HDD GURU FORUMS

lcoughey wrote:FAT? EXT? NTFS? HFS+? APFS? XFS? ZFS?
HDD or SSD?
Single drive or RAID?

I'll assume NTFS on a single HDD. In such a case, I'd go with R-Studio, UFS Explorer or ReclaiME.

On a side note, you have to be the first real person I know of who uses MiniTool. The other million posts I've seen are all spammers.

Spildit wrote:I use DMDE ...

lcoughey wrote:FAT? EXT? NTFS? HFS+? APFS? XFS? ZFS?

On a side note, you have to be the first real person I know of who uses MiniTool. The other million posts I've seen are all spammers.

fzabkar wrote:If all you need to do is to recover deleted files, and if the file system is otherwise OK, then I wonder if the results would be better if one were to wipe all the active files.

That is, one could clone the drive and then delete and write zeros to each active file and its corresponding directory entry or MFT record. This will remove all traces of the newly deleted [unwanted] files, leaving only the remnants of the previously deleted [wanted] files.

CSL PC wrote:Is there any other tool that I'm not aware of that can do more than these 3 tools I used? All three gave similar result

fzabkar wrote:

CSL PC wrote:Is there any other tool that I'm not aware of that can do more than these 3 tools I used? All three gave similar result

I understand your question, but I would approach it from a different viewpoint. I'm wondering whether your data recovery tools would perform better by searching an "empty" user area. To this end I would remove all the unwanted files by filling their space with zeros. That should be easy to do with a file wiping tool. Then all that will remain on your HDD will be the unused space. If there are any previously deleted files, they will be located within this unused space.

As for other tools, GetDataBack is often mentioned.

fzabkar wrote:A file system consists of used space and free space. Ideally you would limit your search for deleted files to the free space. If your tool cannot do this, then you could fill the used space with zeros. That's all I'm suggesting.

I didn't know that there is a way to delete files completely without low level format.

As for Minitool it did most of the jobs for me, I did buy R-studio because most of data recovery using it. I did use photorec as well.

I have a case where I used 3 recovery software, R-Studio, Minitool, and photorec. All gave me slimier result.

I recently had a deleted user account to recover, but couldn't find anything above 2014 [...]

Not much info on the drive only 60 gig from 750g
...
I did a raw copy using hddsuperclone just in case.

Thats interesting
https://security.web.cern.ch/security/r ... %20MFM.pdf

In conclusion, as was presented in the previous chapters, a system to recover data from a hard disk drive through magnetic force microscopy was developed to do so from an un-degaussed hard disk under certain experimental conditions. The design of this system took inspiration from the read channels of modern hard disk drives to accomplish this goal. The performance has been poor even under these idealized conditions, but this is attributed to a particular form of degradation that could be removed by an improved experimental setup. Techniques to remove this degradation via signal processing were investigated, and while they have not proven successful yet, they still hold promise to be beneficial. Since the performance of the developed system has been poor even when recovering data from an un-degaussed hard disk drive, any amount of degaussing would make this systemunable to recover data. It should be emphasized that even if high performance could be achieved in detecting data from the images, the time required for the imaging process itself would make the recovery of any significant amounts of data intractable.
This having been said, it is interesting that the response of magnetic force microscopy to the magnetization pattern has enough similarities to that of a read head to allow the application of the design principles in read channels to this work. As the technology in both microscopy and hard disk drives evolves, the questions this work has sought to answer and the answers this thesis has provided might yet change. Ultimately, only time will tell.

abolibibelot wrote:

I didn't know that there is a way to delete files completely without low level format.

Even the free Recuva can do that (and many dedicated file shredding tools). WinHex can wipe files' contents and also files' MFT records. (Not sure about other file systems.) WinHex is also able to explore deleted file trees, although it's usually less efficient than R-Studio in my experience it's worth a shot (but it most likely won't give better results in this case, see below).

Good to know

As for Minitool it did most of the jobs for me, I did buy R-studio because most of data recovery using it. I did use photorec as well.

