Recovering lost and deleted files...

[danw]

Dear Members and Visitors,

In this topic I would like to describe result of our analysis of poplar data recovery software, available on the market.

Not a secret that in case of unexpected data loss, no matter is it was file deletion, virus attack, power failure or any other reason - data owner would be very interested in the data recovery.

When data loss is detected, what are next steps?

Right! He asks for "data recovery software" on internet search engine.

And search engine instantly proposes many choices.

Most of such software products are commercial shareware, often even not giving real try-before-buy functions.

So potential customer may just select software using principle: "most famous is the best!".

And this is not right.

Nowadays, many companies working on Marketing-over-Quality base, so even if customer purchases "most famous" and "most expensive" software product this not means he would get

better software solution.

Working in data recovery, we tried to make objective analysis of this situation, simulate 'mass customer' behaviour and look at results.

So, what were our "situations":

1. Lost Windows partition due to some failure (actually - destroyed MBR);

2. Deleted few folders with "critical" data on Windows XP NTFS partition;

3. Deleted few folders with "critical" data on Vista NTFS partition;

4. "Forgotten" data restore: recovery of data, deleted long time ago.

So, asking search engine we found many data recovery software products.

Making our choice we selected six "most popular" commercial software products:

Active@ UNDELETE - Data Recovery 5.5

Price: $39.95

Location: www.active-undelete.com

Handy Recovery

Price: $39.00

Location: www.handyrecovery.com

Stellar Phoenix File Recovery

Price: $69.00

Location: www.stellarinfo.com

Nucleus Kernel for FAT and NTFS

Price: $69.00 ($79.00)

Location: www.nucleustechnologies.com

GetDataBack for NTFS V3.03

Price: $79.00

Location: www.runtime.org

R-Studio v3.6

Price: $79.99

Location: www.r-studio.com

One much less popular commercial software product:

UFS Explorer Professional Recovery

Price: $69.95

Location: www.ufsexplorer.com

And one popular freeware product:

Smart NTFS Recovery

Freeware.

Location: www.smartpctools.com/ntfs_recovery/

Commercial products are represented in price ranges $40, $70 and $80.

They have different functions set, but all are targeted to solve problems like "ours".

So, software analysis follows:

Active@ UNDELETE - Data Recovery 5.5 (DEMO)

Popular and cheap application. We expected to see result-oriented, specialized software solution.

It has nice mass user-oriented interface, simple tools. Interface is designed to get result.

The surprise was to find RAID builder tool: most software products use 'RAID builders' in more

expensive software solutions.

We tested software using our testing plan and found:

1. Software not supports scan for lost partitions [0/10].

2. Very nice result for undelete on XP [10/10]

3. Very nice result for undelete on Vista [10/10]

4. No signature-based scan [0/10]

Additionally, we tried RAID builder but were unable to make it work. No any diagnostics, except 'some error occurred'.

Evaluating usability we also found:

- Very low memory use: would be nice for data recovery on very large file systems;

- Unable to backup/restore result of simple/extended scan. On large partitions scan might be really long-time so scan result backup is preferred;

- No any file preview (even HEX) for files over 64KB; should we trust or purchase to preview? One must know that deleted files are often overwritten; even other deleted files so some preview must be mandatory;

- Advance scan is too slow, taking to account poor results;

- No any signature-based search; in case of file entry reuse, data would not be accessible anymore.

- After advanced scan is completed, data is represented in 'virtual folders'; there are thousands files, but no any search available!

Taking to account 'test tasks' results [5/10], nice GUI and low price but many usability problems, our final score for this product is [4.5/10]

GetDataBack for NTFS

One of most expensive data recovery products for this analysis. NTFS-only specialization. We expected to get outstanding result with this software.

First surprise was after program is started: strange GUI, symbiosis of ancient-style layout and icons and modern MSO-controls.

But main software function is data recovery?

So, let's continue.

Starting recovery wizard, we got software hand on disks detection. Strange, but we was able to 'abort' detection, having all disks in list.

In disks list we were not sure how to recognize each disk (no name except some number), but we knew disks order and guessed.

Second surprise was hard-coded data recovery program: long-time scan for any recovery operation. Extra text visualization (is it required to user??) makes process slowdown and uses much CPU. No any advantages of this!

Software 'in any case' suggested detected partitions. Among suggestions were backup 'superblocks' of NTFS. So on Vista we had near eight different size partitions instead one. Did they forget to check volume identifier?

After this long-time scan finished we finally get result; changing few settings we tried to repeat with some different options (undelete is enabled and so on).

And were surprised with same long time scan again.

Our tasks result:

1. Scan of lost partitions works; partition detected but:

- many 'phantom' partitions;

- not exact file system was reconstructed (some folders were missing, some phantom 'numbered' folders)

Score is [5/10].

