Carving software comparison

[bunty]

Guys
Logical recoveries have become historic with SMR / SSD drives as even quick formatted recovery may not be possible from each case anymore
However customers insist to give it a try & only way is to try raw recovery.
I want to know your opinion on pc3k DE vs R-studio vs UFS explore .I would like to know any other software which can be included in this comparison.
UFS is very costly but in some cases it can decrypt clear key bitlocker while r-studio so far does not support it.
DE is very slow through USB interface (scanning nvme ssd through USB) while on C-port it can be done at 5% time taken by DE.
Pls.suggest

[Alt(R-TT)]

Guys
UFS is very costly but in some cases it can decrypt clear key bitlocker while r-studio so far does not support it.

R-Studio does support clear key/self unlock for BitLockers. It unlocks such containers automatically.

[bunty]

Guys
UFS is very costly but in some cases it can decrypt clear key bitlocker while r-studio so far does not support it.

R-Studio does support clear key/self unlock for BitLockers. It unlocks such containers automatically.

I have found R-studio results are far better than UFS which is clumsy , difficult to configure ,fancy exorbitantly charged when it comes to raw recovery at least & I have just compared it with R-studio
(both trial versions latest)
Almost 100% raw files recovered by UFS were corrupt while success with r-studio was better .Update frequency of r-studio is also high besides base costs.
What are opinions of other memebers ?
Yes I tried bitlocker clear key also R-studio has decrypted volume without any efforts. I will go ahead with R-studio renewal only.
Now I want to compare results of r-studio & PC3K DE. Is there any alternate software.

[Lardman]

Depending on your target

https://www.klennet.com/carver/ and https://www.goprorecovery.co.uk/index.html are also worth having . ( goprorecovery has been bought by cleverfiles so expect it to be absorbed into diskdrill at some point)

No added features but do the job they were designed for very well and at a reasonable cost.

[bunty]

Depending on your target

https://www.klennet.com/carver/ and https://www.goprorecovery.co.uk/index.html are also worth having . ( goprorecovery has been bought by cleverfiles so expect it to be absorbed into diskdrill at some point)

No added features but do the job they were designed for very well and at a reasonable cost.

Many Thanks
I have got good solution for photo /video recoveries . I have hardware dongle of another software CNW .

[Arch Stanton]

* With regards to klennet / GpProRecovery: I think you may discover they're not very well suited for hard drives and if speed is a consideration, as indicated in OP, these may be least desirable. Also note that once you copied video from memory card to a hard drive much of the specific camera induced fragmentation issues you have on cards no longer apply.

* Regarding GoProRecovery specifically, grab a copy now if you toyed with the idea, soon it will cease to exist as a separate tool, it will be part of DiskDrill in the future.

* As rule of thumb, the quicker the carver the more simplistic it's approach as a result the less precision you get.

* I'd argue, after you verified whether formatted volume was trimmed or not using a hex viewer or some visual entropy tool, carving is just a waste of time no matter what your customer wants you to do. You are the expert, not the customer.

* As a general carving hint, limit number of file types you hunt for, I have seen too many times ppl get incomplete files due to using a very broad set of file types they carve for and the carver prematurely truncate a file due it stumbling on a supposed next file start.

* I pick the tool best suited for situation at hand, for example I have seen UFS get me intact MP4 files where others don't. I have used DMDE to create custom signatures where others wouldn't let me create a signature I needed, an example being BRAW files: R-Studio or UFS just didn't offer the tools needed (AND / OR conditions).

[bunty]

* With regards to klennet / GpProRecovery: I think you may discover they're not very well suited for hard drives and if speed is a consideration, as indicated in OP, these may be least desirable. Also note that once you copied video from memory card to a hard drive much of the specific camera induced fragmentation issues you have on cards no longer apply.

* Regarding GoProRecovery specifically, grab a copy now if you toyed with the idea, soon it will cease to exist as a separate tool, it will be part of DiskDrill in the future.

* As rule of thumb, the quicker the carver the more simplistic it's approach as a result the less precision you get.

* I'd argue, after you verified whether formatted volume was trimmed or not using a hex viewer or some visual entropy tool, carving is just a waste of time no matter what your customer wants you to do. You are the expert, not the customer.

* As a general carving hint, limit number of file types you hunt for, I have seen too many times ppl get incomplete files due to using a very broad set of file types they carve for and the carver prematurely truncate a file due it stumbling on a supposed next file start.

* I pick the tool best suited for situation at hand, for example I have seen UFS get me intact MP4 files where others don't. I have used DMDE to create custom signatures where others wouldn't let me create a signature I needed, an example being BRAW files: R-Studio or UFS just didn't offer the tools needed (AND / OR conditions).

