1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Windows "Free" Data Recovery Software

Discussion in 'Software' started by Arboreal, 24 Mar 2022.

  1. Arboreal

    Arboreal Keeper of the Electric Currants

    Joined:
    21 Jan 2011
    Posts:
    4,891
    Likes Received:
    1,238
    I have been given an unhappy 2.5" external USB drive to look at by a friend at a charity that I help with their IT.

    If it's plugged in via USB or SATA (having shucked it) it shows on my PC as D, but no more information other than it's corrupted.
    Chkdsk won't touch it and Disk Manager shows it as a raw partition.

    I have downloaded a couple of random data recovery apps, but wondered if anyone had any recommendations for something decent that's free or a reasonable 'pay to recover what I found' option?

    The Easeus one found 1.8TB of stuff on a 500GB drive, and that has a 2TB free limit.

    When I looked, it seemed to be full of duplicates with the same name and small files that are no use.

    From what I can see, this drive contains someone's attempt at a windows 'backup' where they have dragged and dropped their C drive to an external USB drive... :wallbash:
     
  2. Gareth Halfacree

    Gareth Halfacree WIIGII! Lover of bit-tech Administrator Super Moderator Moderator

    Joined:
    4 Dec 2007
    Posts:
    16,130
    Likes Received:
    5,062
    First things first: STOP WORKING ON THE DRIVE.

    You need to image it, because every moment it's spinning is another chance for the data to be gone for good.

    Image it, either to a file or another drive, then do all recovery on the image.

    As a Linux user, it'd look something like this:

    Code:
    $ ddrescue if=/dev/disk/by-id/ata-ExternalDrive of=image.img
    $ testdisk image.img
    
    The first command will create the image, then you can remove the drive; the second will load TestDisk, a data recovery tool, on the image. You could also use plain dd instead of ddrescue:

    Code:
    $ dd if=/dev/disk/by-id/ata-ExternalDrive of=image.img bs=4k conv=noerror,sync
    
    But if there's damage to the disk it'll drop more data and run more slowly than ddrescue.
     
    kim, Arboreal and liratheal like this.
  3. Arboreal

    Arboreal Keeper of the Electric Currants

    Joined:
    21 Jan 2011
    Posts:
    4,891
    Likes Received:
    1,238
    Thanks GH, Do you think Macrium Reflect could image it even if it's not showing up properly?
     
  4. Gareth Halfacree

    Gareth Halfacree WIIGII! Lover of bit-tech Administrator Super Moderator Moderator

    Joined:
    4 Dec 2007
    Posts:
    16,130
    Likes Received:
    5,062
    I 'unno, I've never used it. dd'll image anything to anything, it doesn't give a monkey's what you're trying to do. Image a hard drive to another hard drive? Sure. Image /dev/urandom to a CD-ROM? It'll give it a go. Image a serial port to a printer? 's your toner, whatever you want, boss. Image the Linux kernel to your soundcard's DSP? G'wan, then, but turn your speakers down first.

    Assuming that Macrium Reflect's got anything about it, it certainly should let you image a damaged drive. If not, 's a bit rubbish.
     
    Arboreal likes this.
  5. Arboreal

    Arboreal Keeper of the Electric Currants

    Joined:
    21 Jan 2011
    Posts:
    4,891
    Likes Received:
    1,238
    Thanks again GH, I've dropped into a rabbit hole that I haven't chosen!

    I do have an old Mint CD that I could live boot from and have a go.
     
  6. kenco_uk

    kenco_uk I unsuccessfully then tried again

    Joined:
    28 Nov 2003
    Posts:
    9,928
    Likes Received:
    496
    I've used photorec in the past with great success. It came up with some strange filenames but it at least salvaged them from a dying hdd.
     
    Arboreal and wolfticket like this.
  7. Arboreal

    Arboreal Keeper of the Electric Currants

    Joined:
    21 Jan 2011
    Posts:
    4,891
    Likes Received:
    1,238
    Thanks for all the suggestions.
    I did image it and the image was seen as corrupt and unusable, and Photorec did have a good go at it but only a list of files with inexplicably small files sizes came out.

    The list looked promising, all the sorts of things I was hoping to recover, but nothing of ans substance.

