Home

Learning to use any software always takes time. Some applications are very straight forward because their function is known.  For instance to write a simple letter in a word processor should be simple straight out of the box. For data recovery, the situation is more complex.  This is because each piece of media can fail in different ways.  No single approach will always work.  The following guide is intended to assist users find their way around the program, and bit by bit see what options are available and should be used.

To use this as a tutorial, follow each stage by clicking on the links.  Each stage there are several options, and these are discussed to assist.

There is also a chapter with extra, different tutorials.

The section Recognising sectors will be of use for any user not very familiar with the elements that make up a disk

Stages of data recovery

1. Connect suitable drive to computer with CnW Recovery software loaded. Installation and Media detection links may be helpful
2. Ensure that the drive is being viewed - use View sector to look at a few sectors
3. Run Wizard and select drive to recover data from

If wizard does not work, use manual mode

1. Select Recover files icon
2. For a hard drive, it is worth checking the partitions are valid
3. One of the following Recovery options will be displayed

               NTFS recovery

               FAT Recovery hard drives and memory chips

               CD Recovery

For disks that cannot be read logically

Certain disks may have been corrupted, or damaged to such an extent, that logical reading is not possible. For these disks, the next solution is the Data carving option.

For disks with many physical errors

If is common for disks to fail partially.  In this mode, many sectors will read, or read after several retries.  Some sectors will be unreadable.  Trying to recover from this disks can be very slow, in particular if there are failed sectors within the directory area. CnW has several tools to assist in creating a workable disk image.

To recover deleted files

Accidental deletion of files is a very common problem.  Recovery is normally possible, as long as other files have not been written to the disk. For CD-R, recovery should always be possible, but for CD-RW it is dependant on what has been written to the disk after deletion. The first stage for recovery can normally be the Wizard, and select the Recover Deleted File option.

To recover formatted disks

If a disk has had a complete format (and not a quick format) then your data is lost. There are stories that using special equipment, with the budget of the CIA, that it is possible to detect residual values of a previously written byte.  The argument, is that if a bit is changed form a 0 to a 1, then it may only go to 95% of the expected value. With the density of modern disks, and the recording methods used, I would suggest that it is not actually viable to attempt to recover more than maybe one or two sectors.  A typical JPEG photograph is about 1MB, or 8,000,000 bits, which is probably about 12,000,000 flux transitions on a disk.  That is a lot of work. For more details, look at www.nber.org/sys-admin/overwritten-data-guttman.html

If the disk has had a quick format, then normally only the directories and sector use tables are initialised.  The old data often still exists and can be recovered. The best approach to recover data varies slightly for each operating system, but for NTFS, searching for all MFTs is a good start. On all formats, there is the option to recover unallocated space, but this does have the problem that typically, filenames will be lost.

To recover files from unallocated space

Unallocated space is the area on a disk that the operating system says is free, ie there are no files in it. On a brand new disk, this space will normally be blank, or just the values used by the disk initialisation program. On a used disk, this space will often contain files that have been deleted, or possibly moved with a defrag program. The recovery of files from this space does depend on the operating system used, hence the normal recovery mode should be selected, and then the option to recover files from unallocated space should be enabled. All files from the unallocated space will be stored in a main directory of !recover. As there is no information on file structure, the recovery is basically in Data carve.  Another way to recover files from the unallocated space is to scan the disk for directory stubs, or MFTs (depending on operating system).  This will recover files in a more logical way, but the option to scan the unallocated space will still apply after all other files have been recovered.

Raid Disks

Raid disks can be recovered once an image has been created - see Disk image for more details.  For more comprehensive raid recovery, see the raid option, a chargeable option