I know this forum is VERY knowledgeable, but, for others who’d like some info about recovery, I’ve included some principles and free means (and low cost approaches) for DIY Recovery I which someone had explained to me many years ago:
$MFT - NTFS uses a Master File Table (table of contents).
$MFTmirr - NTFS BACKUP of the primary $MFT backup
(something I wish other FS used) …
Ext2-4 - Linux: uses Inode tables
HFS+ - MacOS: uses nodes also and a “catalog” …
Windows Boot Flag: (found in HEX editors: 55 AA
As Wendell mentioned, SSD drives are exceptions bc of:
(Garbage collection, encrypted Firmware, TRIM), however:
Expensive tools (PC3000 SSD) put SSDs in ‘Technology Mode’
RECOVERING SPINNING DRIVES WHICH:
- Spontaneously Lose Partition Info
- Accidentally Formatted
- Damaged Partition info
DON’T BENEFIT FROM SOFTWARE nor HARDWARE IMAGERS:
Imaging should ALWAYS be done by SATA, PCIe (NVMe) or Thunderbolt
LIST OF (Software + Hardware) IMAGING TOOLS
SOFTWARE Imager (list of the better ones)
- DDRescue CLI (Free)
- DDRescue GUI ($5 to DL, but still free on Hirens, etc)
- HDD Super Rescue (Free)
- HDD Super Rescue Pro (60-days) $20
- HDD Super Rescue Pro (LifeTime) $200
HARDWARE Imager (some do Logical, but it’s often extra)
- DeepSpar DDI 4* ($2,500+)
- Atola DiskSense * ($6,500+)
- Ace Labs PC3000* Express + Nand, RAID + DE: $16,000
(I own the above so I know the pricing better)
- SalvationData* (not sure)
- DFL SATA Imager* (not sure)
(most of the above have add-ons for USB3.0, NVMe, forensics, etc.)
BOTH HARDWARE AND SW IMAGERS ENABLE:
- customization of sector timeouts
- multi-pass (requires a log file, etc)
- TONS more features
ALL SOFTWARE / HARDWARE “IMAGERS” ONLY WILL STILL REQUIRE
LOGICAL PROCESSING AFTERWARDS: R-Studio / UFS Explorer, etc.
Features EXCLUSIVE to HARDWARE Imagers:
- Each [Imaging Port] uses a ‘micro’ OS to ISOLATE Recovery Ports.
- INDEMNIFIES the UI from patient device instability / crash, etc.
- PC3000 Express (4x simultaneous DR ports) and 5 OS, total.
- Each DR port has Hardware WriteBlocker (enable / disable)
- Control DRIVE Timeouts (not possible via consumer OS).
Pass 1
- Test R/W Speeds at various sector regions PER HEAD.
- DISABLE heads (selectively) to read weak heads last.
- Can perform passes to read JUST the Catalog (mac), $MFT, etc.
- If a “Table of Contents” (catalog / $mft) exists, recover selectively.
- Set first-pass “read timeout” = 10ms
- Mix multiple rules: If 10x sequential sectors exceed 10ms, skip 5,000
Going in depth here could turn in to 10 pages.
This info is onerous / extensive & but a sample.
BOTH Hardware and Software Imagers:
- Control sector read time
- Multi-Pass Recovery (sector to sector)
- Many other features I wouldn’t know (I own multiple HW imagers)
IMAGING SOFTWARE DOES MANY THINGS HARDWARE IMAGERS DO:
- DDRescue CLI (Free)
- DDRescue GUI ($5? but is still free on Hirens, etc)
DDRescue’s limit: OS’ Timeouts due to native SATA drivers
HDD Super Rescue may be superior for this reason alone:
- HDD Super Rescue (Free)
- HDD Super Rescue Pro (60-days) $20
- HDD Super Rescue Pro (LifeTime) $200
The above “SOFTWARE IMAGERS” (& many Hardware imagers)…
Still REQUIRE LOGICAL RECOVERY AFTER IMAGING IN MOST CASES
REQUIRES ONLY LOGICAL RECOVERY:
- Accidentally Formatted SPINNING drives.
- Damaged partition table (good heads).
In no way benefit from ‘Imagers’ (hardware or software).
SOFTWARE IMAGER WITH INTEGRATED LOGICAL RECOVERY
DM DE or DM Disk Editor
- Multi-pass imaging
- Fix DELETED PARTITION INFO!!! (perhaps THE best at this)
- Logical Recovery (“carving” or searching for Headers + Footers)
- RAID Recovery
Applications which EXCLUSIVELY perform LOGICAL Recovery:
- R-Studio by RTT - (at R-TT.com = outstanding app)
- UFS Explorer - (SysDev labs = outstanding app)
- Recovery Explorer - (SysDev labs = outstanding app)
All of which are outstanding Logical (carving) tools with RAID recovery
None of which can make multiple passes …
The first group of pictures are from DeepSpar DDI 4
What stanning looks like as it’s running:
Options available in DeepSpar
DeepSpar options per Pass:
Standard Settings (not the rules based settings):
The ANATOMY of a SATA Hard Drive Sector:
Some Drives will read better in older modes, etc.
Automating power-handling during unattended recovery period …
Loss of Readiness HD options …
There’s a ton of info on this page, some of which just isn’t obvious, such as, the ability to test the heads, then, in these settings, deselect heads (requires another section of the application called the “Utility” already be running for that drive, and the drive is in the DataBase).
This isn’t even 2% of the options available in PC3000
