The bolt from the blue
So, you boot the PC and see that one of your logical drives has disappeared or even the whole partition marked as “unformatted”? Or the drive seems OK, but you missing some files and folders or getting “File cannot be opened” / “Wrong file format” errors?
Or maybe you have accidentally deleted important files or installed Windows onto a partition where you stored family photos? Selecting wrong drive during the partition table creation is another common reason of data loss.
Who's to blame?
The most common reason for the faults of first type is errors in the partition table or in the file system structures. They can appear after incorrect or unplanned system shutdown, software or hardware failures or as a result of virus activity. Another possible reason is a partial damage to the disk surface (also known as bad sectors). Unfortunately, on modern drives bad sectors can be found after a few weeks or even after a few days of use.
If your data was lost due to the user mistake, then I think we need no further explanation for this reason :)
What to do?
If you haven't copied or moved any new files over, then the old data is still physically exists, but all references to original files and folders in the file system now removed or corrupted. So you need to locate that data on the storage device and read it properly.
When data has been physically overwritten on a hard disk (e.g. you have formatted your drive and installed a new OS) it is generally assumed that complete recovery of the previous data is impossible. In this case your chances to rescue the information depend on your luck and proportion between the lost and written data. For example if you have accidentally deleted 1GB of business data and then copied 50GB of family video onto the same logical drive, your chances to get original data back are very slim. It should be noted that programs like Windows ScanDisk tend to make everything even worse, since they delete file system structures (like MFT in NTFS), which they unable to interpret.
To recover your data you may want to use special data rescue software. Such programs usually scan the whole storage device and collect file system information. These scan results can be used to build a map of file fragments and directory tree. This map describes relations between files and clusters, file names, sizes and other file system attributes — everything that was found during the scan process. If this isn't enough for recovery, then special extrapolation methods may be used to complement scan results. After that recovery program can read selected files and folders in accordance with the file map and copy them to another media.
According to my experience, if your storage device is in good order, then all the recoverable information can be rescued using the tools described below. Only in certain cases low-level recovery can increase amount of salvaged information.
There is a certain probability that data loss has been caused by a physical failure of a drive. And possibly you will not be able to determine nature of such a failure without special tools and skills. Although software that we are going to use does not perform any destructive actions (it will not write anything on the drive we recover the files from), attempts to perform any rescue operations on a drive with physical damage will worsen the situation, up to complete impossibility of recovering anything at all. So if you have lost critically important information, you should contact a professional data recovery company.
What tool to use?
There is plenty of data recovery software on the market offering different algorithms and each of them can be a better solution depending on exact situation.
To make this article suitable for a wide readership I will describe the UFS Explorer software. The reason for this choice is that program supports recovery from wide variety of file systems and can be run under different operating systems.
Needless to say that most modern storage devices are supported.
Besides, authors of this program offer even more affordable software editions, limited to the single file system support. These editions are functional and cost-effective data recovery solution for accidental data losses and a great way to save for experienced users.
If your PC has only one hard drive then it's highly recommended to connect that HDD to another computer, especially if you need to recover data from the logical drive with OS installed. If such option is unavailable then at least do not install the software onto the drive you need to restore information from! As we said above, every writing operation can be tragic for the lost files since the space they occupy is marked as available for writing.
An additional way to perform the same manipulations safely is to run the software from the UFS Explorer Recovery CD: this will help to avoid writing to your storage device and allow saving rescued files to any external drive, flash stick or network folder.
How to do?
Download UFS Explorer software and install it onto your machine (in this article I'm using ver. 4.6). Please note: you should never download or install any software onto the logical drive, containing lost files — this may overwrite your valuable data and cause its permanent loss.
Before purchasing the software you can download the fully functional demo to test if your files can be recovered. The only limitation of the trial version is that you'll be able to save only small files.
