Jump to content











Photo
- - - - -

Free file recovery tool.


  • Please log in to reply
7 replies to this topic

#1 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 29 November 2020 - 09:48 AM

Hi everyone,

                   Can anyone recommend a free tool that is able to mount an external USB drive that windows reports as being unformatted/raw to view and fully recover the folder structure and files.  Ideally it would be possible to run it in a WInPE.

 

Thanks in advance.

 

 



#2 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 29 November 2020 - 11:17 AM

DMDE:

https://dmde.com/download.html

 

is probably the best out-there, but a number of caveats apply, it is not the easiest software to deal with.

 

Anyway the FIRST thing that you MUST do is to make an image of the USB stick, than make a copy of the image and ONLY work on this latter image.

 

DMDE has a provision for making images from physical drives, but of course you can use other tools, any tool capable of making a "dd-like" or RAW image would do.

 

That is in the (hopefully) hypothesis that the issue is a partitioning/formattting/filesytem issue, a with USB sticks it is common that the issue is in the controller and rarely anything can be done about it by a non-professional (and often even by a professional).

 

In any case, if you succeed into making the image (and its second copy) and if all you want is to recover files, the other recommended tool is photorec:

https://www.cgsecuri...g/wiki/PhotoRec

 

:duff:

Wonko



#3 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 29 November 2020 - 12:02 PM

Thank you Wonko,

                              DMDE certainly looks to be a very capable tool, the only downside is that the free version has restrictions on file recovery.

It's an external USB 1TB hard disk that I hope to recover rather than a USB stick.  The file system has become corrupted for reasons unkown. 

I don't mind buying a license if I know it can do the job, but it would be nice if I could do this without the expense.

 

I'm unsure if the software is able to mount the raw partion so that I can view and copy folders and files directly to another drive I'll give it a try following your guidance.

 

I'll check out PhotoRec too.



#4 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 29 November 2020 - 01:12 PM

Well, the limits for the freeeware version of DMDE are rather ample:

 

With Free Edition you may recover up to 4000 files from the opened panel per single command call (you should first open a directory with the necessary files on a panel and then select recovery from the panel).

i.e. you cannot recover *all* the files in one single command, which BTW is not something is usually done, as one would want to explore the rebuilt/recovered filesystem and copy file with some order (whilst a professional may want to simply "extract everything"), as well other "professional edition only" features are usually not needed. 

 

BTW, forgot to mention, the main difference between DMDE (that also have carving abilities) and Photorec (that is a "pure" file carver) is that - if possible - DMDE will recover files including their filesystem metadata (i.e.essentially the filename) and will (hopefully) show the recovered filesytem structure (path/directories, etc.) whilst Photorec will try to recreate new files from data extents (losing filename and original placement) and - of course - the ability to recover is heavily dipendent on the fragmentation of the original.

 

The actual way the corruption happened is VERY relevant, as more often than not it ends up being a few structures corrupted (the partition table or the data in the PBR) and in this case, before Photorec, Testdisk would do.

 

:duff:

Wonko



#5 Tokener

Tokener

    Frequent Member

  • Developer
  • 378 posts

Posted 29 November 2020 - 01:37 PM

@Nuvo

In case the partition is RAW, the first I'd try is Minitool Partition Wizard -> Menu [Wizard] -> [Partition Recovery Wizard]

It can recover partition structure in no time. If the drive was too often partitioned it might fail.

Good luck.

 

Regards   T.


  • wimb likes this

#6 Tokener

Tokener

    Frequent Member

  • Developer
  • 378 posts

Posted 30 November 2020 - 02:56 AM

Forgot to clarify:

You have to delete the RAW partition, because the Wizard can find / restore partitions only if area is "empty" / unallocated.

If you made a forensic image as Wonko recommended, you can make experiments without any danger to loose data.

T.

 
 

 

 



#7 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 30 November 2020 - 11:22 AM

Thank you for updating you post Retokener.

I'm still getting to grips with DMDEs tricky user interface but I've been able to successfully recover some test files so far.

I'll give Minitool Partition Wizard shortly to see if I recover the partition structure.  The drive only has a single partition so it should hopefully be a straight forward task.



#8 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 30 November 2020 - 12:37 PM

Thank you for updating you post Retokener.

I'm still getting to grips with DMDEs tricky user interface but I've been able to successfully recover some test files so far.

I'll give Minitool Partition Wizard shortly to see if I recover the partition structure.  The drive only has a single partition so it should hopefully be a straight forward task.

 

In DMDE, once it has analyzed the device/image, you are given the choice to choose among several "found" volumes.

(or get to it from Drive->Partitions)

 

If the disk didn't contain any "plain" disk image, you are proposed only one or maybe two possible volumes.

 

There will be green letters beside the drive and the volume.

These are very relevant as they may give a hint on where the issue lies.

A "good" device will have a T near the drive

A "good" volume will have EBCF.

 

Their meaning is explained here:

https://dmde.com/man...partitions.html

 

and of course - even if is an "advanced" topic - you can normally fix the issues from within DMDE, including (highly advised) save/backup the current partitioning scheme before making changes.

 

:duff:

Wonko






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users