Urgent Help Needed - Data Recovery

http://www.gillware.com  data recovery service $379

STOP...if the data is critical, do not try to install utilities or repair it yourself.  Any use of the harddrive WHATSOEVER including scans, etc may only make the problem worse.  ESPECIALLY if it's making one of those loud popping noises or smoking! (not good)

I know of a couple repair centers that offer free analysis and a quote...so that you can pick and choose what you want restored (thereby saving $$).
http://www.nationwidedatarecovery.com/
http://www.iomegadatarecovery.com

good turn around times too.

You can use many programs in the case of "accidental" format:
http://www.recovermyfiles.com
I just did a google search for "recover formatted drive".

I personally? I use a program called Encase Forensic Edition, but this isn't for the average home-pc user, more for retrieving data from HD's seized during a criminal investigation.  (It is also several thousands of dollars).  I say this not to brag, but to make the point that the cheapest recovery tool isn't always the one that will actually work for your particular situation.

However, the issues you describe each have different solutions in my book:

Drive has Crashed: We are talking the drive is making a funny grinding sound, the computer says there is no hard drive present, and/or the hard drive keeps making a clicking sound over and over again while it is on.  The drive has had something physically go wrong with it internally.  In this case, I'd go w/ irwinpks on this one and send it to a place that can take the drive apart, and attempt to recover your data in a clean-room.

Drive has bad blocks/sectors:  This assumes that the data is still  there, but the drive is in the process of failing.  In this case, the FIRST thing I would do would be to boot the computer using a CD like ERD Commander or even a Ghost boot floppy and attempt to copy as much of the data off of it.  
Then, I would use  a utility to attempt to repair the damaged areas, I like GRC's Spinrite http://grc.com/spinrite.htm  This program will test the integrity of the entire disk, attempt to repair bad areas and if unsuccessful in the repair, then it will attempt to at least recover the data from the bad areas and move it to good areas.
Finally, I would do one last copy to see if I could grab anything I missed during the first copy. :) Price?  plus $89.00 for SpinRite $499.00 for the ERD Boot disk (now part of a larger utility Suite which has some pretty great recovery tools on there too)
If you don't want to pay for the ERD boot disk, you can always download one of the many free Linux Bootable CD's and boot your computer with that, or install the ailing drive in another computer as a slave and copy your data off that way...

Drive has been formatted:  I use EasyRecovery Pro (tho you could likely get away with EasyRecovery DataRecovery instead).  EasyRecovery Pro has the ability to retrieve data from a disk that has been formatted EVEN ACROSS DIFFERENT FORMATS!  So if you had a disk that was Fat32 and now it is NTFS, you can tell it to recover data based on the FAT32 standard.  It is really quite amazing how it does this, I've tested it and it really works! ER Pro is $ 499.00 for a "home" user OR $199.00 for the DataRecovery edition)  http://www.ontrack.com/

Hope this helps!

__Mal

Shame on me!  In my zeal to get to the technical bits, I overlooked what should have been my first statement, and that is exactly what rairdonm stated... If the data is CRITICAL, then you need to turn the PC off, and contact a recovery service.  Popping or clicking sounds usually means the magnetic heads in your hard drive have shattered, and your drive could get more and more damaged every time you heard that "CLACK!" sound and the arm of the hard drive thrashes from one end of the drive to the other, possibly scratching the surface of the hard drive platters with pieces of what used to be the magnetic read/write heads..

You definitely need to weigh the value of the data vs. the risks you run.. Always leave it to a professional if the data is something you (or your business) can't live without.

http://www.oo-software.com/cgi-bin/download/download.pl?lang=en&product=OODR4

Complimenting O&O UnErase, O&O DiskRecovery V4.0 enables you to recover important files and data on storage media with damaged or deleted file systems. Quickly and easily you can scan your hard disks, USB sticks, digital cameras, and other storage devices for deleted data and swiftly restore them with O&O DiskRecovery V4.0.

---

http://www.pcinspector.de/file_recovery/UK/welcome.htm

PC INSPECTOR™ File Recovery 4.x is a data recovery program that supports the FAT 12/16/32 and NTFS file systems.