Thanks Arch Stanton
Vey much useful hints , I am mostly looking for msoffice file types. As you have suggested I will not take cases where trim was enabled or substantial overwrite has already taken place.
Let's hope diskdrill will not scrap goprorecovery but continue it or improve it further.

[Alt(R-TT)]

Now I want to compare results of r-studio & PC3K DE. Is there any alternate software.

PC3K DE is a part of a hardware/software bundle. So you need to compare the PC3K bundle with R-Studio + USB Stabilizer.

[fzabkar]

If you are limiting yourself to file carving, without any consideration for file system metadata, then PhotoRec may be the best option in some cases. That's because it supports more file types.

https://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec

[bunty]

If you are limiting yourself to file carving, without any consideration for file system metadata, then PhotoRec may be the best option in some cases. That's because it supports more file types.

https://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec

Thank you fzabkar
Yes I will add photoRec as well , it has hugh signatures,but I want accuracy too.

[posidon]

None of the super expensive forensic tools advertising advanced carving technologies are useful.
I have tried few of them & are useless.
I am also curious to know more about PC3K's efficiency & False positive nos. as I have not done it myself .

[Amarbir[CDR-Labs]]

Guys
UFS is very costly but in some cases it can decrypt clear key bitlocker while r-studio so far does not support it.

R-Studio does support clear key/self unlock for BitLockers. It unlocks such containers automatically.

I have found R-studio results are far better than UFS which is clumsy , difficult to configure ,fancy exorbitantly charged when it comes to raw recovery at least & I have just compared it with R-studio
(both trial versions latest)
Almost 100% raw files recovered by UFS were corrupt while success with r-studio was better .Update frequency of r-studio is also high besides base costs.
What are opinions of other memebers ?
Yes I tried bitlocker clear key also R-studio has decrypted volume without any efforts. I will go ahead with R-studio renewal only.
Now I want to compare results of r-studio & PC3K DE. Is there any alternate software.

What ,
I use UFS More then anything else in the world ,There is nothing like 100% RAW Files were corrupt , I Do File and Folder Extractions and also RAW extractions on 3 to 45 cases on daily basis with UFS

[bunty]

Guys
UFS is very costly but in some cases it can decrypt clear key bitlocker while r-studio so far does not support it.

R-Studio does support clear key/self unlock for BitLockers. It unlocks such containers automatically.

I have found R-studio results are far better than UFS which is clumsy , difficult to configure ,fancy exorbitantly charged when it comes to raw recovery at least & I have just compared it with R-studio
(both trial versions latest)
Almost 100% raw files recovered by UFS were corrupt while success with r-studio was better .Update frequency of r-studio is also high besides base costs.
What are opinions of other memebers ?
Yes I tried bitlocker clear key also R-studio has decrypted volume without any efforts. I will go ahead with R-studio renewal only.
Now I want to compare results of r-studio & PC3K DE. Is there any alternate software.

What ,
I use UFS More then anything else in the world ,There is nothing like 100% RAW Files were corrupt , I Do File and Folder Extractions and also RAW extractions on 3 to 45 cases on daily basis with UFS

Thanks Amarbir
May be trial version I have used is the reason. Cost is another major concern with UFS.

[Arch Stanton]

Thanks Amarbir
May be trial version I have used is the reason. Cost is another major concern with UFS.

Consider if you absolutely need the professional edition or that the Standard or RAID version for example covers your needs, and then get commercial license for that if you're providing a service to 3rd parties.

https://www.ufsexplorer.com/manual/stan ... -storages/

[bunty]

Thanks Amarbir
May be trial version I have used is the reason. Cost is another major concern with UFS.

Consider if you absolutely need the professional edition or that the Standard or RAID version for example covers your needs, and then get commercial license for that if you're providing a service to 3rd parties.

https://www.ufsexplorer.com/manual/stan ... -storages/

Thanks for pointing out very important point.
Considering advanced features its always advisable to have UFS explorer Professional edition . I think its better to save money & go for pro. version only.

[Amarbir[CDR-Labs]]

Bunty ,
i meant i do 3 ~ 5 recoveries a day not 45 its a typing error ,Also you can buy recovery explorer pro instead of ufs pro version .I used that for 1 year and i loved it

[bunty]

Bunty ,
i meant i do 3 ~ 5 recoveries a day not 45 its a typing error ,Also you can buy recovery explorer pro instead of ufs pro version .I used that for 1 year and i loved it

Thanks Amarbir
Yes as for as data recovery or carving is concerned both products have almost same features (excep UFS has support to ZFS file system & bitlocker decryption feature)
recovery explorer has cost advantage .