Runtime’s Data Recovery Blog

There is a new version of DriveImage XML available today. We now have a new option on compression and we have made the software much faster.

Lets have a look. This was the old version backing up a 10GB NTFS partition that has 5.93GB of data on it. We were backing the data up to the My Documents folder on the C drive.

As you can see, it took about 12 and a half minutes to complete the backup.

The backup size of the dat and xml file was 5.28GB

Now we backed up the same data on an external drive with the same settings as :

It only took about 20 seconds longer, but this is a small drive with not a lot of data. Had this been 100 or 200GB of data, the extra time would have been substantial.

There are some new options on the new version. You have the ability to choose if you want fast or good compression. Fast is much much faster. Good is still pretty slow but it does a good job. We recommend that you always use the fast option.

So now we took the new version and backed up the same drive with the fast option and saved the data and xml in My Documents

Only 3 minutes and 15 seconds!
The file size is only slightly larger as well, but this will be different on everyone’s computer:

Now we will take the same settings as above and save the data to a USB 2.0 External drive:

Still only 4 and a half minutes!

A few things about the slow compression:

The slow compression is still faster than the old version by two minutes in our internal test.

The size is about 500 MB smaller than the fast compression, however this will again vary with the types of files you have and how many files you have.

!!IMPORTANT!! There are a few issues with the new version. The image you make on the new version is not compatible with the old version and vice versa. If you have a BartPE with the old version, rebuild it with the new version as the image will not restore with the old software.

We do not offer any support for this software since it is free, however if you have an issue that you feel needs to be looked at, let us know.

Lets have a look at making a partial image in DiskExplorer. This is important when making an image of a drive with damage.

Lets start DiskExplorer:

Switch to hex mode my pressing F3 and go to sector you want to start the image at:

Once the sector is selected, press CTRL-SHIFT-END and it will select the sector you chose to the end of the drive:

Now, click on Edit>Copy to file:

Pick the file name and location and click save. You can see the size of the image at the top of the file location box.

If you have any questions, feel free to contact us at info@runtime.org.

This is because of our copy protection. There is an easy way to fix this though inside Vista and Server 2008.

When you start our software in Vista or Server 2008, you may get a screen that looks like this:

Click on the option to close the program. Then to fix this, you need to go to your run command and type the following:

You will be given the System Properties box. Click on Advanced -> Performance Settings:

You will then arrive at Performance Options. Click on Data Execution Prevention:

Click the add button and path to whatever version of our software you are using. We used RAID Reconstructor in this case. RAID Reconstructor should be C:\Program Files\Runtime Software\RAID Reconstructor\raid.exe. All of our software will be found in C:\Program Files\Runtime Software\.

Once RAID Reconstructor is in the list, click OK to close the Performance Options and OK again to close System Properties

Go ahead and start any of our software, and it should work with no problems now.

Q: What are the four options I am presented with when starting GetDataBack for FAT or GetDataBack for NTFS?

A: These options change the settings that are used when scanning the drive for data. Lets go into each one in detail.

Option #1 - I don’t know use default settings:

This option leaves all settings turned off. It does not recover deleted files, lost files, duplicate file names, and it does not do an excessive search.

Option #2 - Systematic file system damage, e.g. Format or FDisk:

This turns on none of the options as well.

Option #3 - Sustained file system damage, e.g. a new operating system was installed

This turns on the option to recover deleted files and allows duplicate file names to be recovered.

Options #4 - I want to recover deleted files

This also turns on the option to recover deleted files and allows duplicate file names to be recovered.

You can find all of these options by clicking on Tools>Options.

You can then click the environment tab for additional options.

Stayed tune for the next post. We will go over what each of the options really do.

Q: I have reinstalled Windows and all of my software, but I forgot to backup all my pictures and music before the re-install. Can you I recover that data now?

A: It really depends on how much data you had before you did the re-install and how much data you have written since.

When you reinstall Windows, it formats the drive. This takes all the clusters of data and marks them so they can be overwritten. The data is still on the drive after the format and can still be retrieved. The damage happens when you reinstall Windows. You need to follow all the directions as outlined at http://runtime.org/howto_datarecovery.pdf. When you get to step 3 of our software, the first thing that people assume is that since they can see the file name, the data is recoverable. This is an incorrect assumption. In the NTFS file system, the file’s name, size, date, time and the clusters used by the data are stored in the Master File Table (MFT) Entry.

When you test a file in the demo version of GetDataBack for NTFS, it reads this information and reaches out to the clusters of data that are used by that file and retrieves them. If those clusters have not been overwritten by the re-installation of Windows, then the file will be recoverable. However if the re-installation of windows has written anything to these clusters, it still grabs these clusters and you either see ascii characters in your documents, it will tell you it needs to convert the document or it will simply tell you there is no preview available.