2. Deleted files on XP were detected, but not all [6/10];

3. Deleted files on Vista were detected, but not all [6/10];

4. Too poor result of 'advanced scan' [2/10].

Additionally, about usability:

- On each configuration change new long-time rescan required; it is very slow!

- Not supports disk mages at all;

- After scan is finished, we are able to use embedded 'Find file' tool. But search is not context-dependant, so we were unable to search in exact folder.

- It has signature-based search, but is too poor and not configurable;

- it just missed many (most in our case) deleted files with 'advanced scan'.

Initial task result was [4.8/10], but including many usability issues, high price and specialization, maximum score we could give is [3/10].

Also software is located in ".org" domain that must be non-profit and have higher page ranks in search engines.

Just one more not honest turn..

Handy Recovery

Simple, nice, cheap program. Target-oriented, This is the first opinion.

It is application just to solve the common-case, 'mass' problem like 'ours'.

Program is not 'to experiment', bit 'to use'.

So we started:

1. It found our partitions, however backup NTFS superblocks are again interpreted as 'new partitions'. Score is [9/10].

2. It detected our files on XP NTFS [10/10];

3. It detected our files on Vista NTFS [10/10];

4. Advanced scan detected many files, however signature-based scan has no many rules and thus many data was missed [7/10].

Testing usability we found files preview (but HEX only). File search exists, works but is not context-dependant, have strange combination of filter/search (no advantage on many folders) and only file-by-file search results. Program allows backup/restore recovery session.

Also background-running advanced search makes scan process slower; on-the-fly tree rebuilding not allows working normally when scan is in progress; so advantage of background scan is minimal. Even would be better to scan not in background but faster.

No any additional features, search problems but low price and yet good recovery results makes not large initial score change: [9/10] to [8/10].

Stellar Phoenix File Recovery

One of popular software products from company, working in advanced recovery solutions.

We just had no chance to miss it.

$70 price and specialization promises good results in data recovery.

Starting our test tasks we were very surprised: it didn't detect our Vista partition at all! Strange..

Also having full disk scan for lost files t has no partitions scan.

So testing our tasks:

1. No partition scans. Our files are lost... [0/10]

2. With normal scan of XP we found all our deleted files [10/10]

3. No chance to get data from Vista at all [0/10]

4. Configurable RAW scan promises good results, but in our case we had low detection rate [7/10].

Software usability is also at some low level. No any context tasks, including file search. No any file preview. Advanced search also has low detection rate and we not sure how re-configurable signatures might solve the problem. Rules for RAW recovery are too basic (hex search). Scan result could be saved/restored.

In conclusion, this software showed functions no more then on half of its price. Advanced tools (like signatures configuration), combined with weak basic tools makes software score at its [4/10].

Smart NTFS Recovery

Freeware product, making data recovery tasks available for free.

We tested it to compare it with commercial products and to find is it really the concurrent.

Software has simple wizard GUI, and we started.

1. No partitions detection available. Say bye to our lost data.... [0/10]

2. It found some files on our XP partition, but not all [6/10].

3. No files detected on Vista partition [0/10].

4. No any RAW scans [0/10].

Usability is at low level. No file preview. Software is just a simple solution to try. No more.

Some embedded adverts making software rather adware then freeware, so our score for it is [2/10].

Nucleus Kernel for FAT and NTFS

Software product at $70 ($80) price. Popular on Internet. What to expect? Of course result!

So let's start:

1. It detected our lost partitions and opened them nice [10/10]

2. Detected our lost files on XP NTFS: [9/10]

3. Detected our lost files on Vista NTFS: [9/10]

4. With RAW scan we were unable to find lost files (no signature based scan) [0/10]

Software has simple GUI, wizard-based recovery and is able to backup scan results.

However scan visualization takes much CPU and makes it slower. It has too long scan as for MFT-based scan only.

File preview works only with files recovery to temporary folder (not configurable) so there are great risk to damage data on disk with such 'preview'.

Overall software functions are poor. No context operations. File search exists but is not context-dependant.

Initial score is [7/10], but leak of functions and high price for them makes score [5.5/10].

R-Studio

Newer commercial product with aggressive advertisement policy. Becomes more and more popular.

Price is $80. Targeted to cover much more tasks then ours. It includes RAID builder, many file systems support many tools and all in one product.

Testing in our tasks we found:

1. Disk scan exists, however it is combined with files search so is slow and not target-oriented [9/10].

2. It found all our deleted files on XP NTFS [10/10];

3. It found all our deleted files on Vista NTFS [10/10];

4. It supports many file types for RAW scan; however custom search could not be configured [8/10];

Testing other software features to take 'entire view' of product we found it works good in other supported file systems. It has excellent file preview, best from all products we tested.

