HDD Data Recovery

In our previous articles we've talked about how and why your data is actually not deleted when you accidentally delete them from your operating system.

When you delete a file from your computer, it is marked as 'deleted' and usually stay recoverable as long as it's not overwritten by other data. This is true even if you've totally emptied your recycle bin or pressed shift + delete to delete the files without first sending them to the recycle bin.

If you want to recover your deleted files from your hard disk, the first thing you need to do is not to write or save more to the same hard disk. Then, you'll need special data recovery tools and programs to restore your files/partition back.

Here are a few selected data recovery tools and programs that you can use to recover your deleted files and partitions:

Free Deleted Data Recovery Tools and Programs

Undelete Plus - Undelete Plus is a quick and effective way to restore accidentally deleted files. It can also recover files that have been emptied from the Recycle Bin, permanently deleted files within Windows using the Shift + Delete, and files that have been deleted from within a Command Prompt.

TestDisk - This is a powerful free data recovery tool to recover your hard disk drive. It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting your Partition Table).

Corruption Corrector - Corruption Corrector (CCorr) is a program designed for fixing corrupt files. It is for situations when you have (downloaded) many copies of the same file, but all of the copies are a bit corrupt. If the corruptions are in different parts of the file, it is possible to combine the good bytes from each file and get an uncorrupted copy of the file.

myrescue - myrescue is a program to rescue the still-readable data from a damaged harddisk. It is similiar in purpose to dd_rescue, but it tries to quickly get out of damaged areas to first handle the not yet damaged part of the disk and return later.

GParted Live CD - A hard disk is usually subdivided into one or more partitions. These partitions are normally not re-sizable (making one smaller and the adjacent one larger). The purpose of GParted is to allow the individual to take a hard disk and change the partition organization therein, while preserving the partition contents.

Knoppix - Knoppix is a GNU/Linux distribution that boots and runs completely from CD. Since you don't have to install anything on your hard disk, it's a priceless tool to use for hard disk data recovery operations.

System Information for Windows - SIW is an advanced System Information for Windows tool that gathers detailed information about your system properties and settings and displays it in an extremely comprehensible manner.

Ultimate Boot CD - Run floppy-based diagnostic tools from CDROM drives, free yourself from the slow loading speed of the floppy drive, consolidate as many diagnostic tools as possible into one bootable CD, run it from your USB memory stick

When you know you've lost your data, the first thing to do is not to write anything more on the affected hard drive. If you keep on saving things on your hard disk, you'll risk your lost data to be overwritten and forever gone.

In the previous post we've talked about why your files are still stored on your hard drive although they are deleted even from your recycle bin. The thing you should remember is your data is not totally deleted from your hard drive when you delete them, rather they are marked as deleted and keep existing on your hard drive until something else is overwritten on them.

So if you've accidentally emptied your recycle bin or deleted a partition, just don't save anything more on your hard drive and don't create a new partition. This way, your data will stay recoverable.

Steps to Recovery

In the previous article, we've also talked about what are boot sectors on a hard drive. If the boot sector is damaged on your hard drive you can't normally boot to the operating system. But this doesn't mean all your data on your hard disk is lost.

So, in this kind of situations, the best thing to try is transferring your hard drive to another computer. This way you'll both avoid overwriting your files and potentially be able to recover your files if your problem is a hard drive which refuses to boot up.

If you have damaged or erased essential operating system files, but the partition information is still intact Windows will not boot. However, the HDD can still be read from a different operating system which is one way out of the doom and gloom.

If this looks like your case, just try transferring your had disk to another computer, you'll see how easily you'll recover your data.

In the next post, we'll talk about how to recover your deleted files.

Let me guess. You've pressed shift + del and deleted your files or killed your hard disk drive without backing up. And now obviously you cannot find them in the rcycle bin. Let me tell you the truth: forget those files and move on. Not!

If you're at least a bit informed about computers, you probably know that the fact that you store your data on a HDD doesn't mean your data is totally safe. It can be close to safe if you're regularly backing up your data in an external hard drive. But clearly you're not doing it since you are here. Right?

Yes, data that you store on hard disk drives are not safe but this is not always due to the hardware failures. We, users, constitute the bigger part of the threat. It is always easy to delete a file by mistake, even for a professional. Operating systems know this fact, that's why we have a recycle bin. But sometimes we, humans, want to make things a little bit faster and press shift + del and the file goes to hell without even visiting our recycle bin!

Or perhaps it's not our fault at all and the damn HDD just stops working and refuses to show the way to our files. A more common scenario is we feel ourselves so comfortable with our system, back up our data on a 'safe' partition and grab that old windows CD to format the partition with the broken or infected operating system. However, something happens during the process and both partitions stops working before we begin to figure things out!

Whatever the reason, now you need a hard disk recovery to get your beloved files back. Before we begin recovering our data we need to know the basics of file systems.

File Systems

File systems are methods used by the operating systems to arrange the data and the free space on a HDD to make it writable and readible. Partitions are areas used to split a HD drive in certain sizes like it was consisting of two or more separate hard disks and they are recognized by the system as logical drives (C, D, etc) to write and read the data from.

Windows uses two file systems according to your choice during the setup: NTFS and FAT file systems. FAT file system is a rather old file system that was first used in DOS as FAT-16 and than in the later Windows versions as FAT-32.

NTFS file system, however, is used in Windows NT, 2000, XP and in the later versions. NTFS is a more secure and efficient way of storing data on our hard disks. It allows file-based security, compressing rarely used files to open up free space and stores back up copies of essential disk information. This sure helps in case you need a data recovery on your hard disk later.

Both file systems use the partition table and the MBR (Master Boot Record) found in the first sector of the hard drive. The system uses this info to locate the hard drives, determine which one is bootable and manage the administrative duties to boot the operating system.

If this data on the MBR and the partition table is damaged our system cannot boot up and might consider the partitions as blank if the partition data is deleted.

The first sector of a NTFS partition is reserved for the partition boot sector. Information stored on this sector is used by the operating system to read the partition. In the absence of this sector, the partition becomes unreadable.

NTFS file systems store a backup copy of the boot sector on the last sector of the partition so that the partition can be recovered and restored in case of a failure. FAT file systems also have a boot sector in the first sector of the partition but the downside about this file system is it lacks the backup copy on the last the sector. This is why NTFS is safer and relatively easier to work with in data recovery operations than FAT file systems.

Master File Table (MFT) is the first table stored on an NTFS file system. MFT is a listing of the names, properties and locations of all the other files stored on the partition. This is used as a reference by the OS to access the files on the partition. FAT file systems use File Allocation Table, as its name suggests, for this purpose. This info is also backed up on the disk and can be recovered but it needs to be located on a specific area of the disk in order to be able to start the recovery process. If that area is damaged, things start to get harder.

When you delete a file and later emty the recycle bin or press shift + del the first time deleting the file, the file is marked as deleted by the both file systems. The good thing, and which makes data recovery possible, about it is the file is not actually deleted from the hard drive, but the space it takes up on the hard disk is now considered to be free space.

This means you can certainly recover and restore your files when you accidentally delete them from your computer unless the space it takes up is overwritten by some other data. In practice, if you immediately notice and start recovering your deleted files just after deleting them, the chances are you are going to restore your files safely. However, probably you're not going to be able to recover the files deleted a year ago. But you still have a chance, so the best way to learn is to try, as operating systems don't easily overwrite things if you have a rather large hard disk drive and ample space on it.