The current version 4.x replaces the previous version 3.x, which is now over 6 years old.

Here are some of the new features in PC INSPECTOR™ File Recovery 4.x

• Finds partitions automatically, even if the boot sector or FAT has been erased or damaged

• Recovers files with the original time and date stamp

• Supports the saving of recovered files on network drives

• Recovers files, even when a header entry is no longer available. Competition products cannot recover such files. The "Special Recovery Function" supports the following disk formats:

    *
      ARJ       AVI       BMP       CDR       DOC       DXF       DBF       XLS
      EXE       GIF       HLP       HTML       HTM       JPG       LZH       MID
      MOV       MP3       PDF       PNG       RTF       TAR       TIF       WAV
      ZIP                       

Tolomir

@jhance-- My statement is made from personal experience, usually when I've encountered drives that are stuck in an endless recalibration mode, a post-mortem has revealed that one of the heads has come off the arm, and is hanging on by a very thin wire.  It was explained to me many years ago that this condition is referred to as the heads having shattered.  Admittedly, this came from a tech who started his IT career working w/ hard drives that were massively large and the platters were the size of LP's (at least to hear him tell it).  So perhaps this is one of those cases where bad information perpetuated under the guise of education.  

I defer to your expertise and appreciate your professionalism in your correction. I knew joining up EE to try to help others would educate me in the process :)

I would say that finding the head loose from the arm would be due to an attachment failure and not a shattering of the head.  Today all HDD heads are "thin-film" which is a technology that makes heads the say semiconductors are made.  They are a tiny piece of silicon that has the head pattern etched into a thin metalized layer.  The head is about the size of a grain of salt.  Not only is silicon a very sturdy material the very small size of the head makes it very strong.

Perhaps in ages past the head, which was quite a bit larger and much more fragile could break or shatter.  I do have in a closet somewhere a massive (in size) 5MB 8" hard drive.  It dims the lights when you power it up and sounds like a freight train.  I kept it because the enclosure is clear plastic and you can see the workings of the drive.  The heads are visible and they are about 1/4" square with the fine wire coils clearly visible.  Very cool in my opinion.  Anyway, I suppose it's possible for the head to come unwound or the very fragile ferrite core to break.  I think the drive date from about 1982 or so.  Make by Seagate, amazing that they are one of the original hard drive vendors and are still around...  Most others have gone by the way...

gorhamoien,
To get back to your question, in my experience GetDataBack is the most effective of the mid-priced recovery tools. It's not free, but it's not expensive either. It will recover data from formatted HDD, and I have used it on clients' behalf quite a few times, always with positive results.
As r-k said, you can download it here:

www.runtime.org/gdb.htm 

You don't pay until you're sure that it has found your files.

Good luck!

Thank you all that have contributed to this issue. However, sending to a data recovery center and them charging us thousands of dollars is what we want to stay away from.

What I am looking for is for someone to tell me if they have purchased a software that works effectively of recovering any kind of data and operating systems, cd, floppy, hard-drvie. Lot of companies out there are doing this and literally ripping people off when all they do is use a software. But I am not sure which one will work for any circumstances. Someone talked about the software called Encase Forensic Edition? How effective is that and how much does the software cost? Will this do a good job of recovering no matter how many times a drive has been formatted? Is there a limitation as to when data cannot be retrieved or there is no such thing like that. Please only people who know hardware core and programming language or worked with it reply. Everything that is hardware has to have some reasons as to why, how and when.

One more thing I read that one can hook as a secondary drive before restoring. Id the hard-drive cannot be recognized by the controller how can one recover then? Anyone worked in a clean room before and has any experience please reply.

These tools will only function if you had logical r/w problem but no real hardware related like fire / smoke etc...

If the harddisk was physically damaged like in http://www.techtalkradio.com/ontrack.htm you need help from someone like the named company.

Btw. the free http://www.pcinspector.de/file_recovery/UK/welcome.htm is really worth a try.

Tolomir

"What I am looking for is for someone to tell me if they have purchased a software that works effectively of recovering any kind of data ..."

As I said above:

"...in my experience GetDataBack is the most effective of the mid-priced recovery tools." :

www.runtime.org/gdb.htm 

Try it. You only pay for it if it recovers your data.