Supports 'abstract' RAID reconstructor on disks, partitions, images, virtual RAIDs with many settings, however delayed parity for RAID5 still not supported.

It may save and load disk images, even with password protection. Working with alternative file systems it has fast enough partitions detection and file systems direct access.

However its recovery functions sometimes make many 'phantom' objects, like 'phantom files', and empty folders and so on, making recovery harder.

Signature based search could not be configured. Surprise was not having partitions auto-detection virtual RAID arrays. Why?

Software also not supports result scan/restore.

Its interface is symbiosis of professional-oriented and user oriented; on our opinion this is not good, because making confused both users and professionals.

Overall opinion is as about professional-oriented product, re-oriented to mass user. Many missing functions, however many tools and buttons.

Tabbed GUI and strange window resizes makes user some nervous,

Overall score [9.3/10] would be increased to [9.5/10] with incomplete software functions, but powerful potential and nice file preview.

UFS Explorer Professional Recovery

Not very famous and one of new software products on the market. UFS in name means not Unix/BSD file system, but "Universal File System".

Promising, let's try.

Software makes surprise with simple ascetic GUI. Probably not good for users who likes nice interfaces, but all functions are compacted there with main menu and context operations.

So, let’s try:

1. Partitions scan. Perfectly. Received what is expected: [10/10].

2. Undelete from XP partition. Works strange, but efficient: all files found: [9/10]

3. No problems with Vista partition. Again strange, but efficient: [9/10]

4. RAW recovery is at high level: optimized/non-optimized scan, configurable signatures: after some setup would be able to recover really much data: [9.5/10].

Explaining score, let's precise what's fine there and what is not:

Undelete is divided into 2 tools: Undelete and RAW recovery. Logically it is correct, but might be not clear for end-user.

All files were detected, but half with normal undelete, scanning existing MFT and part with RAW scan, scanning disk.

First tool is VERY fast (fastest from tested products), whilst second gives more precise results.

So undelete works, but division into 2 tools makes -1 to our score.

RAW recovery works nice: user have full control on signatures and even make create saved presets to load on demand. There are many rules available, analysis by many fragments and so on.

-0.5 is just because embedded rules list is not complete enough and we had to add signature for our task.

One more disadvantage of undelete is absence of directory tree reconstruction in RAW scan mode, however it is compensated with context-dependant 'Find file' tool.

Testing other features we found software works perfectly with other file systems, making almost no difference in quality of file recovery.

It has some unique features, like data access and recovery from virtual disks of virtualization software, fully-configurable RAID reconstructor, including support of delayed parity for RAID5.

Software works with disk images as well (supports backup/load).

However there are bad sides: software is mostly professional oriented, so some features like direct disk fragments use/backup would not be used by mass user.

Some interface components are complex to understand.

Software just balancing between professional use orientation and wide functions set and acceptable price, giving full data recovery tool set for mass user.

Initial score for this product in data recovery task was [9.4/10], but taking to account really wide software functions we would increase it to [9.7/10].

CONCLUSION

No ideal software exists.

However we found at least two products to recommend for data recovery:

1. UFS Explorer Professional Recovery, www.ufsexplorer.com CHOICE

2. R-Studio, www.r-studio.com

These products shown nice recovery results for their price and are our recommendation.

UFS Explorer also has Standard Recovery edition with less functions but with same recovery result and price $40

The UFS Explorer Professional Recovery is our recommendation for data recovery professional and advanced users.

Other products shown different results:

1. Active@ UNDELETE - Data Recovery 5.5

2. Nucleus Kernel for FAT and NTFS

3. Stellar Phoenix File Recovery

- are the products to consider.

They might solve the problems with data recovery, but are not effective investments.

GetDataBack for NTFS

- is the product we not recommend. Along with high price and not honest way to increase search engine rating it shows poor data recovery result.

And finally:

Smart NTFS Recovery

- not a solution for most recovery tasks, but is free software to consider with no obligations.

--

Daniel W.

This analysis is given for informational purposes. Feel free to comment and use this text with the reference to the source.

Analysis reflects our opinion, but pretends to be objective.

Software was evaluated on specific, 'mass' situations so might not reflect full software functions.

Edited May 26, 2007 by danw

[bledd]

good read

[jaclaz]

For those interested, a link to the "original" thread:

http://www.msfn.org/board/Data_recovery_tool_t84345.html

jaclaz

[danw]

That was old thread I was only interested in opinions.

Now we made real testing and analysis and as you see - have interestng results.

Probably this would be useful to have final 'settement' apart of that thread.

[Stoic Joker]

I've long been a fan of GetDataBack, but now will reconsider this.

Thank You.