Re-installing just Windows XP alone will easily overwrite 2GB. Windows Vista overwrites 10GB+. If you have a System Restore CD that you have used from HP, Compaq, Dell, Gateway, Sony, or whatever company your computer was built by, this does a considerable amount of damage. A Windows XP System Restore with all the demo software does about 30GB of overwriting, while a Vista System Restore does between 30 to 50GB of overwriting. This means any MFT entries that were in those locations are overwritten as well. This means you files, if those clusters were not overwritten themselves, will not have any file names, directory structures, or possibly the correct sizes and you will need to do a Lost File Recovery with our software to see if that data is retrievable.

I understand this is a lot of technical jargon to most people, but it important information to know when trying to do a recovery. If you have any questions, feel free to contact us at info@runtime.org.

I recently stumbled upon a review of our software in the December edition of “Smart Computing In Plain English” by Jennifer Farwell. Her bottom line is that our software is not so simple and even gives some ill advice on how to use our software differently than suggested.

Data is very easy to damage and in the “Caveat Emptor” section of her article she complains that you can not install the program on the problematic drive, even if it is functional. She then says if the drive is not crashed, then you can use the software to recover corrupt or deleted data by just installing it to a secondary drive or be prepared to be disappointed. Let me explain this to you right now, DO NOT DO THIS. By doing this, most people assume that they will not write any data to the drive and everything will be fine, just as Jennifer has assumed. However Windows is still working and writing data to the drive. If you do not have enough memory to store all of GetDataBack’s findings, then it will increase the swap file which could destroy GigaBytes of data easily. When you get to step 3 of the software and start to test files, they are being written to the boot drive as temp files, yet destroying more data. Installing the software to a secondary drive is not the correct way and can damage any chance of recovering your data.

Do not take the fast and easy approach or else there is a chance you will not be able to recover your data correctly. It is easy to make the drive a slave in a working system in order to recover the data correctly. We know everyone does not have a hardware background and it may seem overwhelming when you look at it. We will be releasing some video tutorials over the next few weeks on how to open an external drive and install it internally or how to remove your internal drive and install it as a slave in a working secondary machine so you can see how easy it really is. We will post them here when they are available.

We have now released Captain Nemo Pro version 4.0. This is not the Nemo you are used to. You can now mount a reconstructed RAID in seconds, saving many hours over scanning the image in GetDataBack. Captain Nemo can still mount Linux and Netware devices.

Lets take a quick walk through the process.

You will need to start with RAID Reconstructor.

Now you will need to start Captain Nemo Pro Version 4.0.

Open a few files in order to test them. The fact that you see the folders, files, file names, the right file size, etc. is a good sign but does not necessarily mean that the file content is there and those files will be usable. You will not be able to test huge files or files that need to be imported correctly into their native application, like for example, Outlook PST files.

Select files that are easy to check - for example Word documents, pictures, or mp3. Open these files by double clicking them or by using the built-in viewer(F3). Please note: To open files by double clicking them, their associated application needs to be installed on the recovery computer.

Do the files open fine. meaning you can see the file content, the text, picture?
If so repeat the same process with a couple of more files in different folders.
If all or at least the majority of files open okay, your recover is looking good.

You should purchase the software from our website and copy the data to a different drive.

Windows based Disk Editor for EXTFS2 & EXTFS3

This is the newest addition to our successful line of disk editors. Have an fresh new look at your Linux EXTFS2 or EXTFS3 file system:

• navigate through your drive by using browser-style back and forth arrows, by going directly to the partition table, superblock, inodes, groups etc.
• switch between several views, such as hex, text, directory, partition table, superblock, inode and group description view
• search your drive for text, superblocks and partition tables
• edit your drive by using the direct read/write mode (not recommended) or the virtual write mode
• view and recover files
• create a virtual volume when your superblock is lost or corrupted
• conduct your own data recovery by taking advantage of all these features.

Price: $69

System Requirements:
Pentium Processor
8 MB RAM
Windows 95, 98, ME, NT, 2000, XP, 2003 or Vista

Reconstructing a RAID is not a trivial task. There are many things that can cause the software to not produce the correct settings to ensure a properly constructed array. There are a few steps you will need to follow.

1. You will need to attach all the drives to a non-RAID controller so that the operating system can see all the drives as single drives inside of Windows.