Hmmm..  Ok, perhaps we need the exact scenario you are working from.  As I mentioned in my post above there are different methods depending on what kind of damage we are talking about.  Your question seems to have many parts.  

A) You wanted to know how much Encase Forensic Edition would cost you?  
Probably around $5,000.

B) Is there one software that will recover a drive in any kind of circumstance?
Not to my knowledge.  Most software out there depends on having the ability to access the drive.  If  the BIOS can't see it, then the software is useless since it depends on the operating system's ability to see the drive in order to  acess it.  That is to say, if the drive has a physical hardware failure (controller  fried, heads have lost their ability to calibrate and therefore cannot access any part of the hard drive, etc) then software will not help you.

C) How many times can a drive be formatted before any of the software tools mentioned here will stop working?
This is a tricky one.  It has less to do with how many times a drive is formatted, and more to do with if the drive was "wiped" or not.  Wiping basically overwrites every available area of the hard drive with all 1's, all 0's, alternatining 1's and 0's, random patterns (you get the idea).  What this will do is fill up every area of the  disk, assuring that nothing that was there previously is recoverable.  If you properly overwrite the hard drive (even once), there is no commercial software tool out there that can recover your data.  For the purposes of this conversation, the data is gone, no software will get it back.

D) You mentioned in your last comment that you don't feel most putting the drive in another computer will work since the drive can't be recognized by the controller?
Does this mean that the situation you find yourself in is that you have  a hard drive that isn't being recognized by the  BIOS and you would  like to know what your options are?  If that's the case, you might want to take a look at a very similar question that was posted.  The discussion basically hinged around the possibility of getting an identical hard drive, and swapping the  controller card, in the  hopes it would bring the drive back to life.  https://www.experts-exchange.com/questions/21830503/Need-to-repair-fried-hard-drive.html

Help us narrow down your request so  we can better assist you with your answer. :)

MalleusMaleficarum, Thank you again. Well $5000 is lot less then sending each and every bad drive since the data recovery centers charge over $2500 to recover if they know that the material we are searching for is for legal purpose. We have a combination of linux, unix, widnows, novel etc OS systems so if Encase is the way to go we are better off there. Do you have a screen shots of that software by any chance?

What do you mean by "wiped" drive? Is fdisk and reformatting not the procedure to wipe out the drive? If not then what wipes the drive totally that no software or hardware can ever recover any data off that?

Some more links: http://en.wikipedia.org/wiki/File_wipe

http://en.wikipedia.org/wiki/Disk_formatting

http://en.wikipedia.org/wiki/FDISK

Tolomir

If the recovery is for legal purposes I would encourage you to not attempt it on your own, but call a professional data recovery service. The one I recommend is Gillware (link posted above). They will give you a quote before starting, and they don't charge if data cannot be recovered.

@gorhamoien...data recovery has come down in cost in the last 5 years...Gillware, which is the first comment charges $379, and as r-k mentioned, no charge if they can't recover.

How about restoring your data from backup?  Surely, you have one of these lying around right for your valuable data.

www.guidancesoftware.com is where you can purchase Encase.  However, know that this is only the tool, and if you are recovering data that needs to be done in a forensically sound manner, and needs to be used for any kind  of legal purpose, then the WAY you use the tool is as important as the tool itself.  Without someone who is trained in forensically sound aquisition methods and chain of custody, you run risks that the data could be contested.

Many others have commented regarding your question about wiping, so let me chime in on that too..

Imagine that you have a library with the old-style card catalog that you need to flip through.. The card catalog acts as an index, allowing you to find the information by telling you where in the stacks it is located.  
The hard drive has a similar index called the File allocation table.  

If you were to remove one  of the cards from the catalog, the book would still be there.. For the sake of  this  example, this is what happens when you delete a file in windows.. the entry in the table gets wiped but the physical data is still there on the disk, the operating system just doesn't know where it is anymore.

If you were to remove the entire card catalog, then you wouldn't know where ANY books are, but the books are still there... Same when you format a hard drive... You wipe and rebuild a (now) blank file allocation table.

