Disk recovery

Hard drive recovery with CnW Software

CnW data recovery software will recover files from all types of hard drive that have failed logically, and from the majority of drives with physical errors such as failed sectors. As long as a PC can see the physical drive, often in a USB caddy, then data will be recovered. Failed boot sectors, missing MFTs, or FATs can all be overcome, as well as disks that have been repartitioned.

Types of
logical disks handled

HP Media Vault
● MTF / .BKF images
Unix/Linux XFS
Unix ext2 - ext4
● Unix Reiser 3
CD ROM, Joilet, UDF, and quick erased CD-RW

Hardware setup
The two major stages in hard drive recovery, after you have download the demo software are

Access the physical disk drive
Recover the data

Once the hardware is configured, the program will assist at every level to enable data to be recovered from a very large number of logical, and physical failures. CnW Recovery software will recover all files that exist on the hard drive, and very often with full file names and directory path names.
Overwritten files are not possible.

Hardware access
The first element in recovering data from a hard disc is the hardware configuration. With data recovery it is important that the disk being recovered is not written to. For this reason, CnW software does not try and access the logical drive C. It also never writes to the physical drive without warning. There is also logic to prevent saving files on the disk being recovered.

If a drive has failed, or has been corrupted, nothing must be loaded onto it, and it should be moved into a new computer and accessed as just a slave, ‘data’ drive. CnW Software can then be loaded on a new host computer.
There are several ways that a drive may be connected to another computer, and the following is probably not an exhaustive list

Place the IDE or S-ATA drive in a USB caddy. This is a very nice approach as it can be hot plugged, and does not involve removing the computer case. USB1.1 and USB 2.0 both work, though USB 1.1 is rather slow. USB3 or eSATA is by far the best. This is also the method that CnW typically use when developing recovery programs.

Place the IDE drive in a Firewire caddy - this is similar to the USB described above

An IDE drive can be placed inside a computer using a spare connector. It may be necessary to change a jumper from Master to Slave.

For S-ATA, there may be spare S-ATA connectors in a computer - alternatively, it is possible to purchase a low cost PCI adapter card

For SCSI, there may be a SCSI connector in the PC, otherwise a SCSI adapter card will be required. SCSI cards can be expensive. SCSI drives are also not very common.

For laptops it is normally possible to purchase an adaptor that enables the drive to be read with the normal 3.5” IDE interface. These adaptors cost a few dollars. On some laptop drives, there is an extra connector with gold fingers - this will need to be removed (pulled off) to get to the standard connector with pins. Many lap tops now use S-ATA drives which connect with the same interface as 3.5” S-ATA drives

The next stage is to ensure that the computer sees the drive as a logical device, eg Drive K: Administrative Tools / Computer Management / Disk Management will show all detected devices, and if required a new drive letter can be selected. If the drive is not detected, then it is possible to scan for new drives, sometimes it is necessary to power off and restart the computer. CnW Software will detect Physical drives, as well as logical so mapping to a logical drive is not always necessary.

If it is not possible to detect a drive, then CnW software will not be able to help - it indicates a hard malfunction, rather than a logical corruption. Very often though, a drive will be seen in CnW Software, perhaps as Physical drive 3, but is not visible elsewhere on a PC.

Data recovery
On starting CnW disk recovery software the wizard will be displayed, and at that point the required drive should be selected, and the Hard Drive icon clicked. The program will then start analysing the disk and will display an appropriate option screen for the media. For many drives the process will be fairly automatic, for very corrupted drives, choices may be offered to determine the best way forward. At no time is data every written to the failed drive, so if one solution does not work, other options can be tried.

At all times with the software F1 function key will give a context sensitive help screen, and the help system gives examples of typical recovery procedures.

For manual recovery, the normal approach is to use the Recover function, and the program will then go to the relevant routine for the type of media. For hard drives this will be NTFS, FAT or HFS+ (Macintosh) recovery. A few Unix disk formats such as XFS are being developed, as well as exFat, but contact CnW for more details.
If logical recovery is not successful, the Image Raw function will detect and recover files based on both signature, and meta data. Often, file names will be created based on file contents.
Unallocated space can also be recovered

Should one recover or logically repair a failed disk?

There are many programs that will attempt to repair a failed disk, or maybe just undelete files that have been deleted. The quick answer to this question, is do not touch them if your data is valuable.

How disks get repaired
A disk can be repaired by finding the problem and correcting it. For a deleted file, this may be isolating where the file was stored, read the data and then save the file. The problem with this is that the first deleted file will be recovered OK, but when it is saved, the location it is saved in is in effect random. ie The operating system decides where to save the file and has no knowledge of where the old file was saved, or where the next file to be recovered is saved. This it is quite possible for the recovery of one file to overwrite data that has not yet been recovered.

Why CnW does not allow processing of C: drive

To help try and prevent the above issue, CnW does not allow access to the C: drive, or Physical Drive 0: These are typically the system drives and often written to. The operating system writes lot, sometimes as temporary data, or system updates. CnW stores logs that by default are on the C: drive. Thus the way to recover from the C: drive using CnW software is to remove the drive and set it up a slave on a different PC.

Correct procedure
CnW does not consider drive repair as an option - the only exception would be the single boot sector (MBR), but then only with care. The following stages are the recommended method
1) Create a disk image. This could be considered optional but should always be done if the disk is failing, or recovery is part of a forensic application. An extra safety stage would be to read the disk with a write blocker.
2) Recover the files onto another disk drive
3) Only when 110% sure of full recovery, possibly copy files back to original drive.
4) Retain copy of the original image for a suitable period of time, in case stage 3 was not correct.

Free demo