- After running the “Hard Drive Repair” shortcut, you will see the main program window. Its left part contains list of all storage devices (with corresponding partitions) connected to your system. When you click any of these drives or partitions you will see a brief summary about the selected device or partition in the right panel.
Found storage devices are marked by the hard drive icon; found partitions are marked by round icons, which change their color depending on supposed state of the partition. Green icon means that initial analysis has shown satisfactory condition of the partition; yellow - potential problems or slight damage; red - partition errors; grey - the file system type cannot be detected.
You can view the content of the nonfaulty partitions by double-clicking the corresponding partition in the left panel or by selecting it and clicking “Explore” button at the top of right panel.
In certain cases lost information can be accessible in UFS Explorer without any scan, so you may skip further steps and recover your files right away. - To start the recovery process first of all you have to select the partition, which was used to store the files you wish to recover — if partition is visible just click on it with the left mouse button and proceed to the p.3.
If file system is damaged and drive has no visible partitions (or the required one didn't show up in the program), select the proper drive and click “Find partition” button at the top of the right panel. Click “Find now” in the opened window and select appropriate file system(-s) and scanning range in the “Define scan parameters” dialog. After the partition search completes select one or more found partition(-s) to be used as the source of data to rescue. After you click “Use selected” button, corresponding partitions will appear in the left panel of the main window, so you will be able to select them to perform the data scan. - When source partition is selected, click “Recover” button at the top of right panel, “Data Recovery: general scan parameters” dialog will appear. Here you can select the file system which was used on the partition and set a scanning range.
Most probably you don't need to change anything here, because the program will detect and set proper parameters automatically.
“Recover” button also available during browsing of a partition at the top of the main window.
- After clicking “Next” you will see “Data Recovery: ... file system” dialog, which contains additional recovery options. By default “Search for deleted files” option is set, so this is what the program will do.
“Reconstruct the file system” option should be used if drive missing a partition or if you are going to rescue data after file system failure - program will attempt to reconstruct the file system using found fragments of information.
IntelliRAW is a search method that ignores found fragments of file systems and performs raw file search using known file signatures. Enable this if the reconstruction didn't help or you haven't found required data. IntelliRAW uses sophisticated algorithm that makes it much more powerful than a plain raw file search.
Click “Start” button to start scanning process. Scanning a 300 GB HDD could take up to a few hours, while scanning of a 2GB flash drive requires just a few minutes. Overall speed depends greatly on a particular model and technical condition of the device. - When scan is complete you will be returned to the file system explorer window, where you will see the results. The interface used for browsing is very similar to the Windows Explorer — with tree-styled list of virtual folders on the left and their contents on the right.
In the left part of the window you will see virtual folders with scan results:
- “... file system” (marked with a little green ball) is just an overview of files available directly, without any recovery operations.
- “Deleted files” - list of the deleted files and folders.
- “Reconstructed file system” is a virtual folder that contains results of the file system reconstruction.
- “Detected by type” contains files found with the IntelliRAW recovery method.
Note that number of virtual folders depends on the options you have set on step 4, so if you haven't enabled all four scanning methods you won't see some of these folders.
- Browse through the folders to find the data you need to recover. When you found required file(-s) or folder(-s), right-click on it and select “Copy to...” in the drop-down menu. Then select the destination folder and click “Save”. Note: the destination folder MUST be on other logical drive! Even better if it's on other physical drive or storage device.
Instead of copying you can preview any file - just right-click on it and select “Open”. This operation requires a temporary folder, program will offer to set its location if you haven't done that before (choose other logical drive!).
Now check the files you just salvaged — if everything is OK then you can sigh with relief :)
Before closing the program make sure that you restored everything you wanted or save the scanning results (right-click on any of virtual folders in the left panel and select “Save this recovery result”). Otherwise you'll need to scan your drive once again even if you need to recover just one more file.
This article has been written exclusively for hddscan.com
If you would like to publish or reproduce any part of this article on the other Internet recourses you would have to get an agreement signed by the author of this article.