Wiping would then be if you actually went and removed the card catalog and then replaced all of the books with blank pages, so that you are now taking up the space that the books once occupied, making it impossible for any of the old books to  be there..  This is basically what you do when you wipe a drive, you overwrite all areas with (essentially) garbage, such that no area is left undisturbed. You are then free to put new on the drive, knowing that there is nothing of the old data left.. (so, I guess you could pull off the blank pages from the shelves, and be left w/ essentially blank shelves.. ok, so the example fumbles a bit here)

Other wiping options are of course drive shredding.. think paper-shredder, only for hard drives.  And, you could  put them in a degausser, which will subject the drive to a very strong electromagnetic field.  Dunno if this is practical tho, someone else can chime in on this.  I've never used one, and I've heard that to  use one on modern day drives will render the drive useless..

I realize this is a simplistic example, and that things are a little different depending on the file system used, but I think we could all agree that this kind of  example "works" for the purposes of this conversation.

Now, Encase is so expensive not because it has superior file recovery abilities, but rather because the methodology it  uses has been proven to be forensically sound and has been contested and proven accurate in a legal setting.  This is definitely the tool of choice for many local, state and federal agencies throughout the world.

Can you tell us a little more about  what happened?? Sounds like you had an entire server farm go south on you...

Good luck!

IF you loosed any data you can recover those with getdataback.

Best is getdataback
https://www.experts-exchange.com/questions/21818506/Look-for-free-software-to-recover-files-from-currupt-harddrive.html
https://www.experts-exchange.com/questions/21791572/Recovering-files-From-Hard-drive.html
https://www.experts-exchange.com/questions/21771157/Recover-files-from-unallocated.html
https://www.experts-exchange.com/questions/21792256/After-reinstalling-Backup-Exec-10d-can-not-view-resources-local-or-otherwise.html
Try with getdataback.

http://www.runtime.org/


BR Dushan

Dushan911,

r-k and I have both suggested GetDataBack in our respective posts above.

MalleusMaleficarum & Tolomir

Thanks for the great input. That is what I was looking for. I have one more question though and that is relating to any printing. Is is true that one can recover any data off a print job since there is a watermark on the creation of the date, author even though it does not show up on the page and visible by eyes? Or is this only true on some high level printers?

The wipe method is really great since we swap machines on a yearly basis and always have to send to those third-party for a cost to delete all info. This will save us tons of revenue when we do inhouse.

good link MalleusMaleficarum

this is what it is all about:

"According to experts, several printer companies quietly encode the serial number and the manufacturing code of their color laser printers and color copiers on every document those machines produce. Governments, including the United States, already use the hidden markings to track counterfeiters."

So it's made to identify companies not users printing counterfeits...


Please also check: http://www.hackaday.com/entry/1234000507063771/

The EFF has broken the tracking code for the Xerox DocuColor. The DocuColor prints a faint 15x8 grid of yellow dots on every page. To see these dots you need a magnifying glass. You can also use a blue light to make the dots appear black. The EFF page has a built in application for decoding the dots which hide the time, date, and serial number of the printer. The EFF also maintains a list of printers which do or don’t have this “feature”....


Tolomir

@tolomir...considering that the asker requested software to do a self-fix....all is good, but realistically, the sense of urgency and the lack of knowledge using such software to recover surely would make the situation worse. My suggestion to offer Professional service from http://www.gillware.com should at least be considered an assist as that would be the most prudent approach to solve the problem.

Not to mention showing up at the party first and being iced out of the fun ;-)

I see it rather as a good to know question, than acute demand.

Especially the bad sectors (could be also a logical problem) and formatted disks are no reason for professional services, at least a "smart" check tool like http://www.urltoy.com/asc.htm should be used for further investigations.

Tolomir

@tolomir....good to know is OK.. however, the sense of "urgency" and the mention of "crash" usually will defer to more professional solutions versus self fixes.  Knowledge is power, though used wrongly it could further damage the drive.. Consider MalleusMaleficarum's comment on ENCASE versus the level of the user's experience in this question.  You're placing "rocket science" into his/her hands....yikes!

So to PAQ this question without even the thought of having a Professional Data Recovery service mentioned, would not provide future PAQ seekers a comprehensive solution.