2. You will need to start the software and choose your type of array at the top of the screen with the number of drives included in the array. If you have a RAID-0 with more than 2 drives or a RAID-5 with more than 11 drives, you will need to use our RaidProbe service. You can find more information about this service at http://www.runtime.org/raid.htm#raidprobe. If you have a 2 drive RAID-0, be sure to watch our tutorial about this type of recovery at http://www.youtube.com/watch?v=DWNq5rAhZ9Y.

3. You will then need to enter all these drives into RAID Reconstructor by right clicking on the white space next to the drive number and selecting the drives that belong in the array. If your RAID is a RAID-5 with one drive missing, leave one field empty. Once this is done, open the drives by clicking the open button at the bottom of the drive list on the right hand side.

4. You will now need to analyze the drives in the step 2 box at the top right hand side of the software. When this finishes, you must look at the bottom of the analysis screen to see if you received a RECOMENDED ENTRY. If you received a RECOMMENDED ENTRY, then click finish and go to step 5 of this article. If it says RESULT NOT SIGNIFICANT, then the software did not properly put the array together because it does not have all the information needed. If you are unable to produce a RECOMMENDED ENTRY, do not make an image of this RAID because it will just produce non-working files. You should then consider letting us do a RaidProbe which will allow us to put the array together by hand. Once it is completed, we will send you all the parameters and detailed instructions on how to rebuild the array for you. You can find more information about the RaidProbe at http://www.runtime.org/raid.htm#raidprobe.

5. Once you have your settings, in step 3 of the software, you have the choice to make a virtual image, an image or write the data back to a drive directly. You would usually choose the virtual image. (If you are using a file system other than FAT or NTFS, there is no sense in making an image as we do not make data recovery software for file systems other than FAT and NTFS.) If you choose to write the data directly to a drive, this will only work if the reason for the RAID failure was a controller failure. Otherwise there is something wrong with the file system or partition table that has caused the array failure in the first place and you will need to run GetDataBack to recover the data at that point.

6. Once you created the virtual image or the image, there are two options to recover your data.

Option 1: Mount the image with Captain Nemo
You should use Captain Nemo if there is little or no file system damage. The advantage of Captain Nemo over GetDataBack is that Captain Nemo gives you immediate access to your files while GetDataBack will need to scan your image first. Download Captain Nemo (http://www.runtime.org/nemopro.zip) and mount the image you just created. You can now copy the files to another location.

Option 2: Scan the image with GetDataBack
If there is significant file system damage or Captain Nemo does not bring the results you expect, you will need to download GetDataBack for NTFS (http://www.runtime.org/gdbnt.zip) to process the image you just created. We have also created a tutorial on how to do this at http://www.youtube.com/watch?v=XQBprGyy_Ko.

If you run into problems with any of these steps, let us know right away so we can help you.

You have recovered your data successfully, but what now?

If the drive was a data drive, you can just format the drive and continue using it if the drive is not physically damaged.

If the drive was your boot drive with your operating system on it, then you will need to reload the operating system. Once the OS has been reinstalled, you can copy the data back to the drive, however you will need to reinstall your programs and you should only copy the data for the programs, not the programs themselves.

If you are not sure of how to format a drive, please read the following (click the pictures for a larger version).

The first thing you will want to do is open Windows Disk Management. To do this, Right Click on My Computer and select Manage. Then find your drive that you need to format.

You will need to right click on the drive and select new partition, or if there is a partition already there, delete it first, then create the new partition, click Next.

This will take you though the New Partition Wizard. When this pops up, click Next.

It will ask you if you want a primary or extended partition. If this is a single drive, you will want a primary, if it is a secondary partition on a single drive, then you will want to make it extended. Since this is a single drive, we will make it a primary partition, click Next.

It will now ask you the size of the partition. We will choose the full size, however if you want more than one partition, you will select less, click Next.

You will now decide what drive letter to use. You can just leave it at the default or choose a custom one, click Next.

You will be given some options here about the file system to use, The allocation unit size and the drive name. The only thing you should change here is the Drive Name. Give it a drive name so you will know what drive it is, like external, or the size of the drive. You should also select to just do a quick format unless you have a reason for doing otherwise, click Next.

The wizard will now show you all the options chosen and ask you to verify them. If everything looks ok, click Next.

The drive will format and show you the drive letter, the name of the drive, the size of the drive and that it is a healthy partition. You can now close the Disk Management window.

If you go to Windows Explorer, you will now see the drive letter and be able to open the drive. If this was your data drive, you can now copy the data that you recovered back into this drive.

There you have it, your drive is now formatted and ready to use again. If you have any questions regarding what you have read, you can contact us by phone at 775-884-3922 or email us at support@runtime.org.