data-recovery-hard-drives

Hard Drive Data Recovery — Software & Techniques

Status: Complete Tags: DataRecovery HDD SSD Forensics SysAdmin Created: 2026-10-17 Related: ubuntu-linux.md, docker-containers.md Tool kit: /media/data/recovery-tools/ (see inventory at bottom)

The 4 golden rules

1. Stop using the drive immediately. Every write reduces recoverability. Never run chkdsk /f, fsck -y, defrag, Disk Utility First Aid, or any “repair” tool before recovery — they write to the disk and destroy recoverable metadata.
2. Image first, recover from the image. Clone the drive sector-by-sector with ddrescue, then run every recovery tool against the clone/image. Never scan a failing drive directly — recovery scans stress it hard.
3. Clicking / beeping / grinding / not detected → power off, run no software. That is mechanical or firmware failure; software scans destroy data. Go to a lab.
4. Never recover onto the same physical drive. Destination must be a different, healthy disk at least as large.

Triage: classify the failure first

Symptom	Class	Action
Deleted/formatted files, drive healthy	Logical	Software recovery (below)
Corrupt partition table, raw partition, boot failure	Logical	TestDisk
SMART warnings, read errors, slow reads, OS remounts read-only	Degrading	ddrescue image NOW, then software
Clicking, beeping, grinding	Mechanical (heads)	Power off → lab (head swap)
Not spinning, not detected, burns/spins down	PCB / firmware	Lab (board repair, PC-3000)
Detected with wrong capacity, busy state	Firmware	Lab (PC-3000 translator rebuild)

SMART check (non-invasive, do this first)

sudo smartctl -H /dev/sdX                      # overall pass/fail
sudo smartctl -a -d sat /dev/sdX               # full attributes (-d sat for USB-SATA bridges)
sudo smartctl -t long /dev/sdX ; sudo smartctl -l selftest /dev/sdX

Windows: CrystalDiskInfo (read-only, portable).

Critical attributes — any RAW value > 0 means image immediately:

• 5 Reallocated_Sector_Ct — spare sectors consumed
• 187 Reported_Uncorrect
• 197 Current_Pending_Sector — unstable sectors waiting
• 198 Offline_Uncorrectable
• 199 UDA_CRC_Error_Count — check the cable first, not the disk
• 22 Current_Helium Level — normalized < 25 = imminent failure (helium drives)

A SMART “PASSED” is not a safety guarantee — many drives report clean attributes until final collapse.

Imaging a failing drive (GNU ddrescue)

The core technique. ddrescue reads good sectors fast, skips bad ones, retries them in a smart order, and keeps a mapfile so runs are resumable.

# Pass 1 — fast sequential copy, skip hard sectors (minimizes stress)
sudo ddrescue -f -n /dev/sdX /mnt/other/image.img /mnt/other/map.log
 
# Pass 2 — retry bad sectors, direct I/O, up to 3 retries, reverse direction too
sudo ddrescue -f -d -r3 -R /dev/sdX /mnt/other/image.img /mnt/other/map.log
 
# Trim: fill remaining gaps with truncated retries (last resort, more stress)
sudo ddrescue -f -d -r3 -T100 /dev/sdX /mnt/other/image.img /mnt/other/map.log

• -n no-scrape (pass 1) · -d direct I/O (bypasses kernel read-ahead) · -R reverse · -r3 3 retries · -f force overwrite of output
• Watch the mapfile stats: rescued / non-tried / non-scraped / bad-sector.
• After imaging: unplug the patient drive and set it aside. Work only on the image.
• Mount an image loop-device read-only: sudo mount -o loop,ro,noload image.img /mnt/rec (noload = skip journal replay on ext4).
• Alternatives: dd_rescue (AT), R-Studio built-in imager, hardware imagers with write blockers (Tableau TD3, DeepSpar) for forensic work.
• Validate: keep the mapfile; make a copy of the finished image before any experiment.

