Data Recovery Programs...Pros? Cons? Differences?

[alfarom]

DMDE has come on a lot recently. Also, it can be used with HDDSuperClone to extract data (it's not just a clone tool now). The developer was previously using R-Studio but says he has much more success running his product with DMDE as referred to above. The other major bonus with DMDE is the price. The Pro version is a real bargain and currently, if you have a pro version of HDDSuperClone (which is much more powerful than the free version) you can get a 50% discount off DMDE. I've been testing both this past few weeks during the draconian UK lockdown which has reduced my business by a huge amount.

I agree with HD Sentinel being more powerful than HD Tune but if I just need to check Reallocated Sector Count and Current Pending Sector in smart to get an idea of the condition of the drive it's very useful.

[abolibibelot]

DMDE has come on a lot recently. Also, it can be used with HDDSuperClone to extract data (it's not just a clone tool now). The developer was previously using R-Studio but says he has much more success running his product with DMDE as referred to above. The other major bonus with DMDE is the price. The Pro version is a real bargain and currently, if you have a pro version of HDDSuperClone (which is much more powerful than the free version) you can get a 50% discount off DMDE. I've been testing both this past few weeks during the draconian UK lockdown which has reduced my business by a huge amount.

The recovery efficiency may not be quite at the same level, though. I once made a test with a 32GB memory card, after deleting most of the files, some of which were fragmented :
– R-Studio (v. 8.7) managed to recover 335 out of 343 files flawlessly (matching MD5), only 8 were incomplete ;
– DMDE (v. 3.4.2.722 most likely) recovered 251 out of 343 files flawlessly.

Strangely, in WinHex 18.4, the data shown for most of the deleted files on that same SD card was erroneous, with a constant shift for each group of files, depending on their actual locations – the files located beyond 2GB had a shift of exactly -2GB, i.e. the actual data was found 2GB further than what WinHex was indicating (for instance it showed a file at sector 606400 when in fact it was located at sector 4800704), then -4GB beyond 4GB, and so on, until the last files which had a shift of -28GB. Is there an explanation for that, based on the way the FAT32 filesystem is designed ? How come WinHex didn't take that into account (it may have been fixed in the mean time), if R-Studio and other recovery softwares could at least identify the first cluster right ?

[alfarom]

It seems to vary according to the recovery. The developer behind HDDSuperClone got a better result with his product and DMDE rather than R-Studio. at least according to one of his videos.

[Arch Stanton]

The recovery efficiency may not be quite at the same level, though. I once made a test with a 32GB memory card, after deleting most of the files, some of which were fragmented :
– R-Studio (v. 8.7) managed to recover 335 out of 343 files flawlessly (matching MD5), only 8 were incomplete ;
– DMDE (v. 3.4.2.722 most likely) recovered 251 out of 343 files flawlessly.

I think the HDDSuperclone guy is referring to speed etc.. Been a while since I watched his videos, not so much logical data recovery capabilities. If I am not mistaking ..

Not defending DMDE or anything, but these comparison tests can be quite hard to interpret without knowing exact params. Was test cleaned for doubles, corrupted files for example? Was RAW scan included, were all files checked, an intact thumbnail in explorer does not mean actual file is intact. I test a lot myself, full test even with regards to small devices like memory cards are quite a bit of work. It's true though that results specially on FAT based file systems can show quite dramatic differences.

[alfarom]

I was going by one of his recent videos where he appears to recover more files in a comparison with R-Studio, he also says he recovered some image files in a better conditon with DMDE. Of course, that's only one comparison.

[Arch Stanton]

Yeah, found it: https://drive.google.com/file/d/1sMFL1_ ... sp=sharing

If you look at damaged files, could it be explained by R-Studio using larger skips when hitting a unreadable sector? Anyway, it's not per se the best way to compare logical recovery and file system reconstruction with HDDSuperclone in between.

Last edited by Arch Stanton on May 9th, 2020, 10:10, edited 1 time in total.

[alfarom]

That's the one.. You obviously know lots more about DR than me. How have you found HDDSuperClone Pro (assuming you use it)? I know it's not going to compete with professional hardware but it seems to work pretty well for somebody like myself for whom DR is only part of my repair business (I use a recovery company for all my serious stuff and get a commission on successful jobs).
If nothing else it gives me another product to recover data at a reasonable cost.

Also, I see you like your Sergio Leone films..

[Arch Stanton]

Also, I see you like your Sergio Leone films..

good catch!

[maximus]

Yeah, found it: https://drive.google.com/file/d/1sMFL1_ ... sp=sharing

If you look at damaged files, could it be explained by R-Studio using larger skips when hitting a unreadable sector? Anyway, it's not per se the best way to compare logical recovery and file system reconstruction with HDDSuperclone in between.

I believe it is because R-Studio did not get down the the sector size reads when a bad read is encountered. It only requested as small as 8 sector chunks from what I could tell, so 1 bad sector makes 8 bad sectors. The MFT of the drive is very fragmented, and I think it actually missed a whole MFT chunk because of this. DMDE itself is designed to read down to the single sector level when needed, which is why it works best with HDDSuperClone for data extraction.

I would like to point out that it is admitted in the video that if it had been a full clone attempt and not direct data extraction, R-Studio would have likely done just as well as DMDE. The video is intended to show that DMDE works best with HDDSuperClone for data extraction. It is not meant to show that either tool is better or worse at recovering from a full clone or image on their own.

[Arch Stanton]

Yeah that's kind of what I figured and was hinting at. it's more to say that HDDSC and DMDE are a better combo than HDDSC and R-Studio at this point.

[fzabkar]

The recovery efficiency may not be quite at the same level, though. I once made a test with a 32GB memory card, after deleting most of the files, some of which were fragmented :
– R-Studio (v. 8.7) managed to recover 335 out of 343 files flawlessly (matching MD5), only 8 were incomplete ;
– DMDE (v. 3.4.2.722 most likely) recovered 251 out of 343 files flawlessly.

ISTM that any deleted file in a FAT files system should be 100% recoverable provided that it is contiguous. It's only when files are fragmented that the various tools may differ. So AFAICS there were probably 251 contiguous files and 92 fragmented ones, or thereabouts. If that's not the case, then I would have to give a thumbs down to DMDE. Otherwise it would appear that R-Studio has a much more intelligent approach to fragmented file systems.

[Arch Stanton]

ISTM that any deleted file in a FAT files system should be 100% recoverable provided that it is contiguous

That, or with one of the FATs still intact. Assuming you mean 'deleted' in a broader sense, e.g. 'lost' files

[Arch Stanton]

NVM. I had the HDD Superclone thing in mind. With FAT deleted files, chain in FAT is zeroed by definition. Again, sorry.

[fzabkar]

With FAT deleted files, chain in FAT is zeroed by definition.

Basically what I'm saying is that, for a recently deleted file in a FAT file system, every DR tool should be able to find the file's directory entry. Using this information, the tool should be able to determine the filename (except for the leading character), the starting cluster and the total number of clusters. If the file was contiguous, then it should be completely recoverable. If DMDE failed to recover such a file, then I would have to question its worth.

[Arch Stanton]

With FAT deleted files, chain in FAT is zeroed by definition.

Basically what I'm saying is that, for a recently deleted file in a FAT file system, every DR tool should be able to find the file's directory entry. Using this information, the tool should be able to determine the filename (except for the leading character), the starting cluster and the total number of clusters. If the file was contiguous, then it should be completely recoverable. If DMDE failed to recover such a file, then I would have to question its worth.

Yes, I understand.