Then the question is, what particular file types are you looking for ? If the needed files are of a specific type which is not included by default in the list of file types analysed by any of those tools, it is normal that they can't be recovered in “raw” mode. R-Studio and Photorec allow to add custom file signatures, don't know about the others.

Photos is the main files but other as well like .ost, .bbb and videos.

I have a case where I used 3 recovery software, R-Studio, Minitool, and photorec. All gave me slimier result.

You mean “similar” I suppose ? yep :? It's surprising, as Photorec can only do “raw file carving” Yep even in raw files couldn't find what I'm looking for type of recovery, if both other tools, which are first and foremost designed to analyse the filesystems and recover as much files as possible based on their original metadata, doing “raw” search as a complimentary method (when the metadata structures are partially or totally damaged, or to recover deleted files which are no longer referenced because their metadata information has been overwritten), didn't find any files with the first method (i.e. with their original names and timestamps and directory location), it would mean that no valid metadata structures related to that deleted user account are available anymore.

I did find the account that was deleted with all the pst files till year 2014 and some photos, but he didn't do backup of the emails since that's why I wanted to find the ost file which I did but it is showing 0 byte nothing in it.

I recently had a deleted user account to recover, but couldn't find anything above 2014 [...]

Not sure what you meant by that. You mean the year 2014 ? yep year
Do you at least see actual data all over the “free space” ? (With the aforementioned WinHex, or with R-Studio's hexadecimal viewer – in the “Device view” tab, right-click on the target partition and select “View/edit” or press CTRL+E.) If it's already been wiped (or partially wiped), then nothing can be recovered. Does the customer remember how exactly that user account was deleted ? If he (or someone else unbeknownst to him) used a method specifically designed to really wipe the files (“cleaning” tools like CCleaner are able to do just that for instance), then none of the previously allocated files can be recovered, and what you are getting might be files deleted by a regular method prior to that.

The story is that the IT tech deleted his user account before backing him up and he disabled system restore to make sure it will be impossible to recover but he fail to do the backup, I don't know how or why. Now I did recover the System volume information folder that has 6.5 gig of files but I cannot extract the data from it. If someone can I'll send it to him and him for the job.

Not much info on the drive only 60 gig from 750g I did a raw copy using hddsuperclone just in case.

I don't remember if HDDSuperClone has an option to write an image in “sparse” mode ; ddrescue does for sure, so as a test you could copy that backup (whether you did a clone to another drive or an image file doesn't matter) to an image file (preferably on another drive, much better performance and less stressful for a HDD) with ddrescue -S (upper-case S switch = sparse mode). Then if you check the properties and see that the actual size of that image is in the vicinity of 60GB, you'll know for sure that there is nothing more to recover (in “sparse” mode only non-empty sectors are actually allocated).

The drive is good no bad sectors only deleted files. I'll make an image to check

CSL PC wrote:Hi gurus.

What do you expert recommend for deleted files?
I recently had a deleted user account to recover, but couldn't find anything above 2014, customer insist that there are more files on the drive.
Not much info on the drive only 60 gig from 750g
I usually user power data recovery if I can't find what I'm looking for I use R-Studio, Not much of difference though.
Please, any recommendation for a good paid software will be appreciated.

Rgds

ddrecovery wrote:

CSL PC wrote:Hi gurus.

What do you expert recommend for deleted files?
I recently had a deleted user account to recover, but couldn't find anything above 2014, customer insist that there are more files on the drive.
Not much info on the drive only 60 gig from 750g
I usually user power data recovery if I can't find what I'm looking for I use R-Studio, Not much of difference though.
Please, any recommendation for a good paid software will be appreciated.

Rgds

Maybe I missed it in all the responses:-
How did the user account get deleted?
Was Windows reinstalled?
Has the PC/laptop been used since?

fzabkar wrote:If all you need to do is to recover deleted files, and if the file system is otherwise OK, then I wonder if the results would be better if one were to wipe all the active files.

That is, one could clone the drive and then delete and write zeros to each active file and its corresponding directory entry or MFT record. This will remove all traces of the newly deleted [unwanted] files, leaving only the remnants of the previously deleted [wanted] files.