9

My computer has stopped working because the hard disk has broken. I used it to store important data without having a backup, and several files (.xslx, .word, .pdf) could not be recovered or they are corrupt when we use a program to access it. Is there any other way to try to recover them?

I tried to recover them with some programs like TestDisk, PhotoRec, Recuva.

5
  • 13
    If data is important take it to a data recovery specialist. Common understanding that this costs 1000's of Dollars by definition is a myth in most cases. None of the tools you tried can be considered a serious data recovery tool. If DIY is only option, first step, IF the drive is even detected at all, is cloning the drive using something like HDDSuperClone. Jan 26, 2023 at 19:41
  • 15
    If you really want the data back, do not do anything else to the drive apart from shutting down the computer and removing the drive. Then contact a data recovery specialist as Joep van Steen said. Jan 26, 2023 at 20:38
  • 2
    More often than not, a bad HD is just a bad boot sector and the majority of files are intact. On another working computer, create a Live Linux USB stick. Then boot the problematic computer with that and recover your files back to the USB stick if possible.
    – selbie
    Jan 27, 2023 at 3:19
  • Does this answer your question? How do I recover lost/inaccessible data from my storage device? Jan 28, 2023 at 4:42
  • closed, of course. as far as I can tell he's not asking for a product, nor service, nor learning materials. Jan 28, 2023 at 15:06

1 Answer 1

22

Intro

I'll address specific question and tools tried (as these are commonly recommended tools) and go somewhat 'broader' so the answer may apply to other data loss scenarios too.

DIY or go to a pro?

If your data has value, go to a pro. Most recoveries, even those requiring clean room work do not exceed say $850 but some labs are in to $300 - $500 range even if clean room is required and if no additional parts need to be sourced.

Many failed DIY attempts may hamper recovery and add to the price. This is true if the data loss has a physical cause and if in-place repairs are attempted (partition table editing, rebuild RAID etc.).

As a rule of thumb, if the cause for the data loss is known, for example you deleted a file or partition or formatted a partition, it is safe to assume there's no physical cause.

With sudden data loss a physical cause should not be ruled out before hand, even if the damage appears to be at the logical level. For example, a RAW file system can be due to logical corruption, it is however also a common symptom for physical damage. Even just repeated read attempts can further damage a drive or cause firmware damage (g-list overflow).

If damage is obviously physical, for example after dropping a drive, a lab is always the best solution and DIY attempts are almost guaranteed to make the situation worse.

It does not hurt to use a S.M.A.R.T. utility. Although the information may be overwhelming it can be useful. Treat information as such: If the SMART tool alerts you about problems then assume there are in fact problems. However, absence of alerts does not mean the drive is okay by definition.

Check RAW values of at least following attributes:

  • Reallocated sectors
  • Pending sectors

If raw values are non zero the drive had, at some point, problems reading sectors. Large values IMO (say > 20) are alarming even if the SMART tools says they are not. An easy to use and free SMART tool is CrystalDiskInfo. In menu Function > Advanced Feature > set RAW values to 10 [DEC]. Most of the file recovery tools I'll recommend later on also can display SMART data.

Some words on SSD

It is true that SSD's are less prone to mechanical damage of moving parts. Still, sudden disappearance of data can have physical causes such as sudden loss of power. SSD's can and do suddenly fail just like conventional hard drives.

Also SSD's can experience 'bad sectors' although these are of an entirely different nature than bad sectors on spinning disks. Such bad sectors can have cascading effects and SSD's, once they start behaving odd or unstable can deteriorate rapidly. A a lab is not an option and you need more than a few files, skip to cloning.

What about TRIM?

TRIM is often misunderstood. it's is important to understand that TRIM is a command that is sent by for example the operating system to inform the SSD drive about a range of sectors that can be discarded. TRIM is not file deletion of erasure in itself.

It depends on a specific OS if and when it sends TRIM commands. One OS may send a TRIM command immediately if for example a file is deleted, the other may schedule weekly TRIM commands, or an OS may do both.

For example Windows sends a TRIM command when you format a partition or as soon as you delete a file - if it concerns a NTFS formatted volume. So, in general data recovery from a formatted partition is impossible unless: 'circumstances' (non 'supported' file system, older USB bridge not relaying TRIM commands, etc.).

If you however you can not access the partition because the file system is RAW, this is no reason for Windows to 'TRIM' that partition and in general one can assume the data can be recovered. So in general, an OS will only TRIM data that is purposely deleted.

TRIM =/= erasure, or zero-fill although it may appear that way. In short: Many controllers 'unmap' trimmed LBA addresses. Try reading such LBA addresses and the controller simply returns zeros without even ever reading the drive. A data recovery lab may be able to recover 'trimmed' data while a data recovery lab can not recover data that was truly overwritten, even if only overwritten with zeros.

