Recommendations on the best Data recovery Software?

Give some recommendations on strong data recovery software for data that has been deleted? No system restoring software like Acronis, Rollback RX, or FirstDefense-ISR. Recovery for overwritten data?

 

Freeware solutions you might like to look at are PC Inspector File Recovery, EASEUS, NTFSUndelete, and Recuva.

For paid solutions you might consider EnCase, Forensic ToolKit [aka. FTK], or Helix3

There are currently no known software solutions for recovering data that has been completely overwritten.

 

Runtime GetDataBack is good.

 

Thanks for the recommendations! I want to see how well these products hold up. I'm going to use eraser to erase some data. Its going to be interesting to see how much i can recover. I seriously doubt that i will recover any data i've overwritten using 7 passes or more. Lucky to recover anything using 3, but i would like to see. I will delete a few things using standard deletion that comes with windows, and then try all the different methods eraser offers starting at the bottom, and working my way up to Gutmann 35 passes. I don't have a hardware device for recovery, but it would be neat if i did.

 

Why? Haven't you read other posts in this forum about this subject?

I guarantee you wont recover any file that has been overwritten 1 time Pseudo Random with eraser using any data recovery software period!

I know you will recover any file that has been deleted using the default delete method in windows though!

I guess when you realize you cant recover any file after the 1 wipe pseudo random you will stop trying as their will be no need to test a stronger Algorithm against any software recovery tool!

 

Just so you know, so-called "hardware recovery" is 99.9% myth, an idea based on Peter Gutmann's paper back in 1996 presenting a theory that certain data can be retrieved using an electron microscope. Nobody has ever actually done it to anyone's knowledge. Gutmann later wrote another paper (about eight years ago) presenting the theory, but with less certainty that it could be done by anyone except possibly the best of the intelligence agencies in the world.

In short, "hardware recovery" is mostly myth. There are no documented cases of data being retrieved through use of electron microscopes and it is still, alas, a theory. As for other "hardware recovery" methods: there are none. Yet, data erasers of all kinds continue to label their products and certain wiping algorithms as being recoverable by "software" and "hardware" means. It's all marketing. Even the various methods (3-pass, 7-pass) used by US government agencies are forward prevention methods only. Meaning, they are to protect against future technology.

So don't worry, an electron microscope or so-called "hardware recovery" would do you no good as it has never been documented to retreive a single solitary readable file overwritten even once.

 

Their was this one case though!

http://radsoft.net/rants/20031027,00.shtml

One should consider using at least a 3 wipe pass for super private data, and at least a 1 wipe Pseudo Random pass for everything else considered private, I don't care what kind of Theory's and mind sets the net provides on this subject in the current date, but you never know what they can come up with tomorrow, and the government has set guidelines for a reason, Not because it is impossible to recover data using 1 simple overwrite? But because it is better to be safe than sorry!

I live by 1 motto, I never want to have one of those days where I Should a, Could a, Would a, it is beyond myself to live by anything else when the only thing standing between the 2 are pure laziness and an extra 5 minutes of my time!

Hard Drives are a dime a dozen, but freedom and time is Priceless!

 

For more information on the subject you can also read this thread: https://www.wilderssecurity.com/showthread.php?t=233387
(so we won't repeat the same argument all over again here)

 

Yup .. but I would rather be 100% If I had something to hide, not 99.9% or as they say!

Again:

You never know what they can come up with tomorrow, and the government has set guidelines for a reason, Not because it is so called impossible to recover data using 1 simple overwrite? But because it is better to be safe than sorry!

I live by 1 motto, I never want to have one of those days where I Should a, Could a, Would a, it is beyond myself to live by anything else when the only thing standing between the 2 are pure laziness and an extra 5 minutes of my time!

Hard Drives are a dime a dozen, but freedom and time is Priceless!

If you feel 1 simple overwrite is 100% effective than more power to you, your the only one that has to fill your own shoes, not me!

Please: Feel free to contact the DA in Marc Watzman's case, and explain to them it should have been impossible for them to recover the 200.000 pics they recovered after he used a software to overwrite them with 1 simple pass!

Have a nice day!

...................................................................................................................................

 

Warlockz, I believe the point from Radsoft (in your provided link) is that the deletion was not done properly due to faulty coding from Robin Hood, not that a properly executed overwrite of data from a reputable piece of software is not enough. In other words, the same thing you argued in post #5. The recovery was obviously simple software recovery tools as, again, so-called "hardware recovery" is not used by LEA, or by anyone successfully (see my post #6 in this thread.)

 

No matter how hard we try we will never reach an agreement on this issue, so our best bet is to let the reader/s decide what he or she is comfortable using to which makes them feel Secure or not!

 

Thanks for the info! I bank, shop, and file taxes on line. So its a good ideal to secure delete data. I had not read the earlier threads on eraser.

 

Dont know about overwritten data, but here are the tools I use:

Basic recovery: Emergency Undelete (Single exe, no installation required)

RStudio: Great app, has lots of features, like quick scan, full scan, network bootable. I have never lost data using RStudio. I have even preformed a format and recovered the data from the drive - I lost the file structure (and some filenames), but was able to capture all the actual files.

Zero Assumption Recovery (ZAR): Similar to RStudio, but only allows full scans, which can be a PITA. Again, great at recovering data, however.

For a simple recovery of deleted files, I goto Emerg Undelete, run from a USB stick, for damaged hardware, formats, jacked file tables and other errors I go to RStudio. ZAR I generally only use as a failback if RStudio doesnt see a drive, which is rare.

 

Speaking of...any recommendations on good FREE recovery software for memory cards?

I used to have a great one for pulling pictures off corrupt cards, but I cant remember what I used.

 

If you use Sandboxie default browser with Eraser configured to wipe the dat file that it leaves behind, there will be nothing left to wipe....as far as surfing online is concerned. Unless I am missing something.

 

What you are attempting to do is by no means a simple task, and casually running a few data-recovery programs to see how much (if any) wiped data can be recovered isn't going to prove anything of consequence. You would need to have the skills, knowledge and toolset of a professional forensic examiner in order to draw any meaningful conclusions from this type of testing. Also, at the very least you should be using a hex editor such as WinHex, and possibly some forensics data acquisition and recovery software such as EnCase.

The first thing to get clear on is the type of threat you're defending against. If you're trying to prevent your personal and financial data from falling into the hands of a computer thief then merely wiping the obsolete data off your hard drive will not be particularly helpful, since your hard drive will likely still contain all of your current personal and financial data. In a case like this you would be much better served by the use of strong data encryption.

Of course, you must also focus on online security in order to protect your online usernames and passwords from being captured.

 

These are my recommendations amongst free software:

I recommend to use Recuva first, with the 'Deep Scan' option turned off, recovering only deleted files in 'Excellent' state. If this doesn't recover all the file(s) you wanted, then try PhotoRec. PhotoRec will take much longer because it ignores the filesystem and instead looks at the underlying data, a process called file carving. There are situations where the filesystem has been damaged or formatted, and thus file carving is needed for recovery. Recuva with the 'Deep Scan' option turned on also does file carving, but PhotoRec may be a better choice for file carving as of this writing because it may be able to carve more types of files than Recuva. See http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec for a list of file formats that PhotoRec can carve. See http://www.recuva.com/download/version-history for a list of some of the file formats that Recuva can carve.