    I have now said I can do no more for it.
     
  8. creative

    creative 500rwhp

    Joined:
    23 May 2014
    Posts:
    581
    Likes Received:
    62
    not free.... but available from the usual sources, I highly recommend UFSExplorer.

    I had a drive that nothing was working on... at all! tried all the usual ones and zero luck. 1 did find files but they were all corrupt. Ran UFS and recovered 90% of the files successfully!
     
    adidan likes this.
  9. Invictus.

    Invictus. Minimodder

    Joined:
    28 May 2009
    Posts:
    732
    Likes Received:
    8
    I know there was the suggestion of DD imaging via Linux, but if you only want to use Windows, FTK Imager is free (https://accessdata.com/product-download/ftk-imager-version-4-5).

    From this I'd suggest imaging to "Raw(DD)" as the other types other tools likely won't be able to handle. Then you can work on that image file but you'll likely need to carve it to get any data off (but the tools I know and use for that aren't cheap).
     
    Arboreal likes this.
  10. kenco_uk

    kenco_uk I unsuccessfully then tried again

    Joined:
    28 Nov 2003
    Posts:
    9,928
    Likes Received:
    496
    There's the old bung it in a ziplock bag in the freezer for a bit trick. It's 50/50 but might be worth a punt?
     
  11. RedFlames

    RedFlames ...is not a Belgian football team

    Joined:
    23 Apr 2009
    Posts:
    14,917
    Likes Received:
    2,689
    You're more likely to know than I... can you use DD from within WSL... [or would it be easier to just boot off a live image of *distro of choice here*]
     
  12. Gareth Halfacree

    Gareth Halfacree WIIGII! Lover of bit-tech Administrator Super Moderator Moderator

    Joined:
    4 Dec 2007
    Posts:
    16,130
    Likes Received:
    5,062
    If it exposes drives as block devices, yes. Never tried it myself, though!
     
  13. Byron C

    Byron C Ripping a line of speed off a sh**-encrusted bog

    Joined:
    12 Apr 2002
    Posts:
    8,666
    Likes Received:
    3,100
    This is probably safer, depending on what you want to do. There's a lot of wizardry going on in WSL/WSL2 when it comes to filesystems.
     
  14. RedFlames

    RedFlames ...is not a Belgian football team

    Joined:
    23 Apr 2009
    Posts:
    14,917
    Likes Received:
    2,689
    There's some magic, but it's still a VM at the end of the day...
     
  15. Byron C

    Byron C Ripping a line of speed off a sh**-encrusted bog

    Joined:
    12 Apr 2002
    Posts:
    8,666
    Likes Received:
    3,100
    This is true, however it doesn't present drives as block devices.

    Compare Disk Management...

    upload_2022-4-3_14-14-12.png

    ...with sudo lsblk in WSL2

    upload_2022-4-3_14-13-22.png

    Notice that user prompt though - /mnt/c/Users/byron.... If I ls -lah against /mnt/ I see

    upload_2022-4-3_14-15-33.png

    WSL2 is based in a VM at heart, and your Windows drives are mountpoints inside your WSL filesystem, but those drives are not exposed as block devices.

    To answer your question, yes you can use the dd command in WSL2...

    upload_2022-4-3_14-19-50.png

    ...but you're probably not going to be able to dump a disk device to an image like you can in a "proper" linux distribution. You can probably work around it and somehow make it work in WSL2, but honestly if you've got the ability to boot from a USB device into a "real" live Linux distro then just do that instead.

    WSL is bloody great - especially WSL2 - and I use it daily, but it does have its limits.
     
  16. RedFlames

    RedFlames ...is not a Belgian football team

    Joined:
    23 Apr 2009
    Posts:
    14,917
    Likes Received:
    2,689
    Where were you when Gondolin fell over?...

    ...sorry... couldn't resist...
     
    Byron C likes this.
  17. Byron C

    Byron C Ripping a line of speed off a sh**-encrusted bog

    Joined:
    12 Apr 2002
    Posts:
    8,666
    Likes Received:
    3,100
    Honestly I've gone through so many LOTR place names for desktops & servers (mostly servers and laptop re-installs) that I'm running out! :lol:
     

Share This Page