Recover Deleted or Damaged Data, A short Guide For The User

Overview of data recovery software.

In the previous part, we examined the algorithms on the basis of which Data Recovery is performed. In this part, we will review programs with which you can really recover deleted data. Now there are plenty of this kind of software on the market: there are paid and free options, there are programs for a wide range of applications and there are "local" options (only for graphic files or for office documents, for example). Which user to choose depends on the specifics of his task and the “wallet thickness”.

One of the most common free programs is Recuva.  The principle of this program: after scanning the disk, it displays a list of deleted files. The utility allows you to recover files deleted from the Recycle Bin, as well as from MP3 players, flash drives, mobile devices. The program has a search by file name or by extension. “Recuva” also restores files from memory cards of various types, restores files from external drives, has a multilingual interface.

Another interesting solution from free software is R.saver.

The program performs:

- Recover deleted files.

- Reconstruction of damaged file systems.

- Data recovery after formatting.

- File recovery by signatures.

- R.saver also provides access to data on working file systems of the following types: Microsoft Windows, Apple Mac OS, Linux, etc. And also works with CD / DVD: ISO9660, UDF.

If you are dealing with the deletion or loss of data from home devices, and your case is absolutely not complicated, then we think that you can limit yourself to these kinds of free solutions with a wide spectrum of action.

In the case of corporate practice, or in order to use it in information security, we advise you to pay attention to commercial programs, both of a wide spectrum of action, and of a local nature. It makes sense to turn your attention to the Recovery Software family of programs; here there are programs applicable for general cases of information recovery, for example, RS Partition Recovery.

The RS Partition Recovery program will restore partitions of your disk after formatting, even if you manage to partition the hard drive again. All information that was in a cleaned or damaged section can be restored in full. There are 2 options for data analysis: fast (this is in case of slight damage to information) and in-depth data analysis for significantly damaged or re-worn disks.

Also, for various file systems, there are versions of RS NTFS Recovery (recovering deleted NTFS partitions) and RS FAT Recovery (recovering deleted FAT partitions) programs.

Well, we’ll add a number of programs for local cases of information recovery. For example, to recover lost, accidentally or intentionally deleted office documents, you can use solutions such as “RS Office Recovery” (recovery of deleted documents and tables MS Office and OpenOffice), “RS Word Recovery” (recovery of Microsoft Word and OpenOffice documents), “ RS Excel Recovery ”(recovery of Microsoft Excel and OpenOffice spreadsheets) or“ RS File Recovery ”(recovery of deleted files and folders).

To recover photos or video files that, for example, an attacker deleted from the camera’s memory card to hide evidence, you can use programs of the form: “RS Photo Recovery” (recover deleted photos) or “RS Data Recovery” (recover lost information from a USB flash drive or a memory card of a camera or smartphone).

To restore damaged files, you can use the utility “RS File Repair”. The RS File Repair program will repair damaged files after a failed recovery, restore the logical structure of the file after a virus attack, software or hardware failure, after copying data from a faulty hard drive or memory card.

Well, let’s add, as a universal means of recovering any information, the Hetman Partition Recovery program.

This utility recovers any types of files (it doesn’t matter which extension the file has). These can be Microsoft and Open Office text documents, digital images in JPEG, PSD, EPS, TIFF and other formats, spreadsheets in XLS, XLSX, etc. formats, data archives such as ZIP, RAR, etc., as well as video and audio recordings of the form AVI, DAT, MKV, MP3 and other formats. This program has support for all versions of the FAT and NTFS file systems used in Windows.

Working with the program is very simple and will not cause any difficulties even for ordinary computer users. There is a step-by-step “File Recovery Wizard”, with the help of which you can gradually perform all operations and competently restore lost information. What algorithms does this universal program use? The utility searches for file tables, as well as current or partially deleted fragments of old tables. The program also uses all fully preserved system information. It is taken from the partition table, its fragments, and the master boot record. Receiving the contents and service attributes of files, the program displays them to the user. In addition to the traditional methods, the method of “signature analysis” described by us in the first part of the article is used. Thus, with the help of a whole complex of algorithms, the restoration of lost information occurs. This greatly improves the reliability and performance of Hetman Partition Recovery and makes it one of the universal programs of this class.

The commercial version of Hetman Partition Recovery has a HEX editor. That is, we are available not only a preview of deleted files, as in many similar utilities, but also more features. When we use the HEX editor, it is clearly visible in which sectors the contents of the remote file are located and it is still possible to view service information about files.

Sometimes in practice, especially IT and information security specialists, it is necessary to work on “broken” disks (that is, those that have already been damaged or malfunctioning, both accidentally and, for example, when an attacker tries to damage it). When working with such storage media, you need to do everything carefully, but at the same time and quickly, and not every software solution can be suitable in this case.

“Hetman Partition Recovery” in the scanning process works in read-only mode. The program creates a “virtual image” of the disk and begins to restore data from it.

When is it convenient and applicable? For example, we recently got a mobile hard drive that was malfunctioning and turned off without permission at any time, i.e. There was very little time to recover information, but there was a lot of data there, so it is with the help of this kind of programs that you can restore data from failed disks.