Logical recovery tools (drive healthy, data lost)

Tool	Cost	Platform	Best for
TestDisk	Free (GPL)	Win/Linux/mac	Lost partitions, boot sectors, partition table rebuild, MFT repair
PhotoRec	Free (GPL)	Win/Linux/mac	Signature carving — recovers file content ignoring filesystem; ~480 file types; formatted/corrupted drives
DMDE	Free tier (4 files/dir), paid	Win/Linux	Deep NTFS/FAT/ext recovery, finds what others miss; console version runs on a server
R-Studio	~$80 (demo scans/previews free)	Win/Linux/mac	Professional: FS-aware recovery, RAID rebuild, imaging, previews
UFS Explorer	Paid (trial free)	Win/Linux/mac	RAID, VMFS, Btrfs, ZFS, complex/virtual setups
Recuva	Free	Windows	Casual undelete, quick photo/document recovery
extundelete	Free	Linux	ext3/ext4 undelete via journal — recovers names + content if blocks not reused
ntfsundelete (ntfs-3g)	Free	Linux	NTFS undelete by inode/pattern
btrfs restore	Free	Linux	Walks old metadata roots on damaged Btrfs
xfs_undelete	Free	Linux	XFS (inodes zeroed on delete → carving usually wins)
The Sleuth Kit / Autopsy	Free	Linux/Win	Forensic: fls lists deleted entries by name, icat extracts by inode; ext/NTFS/FAT/exFAT/HFS+
Foremost / Scalpel	Free	Linux	Scriptable carving from config-defined header/footer pairs; Scalpel = fast fork

Filesystem-aware undelete (recovers names + structure; works only if metadata survives)

# ext3/ext4 (unmount source first, output to ANOTHER disk)
sudo extundelete /dev/sdX1 --restore-all
sudo ext4magic /dev/sdX1 -r -a $(date -d "-3 days" +%s) -d /mnt/other/rec   # time-window
sudo debugfs -R "lsdel" /dev/sdX1                                            # list deleted inodes
 
# NTFS
sudo ntfsundelete /dev/sdX1                          # list recoverable
sudo ntfsundelete /dev/sdX1 -u -m '*.docx' -d /mnt/other/rec
 
# Btrfs (unmounted)
sudo btrfs restore -v /dev/sdX1 /mnt/other/rec
 
# APFS (macOS): copy-on-write + TRIM kill undelete → snapshots are the path
sudo apt install fuse-apfs   # apfs-fuse: mount APFS snapshots read-only on Linux

NTFS deep dive: deletion flips the $MFT in-use bit; content extents survive. Tools: MFTECmd, analyzeMFT, X-Ways. The $LogFile and $UsnJrnl:$J journals hold older MFT states — entries the live MFT reused can come back from them.

File carving (metadata gone: formatted, mkfs’d, corrupted partition)

sudo photorec /dev/sdX1                      # interactive, all types
sudo photorec /log /dev/sdX1                 # log = resume after interruption
sudo foremost -t jpg,pdf,doc -i image.img -o /mnt/other/rec
sudo scalpel image.img -o /mnt/other/rec     # fast, config in /etc/scalpel/scalpel.conf

Carving recovers content but loses filenames; fragmented files (DOCX/ZIP, large videos) often fail. PhotoRec logs let you resume.

SSD specifics (TRIM changes everything)

• TRIM unmaps blocks on delete; RZAT makes the controller return zeros; garbage collection erases cells. Deleted files on a TRIM-enabled internal SSD are usually unrecoverable.
• Check: fsutil behavior query DisableDeleteNotify (0 = TRIM on) · macOS: trimforce · Linux: fstrim.timer status.
• Recovery windows: act immediately (before GC), power-loss/crash cases (TRIM queue never ran), external SSDs behind USB bridges that don’t pass TRIM, TRIM-disabled systems.
• Procedure: power off, mount read-only (hardware write-blocker ideal), image immediately. Lab options: cold power-cycle + image before GC, custom firmware to pause GC, PC-3000 SSD.
• Formatting a TRIM-enabled SSD = effectively irreversible.
• APFS (macOS SSDs) is the worst case: aggressive TRIM + copy-on-write. Snapshots + Time Machine are the real recovery path.

