However, there is still a risk… This could happen due to a programming error… Yes; that’s what I said. don't forget potential issues caused by other programs or processes running concurrently or the operating system itself. Yup, the OS itself is usually a huge offender (though this question is about the recovery program itself, not general recovery issues). a device that write-blocks at the physical level Interesting. Other than write-protect switches (which are not available on HDs), I had not seen options to do this. I’ll have to check them out. –  Synetech Sep 12 '12 at 5:17
    
@Synetech: Thanks for the comment! (1) What is "a device that write-blocks at the physical level"? What is it opposed to? How is it useful for data recovery? (2) "Other than write-protect switches (which are not available on HDs)". Do you mean whether a partition on a HDD can be made read-only? I also wonder how to do that? –  SteveO Sep 12 '12 at 12:12
    
@Synetech and John: Thanks! (3) I was wondering if it is necessary to make the partition read-only during the data recovery scanning and restore stages, so to avoid any further writing into it, whether it is by human user, or the OS or other software? –  SteveO Sep 12 '12 at 13:04
    
@SteveO, yes, obviously avoiding any writes to a partition you are trying to recover is important since if you overwrite anything, it is gone forever. Hard-drives don’t have write-protect switches like floppy disks used to, and software solutions tend to be limited. It’s worth checking the devices that John mentioned (which I have not heard of). If you have room, you may want to clone the volume and perform tests on that. Also, make sure to remove any references to the drive-letter from the system to avoid having something write to it. –  Synetech Sep 12 '12 at 19:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.