Bienvenido! - Willkommen! - Welcome!

Bitácora Técnica de Tux&Cía., Santa Cruz de la Sierra, BO
Bitácora Central: Tux&Cía.
Bitácora de Información Avanzada: Tux&Cía.-Información
May the source be with you!

Monday, October 15, 2012

Recover Data from a Dead or Erased Hard Drive

Source
by Alan Henry
Don't worry, we're not going to ask where you got the drive, but there are plenty of ways to examine it and see if any of the data is recoverable. With a little time, the right tools, and some care, you may be able to get some data off of that drive.
Step One: Assemble Your Tools and Examine The Drive's Condition
The first thing to do is make sure you have the tools required to connect this drive to another computer safely. Ideally, you'll have some kind of SATA/IDE to USB cable or USB drive enclosure or sled that you can mount the drive into and connect it to your computer easily. Sure, if you have a desktop and like getting your hands dirty you can try to install the drive as an internal one, but an external connection is faster and easier. Next, take a look at the drive itself. Is it damaged in any way? Are the pins bent or broken? Make sure that the drive is in good enough condition to actually use before you try anything in the first place that may damage it even further. If the drive is too physically damaged to attempt recovery, you may need more drastic measures that we'll get to later. If everything looks good and you have the equipment required to connect the drive to your system, we can proceed.
Step Two: Grab Some Data Recovery Software and Connect the Drive
Before you do much else, make sure your antivirus and antimalware tools are up to date. You don't know what you'll find on this drive, and you don't want it to start misbehaving once the drive is connected to an active system. Once you've done that, it's time to download and install some data recovery tools. Here are a few we love:
  • Recuva (Windows, Free): Personally, Recuva has been indispensible. Made by the same folks behind CCleaner, Recuva makes data recovery simple and easy. if you're only interested in browsing and restoring selected files off of the drive, Recuva is a great option. Alternatively, check out Undelete Plus for Windows.
  • FileSalvage (OS X, $80): File Salvage for Mac will set you back some serious coin, but it's one of the best tools to pull data off of a connected hard drive in OS X. It can recover virtually any type of file on multiple partition types, and prides itself on its ability to recover from damaged drives and corrupt media. If you want an alternative, try Data Rescue for Mac ($100).
  • TestDisk (Win/OS X/Linux, Free): If you're not afraid of the command line, TestDisk is an open source utility that can run against almost any platform or partition type. It does a great job of recovering data quickly, and won't do unnecessary writes against the drive you're trying to recover from.
  • Bootable Linux distros for drive recovery: If you're not interested in messing around with apps (or paying for them), consider burning a bootable CD or USB key with BackTrack, Bart PE, or SpinRite on it, so you can boot to an OS that's not your primary drive, avoid writing or touching the drive you want to recover from, and run a host of recovery and forensics tools against that drive that are highly effective and completely free. Photo by Roman Soto.
A number of these tools can recover from formatted drives, especially if the data hasn't been overwritten. We've tackled this topic before, and used Knoppix as our bootable linux distro, but the steps apply to the ones we've mentioned as well. For more reading, check out this old but still largely accurate guide at Linux.com to recovering from formatted drives.
Remember, the less you work with the drive you want to recover data from, the better. As you read from the drive, you run the risk of exacerbating any damage it may have. The more you write to the drive, the more likely you are to overwrite something you want to recover. Bootable linux distros—many of which have tools like TestDisk pre-installed (among other, more advanced tools)—are the best way to go if you're familiar with the method and if you're interested in recovering entire partitions, or making a non-bootable drive bootable again. If you're just looking for files and you know the drive was in a Windows system or a Mac, a stand-alone app is an easier way to go.
Step Three: Get Out the Big Guns (and Your Wallet)
Okay, so the drive is physically damaged, has been wiped and overwritten, or nothing else you try works and you really, really need the data off of it. You're even willing to pay a lotfor it. We're not going to ask why, but at this point it's time to call in the professionals.
Pick up the phone and call the folks at DriveSavers and OnTrack to see what they can do for you. I've had good experiences with OnTrack. DriveSavers is well known and loved, both because they came to the rescue with free drive recovery services after September 11, 2001 and more recently helping Wired's Mat Honan recover from his epic hacking. Both companies do a superb job at pulling data even off of drives that have been formatted, overwritten, or even severely physically damaged. Keep in mind though that these services generally run in the tens of thousands of dollars and higher.


If the drive is yours, or the data you get from the drive is valuable, we'd strongly suggest you make sure your data is backed up, both locally and online. After all, it's better to be able to get the data back quickly than have to jump through these hoops every time a drive fails. Remember, every hard drive will fail eventually, it's just a matter of time. Now go forth, use this knowledge for good, and recover!


Sincerely,
Lifehacker



No comments: