Hi Can you guys help me to determine which software is the best one to use for data recovery?...

[G+_Bruno Barr]

Hi... Can you guys help me to determine which software is the best one to use for data recovery? I want to be able to recover files either after someone accidentally deletes them, or after a virus attack, or a hard drive error/failure, or a system crash, or unexpected loss of power, etc.

 

I've come across "EaseUS Data Recovery", which seems to be pretty decent based on what it says it can do, but I want to know if there are any real user's out there who can give me a real review on it, or is there anyone who can recommend something else equal to or better than "EaseUS Data Recovery".

 

Thanks in advance.

[G+_Michael Hagberg]

Disk error / failure use SpinRite from grc.com - Home of Gibson Research Corporation for undelete, first pull the drive, do not boot from it, install as second drive in another system, use about any undelete utility. If virus hope it only changed directory entry and not actual file data.

[G+_Black Merc]

Mho.. Spinrite(repairs hdd disk level errors, to ensure the data is there to read) then, and only then, run any undelete software to recover deleted/erased files.

 

[G+_David Peach]

If the drive is at all flaky and you are having to run SpinRite, I would clone the drive before trying to recover files. You can at least salvage what it clones. Then I use a utility called TestDisk. Helps repair MBR tables and undelete files. If you are just undeleting files then the sister program PhotoRec is slightly easier to understand.

 

cgsecurity.org - CGSecurity - Data recovery: TestDisk & PhotoRec

[G+_Jason Brown]

Easeus is okay, but like all data recovery software, it's not guaranteed to get the files you need. As far as it goes, I think it's just as good as any other. I used R-Undelete in my XP days, and that worked great as well. I think there is a more current version, but I've never tested that one and the old one doesn't work on newer versions of Windows.

 

As far as infections go, just get a USB adapter, plug it into another pc, and copy the files over. As long as it doesn't boot you should be fine. Then just clean the infections with something like Malwarebytes or reinstall Windows. If you got infected with one of the crypto bugs, there's not much you can do however.

 

Of course nothing is a replacement for a good backup plan. With an appliance like a datto, you can set up you back up frequency so you never need to worry about it again. We have customers call about restoring a file someone deleted on a weekly basis.

 

I'm currently working on convincing a couple neighbors to join an off-site, encrypted backup cooperative.

[G+_Golden Retriever]

There are programs for virus infections that are non-windows operating systems like linux-based on a CD or USB stick the key is an OS that the virus cannot infect, you boot to that OS and run the A/V software to scan and scrub the virus from your normal boot device.

The same goes for SpinRite you boot to the device containing Spinrite and run it on the device in question.

There are CD and USB thumb drives that are commonly created and carried by computer technicians used to do things like troubleshoot Hardware, partition hard drives, run A/V or Malwarebytes etc....

Some of these CD images are menu driven so you can load each tool into and out of its own VM in RAM the advantage of a CD is no virus can infect your media because you cannot write to it where a memory stick could be written to.

[G+_Jason Marsh]

TLDR: PhotoRec is good, consider ALL customer systems/drives as infected, don't put them on your network, and don't ever re-use removable media.

 

I've used EaseUS, PhotoRec/testdisk, Recuva, and many others. I like PhotoRec. It's FLOSS, multi-platform, simple to use, and quite effective. Also not from a company that has had a massive security problem in recent memory.

 

Sometimes the operator accidentally deletes things and they just need you to get it back for them, and for that PhotoRec/testdisk, Recuva, and other "undelete" and recovery programs are fine. For this type of recovery, you can usually complete the job on the customer's system, without imaging the disk or use of a sterile boot environment.

 

If the files are unreadable due to a disk error, image the disk before any recovery attempt, as recovery can be hard on a disk and could accelerate complete failure of an already failing disk. An image is a bit-for-bit copy of the contents of a drive, and recovery of data from an image will yield the same results as recovering from the original media. Recovering directly from an unhealthy disk could result in a dead disk before complete recovery. If you're collecting a fee for the recovery, recover from an image even if just recovering from an accidental deletion.

 

At least half of the computers I get in for repair are carrying malware of one form or another, whether it's just a noxious weed or the black plague. As such, I always presume the worst infection ever, and proceed with a bootable optical disk on the customer's hardware. I'll only plug a drive into my own workstation if I've run all the popular anti-malware tools and come up clean, and even then only if I really, really need to.

 

I would also recommend you setup a network segment that's only used for suspect machines, and that is not "downstream" of your primary network. See "Three Dumb Routers" or similar for how to do that.

 

Now, let's say the customer wants their data back on removable media instead of the system it's recovered from. Use optical or usb media, and never ask them to return it. The drive can come back with the ghonnosyphiherpaids. Don't risk it. Sure you could scan, disinfect, and then DBAN a USB drive, but that doesn't protect against BAD USB. Removable storage is cheap. Include the cost of recovery media into your fee schedule and consider them wasted once used. If someone gives you one back anyways, crush it and put into the box with your next electronics recycling run, or you could be your own next customer or, even worse, infect your next customer.

[G+_Bruno Barr]

Hi guys, I just wanted to say, thank you all for your responses. You guys have really given me a lot to think about. I've actually never heard of "SpinRite" before, but I will definitely give it a 'look see'.

 

I've often encountered many persons who were no longer able to access their files, due to a corrupted or failed hard drive, and unfortunately, I was unable to help them. Like many of you have suggested, I have actually disconnected the drive from their computers, then connect it to one of my computers (with either Windows, Mac OSX and Ubuntu), using my StarTech SATA dock. Sometimes it does work, and I'm able to recover their files. But, other times, the drives do not show up on the computers. Or I should say, the drives do not show up "readable". NB: If I go into the disk management section for either of the OS that I'm using, I may see the volume, but it's not accessible/readable. Sometimes I even get an error stating that the drive needs to be formatted (even though the person has files that they need).

 

For those of your recommending "SpinRite", will it work if the disk does not show up "readable/accessible", but only shows up as a volume under the disk management?

[G+_Black Merc]

Bruno Barr if the bare metal hardware can see the drive, 90+% spinrite will be able to help. Spinrite (according to its maker) not a recovery tool but a maintaince tool to keep the drive healthy but, can do recovery as needed during a maintaince routine. I (personally) seen windows bsod on a machine, reboot to spinrite to run/repair, and windows resumes normally after. Files recovered, errors corrected a due to spinrite...

Spinrite's history is quite interesting( must check out).