Although many may associate TRIM primarily with SSD's, it (ATA TRIM) is also supported by specific SMR hard drives, and also TRIM like mechanisms are in place on for example SD Cards and CF cards.

TestDisk.

Can be used to make some in place repairs where it concerns MBR, partition tables and boot sectors. These are a tiny fraction of all things that can be wrong and prevent access to your data, and in general it's a bad idea to make in-place repairs. That said, for a knowledgeable person patching a disk can be the quickest way to recovery with only marginal risks.

Also reason for data loss plays a role: If the known cause is accidental partition deletion, and the layout of the disk is known, picking the correct partitions isn't rocket science and fairly low risk IMO. If on the other hand cause for the data loss is unknown it makes no sense to try TestDisk just for the sake of it.

Partition undelete/recovery only makes sense if partitions are not visible, not if new partitions were already created and formatted. Boot sector repair only makes sense if the issue is actually the boot sector.

TestDisk can also copy data from a volume provided damage to the file system is minor.

PhotoRec.

PhotoRec is a so called 'carver' that recovers files by scanning the drive for headers and footers. There are several drawbacks with this method:

  • Filenames are not recovered
  • Folder structure is not recovered
  • High false positive rate
  • Inability to recover fragmented files in most cases

If carving however is the only option, PhotoRec may be one of the best tools for the job. It's default 'rules' set is often more complex and accurate than even pro tools.

Recuva.

In essence a file undeleter, though if a file system was accidentally formatted with exact same file system the tool can handle that too.

It is not by any standards a serious data recovery tool that should be used on 'corrupt' drives.

File Recovery software used by professionals.

Tools for logical recovery used in data recovery labs include:

  • R-Studio
  • UFS Explorer
  • DMDE
  • ReclaiMe Pro
  • File Scavenger.

For these tools and-user versions are available too. They do not have to be expensive, 'cheapest' tool is $20 for a year license.

Clone / image a drive first!

Before a data recovery tech will even attempt any file recovery he/she will first clone or image a drive.

At DIY level best tools for cloning a drive for data recovery purposes are ddrescue and HDDSuperClone.

Even though these tools are designed for this and good at what they do (specially HDDSuperClone), if cloning/imaging is problematic (drive disappears randomly, extremely slow, noisy) it's wise to stop DIY attempts.

What if I just need a few files and I can still access the unstable drive?

I agree in such a case just going for those few files is likely to put less stress on the drive than cloning it entirely - a judgement call.

Good places at ask.

There are several places where data recovery specialists answer end-user questions.

  • Reddit, r/datarecovery and r/AskADataRecoveryPro
  • HDDGuru forums
  • Facebook group "Data Recovery Questions and Answers"

Questions or suggestions or criticism?

Please put them in the comments!

9
  • 3
    I must admit, some times I am less nuanced too. But in fact I like TestDisk like utilities and once made my own very similar tools, DiskPatch, that has been discontinued many years ago. And even as a 'pro' I some times resort to in-place repairs, preferably after imaging a drive though. I have had cases for example where a directory was damaged to a degree no tool would detect it as such. A simple disk edit and voila, back in business. Some times cases can only be 100% resolved by making in-place repairs, example: disktuna.com/sudden-appearance-of-usbc-named-folder-and-files Jan 26, 2023 at 20:30
  • 2
    In 1986 I lost access to my Atari ST harddrive. Bought a book containing stuff about disk internals. Using GFABASIC I found out that either the MBR or the boot sector was written with an offset of +1. After rewriting it everything was back to normal...
    – r2d3
    Jan 26, 2023 at 20:40
  • For example Windows sends a TRIM command when you format a partition. I kinda doubt this bit because AFAIK non-quick format / diskpart clean all still performs actually zero-filling, whereas the counterpart does not perform UNMAP/TRIM either regardless of drive type detected. (I can't rule out things might have changed though, especially when given the somewhat "rolling" nature in Windows these days.) On the contrary, pretty much all mkfs programs in Linux will BLKDISCARD the block device before formation, while the discard mount option is only default for f2fs.
    – Tom Yan
    Jan 27, 2023 at 5:46
  • As for the Windows, TRIM is run with "Drive optimisation tool" which is run every week by default or so, unless disabled manually.
    – Myszsoda
    Jan 27, 2023 at 9:09
  • Yes, but Windows in addition TRIMs immediately as I demonstrate here: youtu.be/NyLQbxnPurc Jan 27, 2023 at 13:08

Not the answer you're looking for? Browse other questions tagged .