Physical failure — lab territory (not DIY)

Labs use PC-3000 / DeepSpar / Atola to bypass firmware faults and image with head maps that skip damaged zones. Typical 2026 pricing (Rossmann et al.):

Failure	Procedure	Cost
PCB dead (no spin)	Board repair / ROM migration to donor PCB	$100–600
Firmware (busy, wrong capacity)	Translator rebuild on PC-3000	$600–900
Head failure (clicking)	Head swap, exact-match donor, ULPA clean bench	$900–1500 + donor
Stiction (heads bonded to platters)	Free heads on bench	~$1000+
Platter transplant	Platters moved to donor chassis	$1500–2500
Helium-sealed (16TB+)	Open + helium refill	$3000–4500

Reputable labs: “no data, no fee”. Donor drives: $50–400.

Myths to skip: freezing a dead drive (one-time stiction parlor trick; condensation destroys platters), running recovery software on a clicking drive (guaranteed platter damage), repeated power-on attempts on a seized motor.

Standard workflow (memorize this)

1. Triage: sounds? detected? SMART attributes 5/197/198.
2. Important data + any hardware sign → lab. Logical + healthy → continue.
3. Boot SystemRescue live USB (patient drive NOT the system drive).
4. ddrescue two-pass image onto a healthy target ≥ source size.
5. Unplug patient. Mount image read-only.
6. Try filesystem-aware undelete first (names intact) → then TestDisk (partitions) → then carving (PhotoRec/Scalpel) as last resort.
7. Verify recovered files (open them; check magic bytes with fidentify).
8. Copy results off, reformat/rebuild the target, keep the image until you’re sure.

Local tool kit — /media/data/recovery-tools/

Path	What	Notes
linux/testdisk-7.2/	testdisk_static, photorec_static, qphotorec_static, fidentify_static	Static binaries, run with sudo, no install
linux/dmde/dmde	DMDE 4.4.4 console (Linux x64)	sudo ./dmde — interactive console recovery
linux/*.tar.bz2, linux/*.zip	Original archives
debs/*.deb	gddrescue, testdisk, foremost, scalpel, sleuthkit, extundelete, smartmontools	Offline install: sudo dpkg -i debs/*.deb && sudo apt -f install (see install.sh)
windows/testdisk-7.2.win64.zip	TestDisk + PhotoRec + QPhotoRec GUI	Portable, run as Administrator
windows/dmde-4.4.4-win64-gui.zip	DMDE GUI	Portable
windows/ufs-explorer-standard-win.zip	UFS Explorer Standard trial	Trial: recovers ≤ 16 KB/file until licensed
windows/CrystalDiskInfo.zip	SMART viewer	Portable, read-only
windows/recuva-setup.exe	Recuva (CCleaner-bundled installer — choose custom install, decline CCleaner)
iso/systemrescue-13.02-amd64.iso	SystemRescue live USB (has all of the above)	sudo dnf-based; dd to USB: sudo dd if=... of=/dev/sdY bs=4M status=progress

R-Studio demo (Windows/Linux): download page https://www.r-tools.com/Download/R-Studio/Download.html — site is geo-blocked from this host; fetch from a Western connection. Demo scans/previews free, recovers ≤ 16 KB files; license ~$80.

Prevention (the cheap win)

• 3-2-1 backup; snapshots (Btrfs/ZFS/APFS) make undelete trivial.
• TRIM off only when the use case demands recoverability (forensics rigs).
• Watch SMART 5/197/198 monthly (smartd daemon, sudo smartd -d daemon).
• UPS: power-loss during writes is the top cause of “mystery” filesystem corruption.
• Never mkfs/partition a drive you haven’t imaged when data matters.