Archive for the ‘Data Recovery’ Category

What Product Do I Need?

Tuesday, December 11th, 2012

You have so many products, what product do I need to recover my data?

Let us start with the basic questions, is the drive a single drive or do you have an array of drives?

Let us start with single drives. If the drive is a single drive, was the drive originally an internal or external drive?

If the drive is internal, then you should use GetDataBack for NTFS. Download the demo version and let it scan the drive and see if your data is recoverable.

If the drive is external, then it is formatted out of the box as FAT32 most of the time. However if you have ever formatted the drive yourself, then the drive would be NTFS as Windows XP and above only allows you to format drives over 32GB as NTFS. So if the drive has not been formatted, then use GetDataBack for FAT, otherwise use GetDataBack for NTFS. Either way, if it does not find your files, the software will recommend that you use the other version. So download the demo version and let it scan the drive and see if your data is recoverable.

Lets talk about arrays now. There are quite a few different options
for arrays. Is the array from a PC or a NAS?

If the array is from a NAS, you will need to follow the instructions located here in order to run any of our RAID software. Once the drives are all attached to the non-raid controller, you can see if the demo version of NAS Data Recovery will find the parameters. Start the software and select the drives that are part of the array and click next. If it finds the parameters, click next in the software to see if it can mount the volume. Did the volume mount successfully?

If the volume does mount, you have the ability to test certain file types by right clicking on them and selecting view. This works with jpg files, so test a few files and see if the data can be recovered successfully, then you will need to purchase the license key in order to save the data.

NAS Data Recovery software reads the file system and gives you access to it, so if your data does not appear when you click next, it is just because there is some type of file system damage. We do not have a file recovery tool for any of the NAS file systems, so if your data does not appear, you should find another solution for recovering your data.

If the array is from a PC, you will need to follow the instructions located here in order to run any of our RAID software. You will have multiple options now on how you can recover your data and view it. So you will need to choose the correct software. We will go over all the options with the easiest to the hardest.

The easiest option is to use the demo version of RAID Recovery for Windows software. Start the software and select the drives that are part of the array and click next. If it finds the parameters, click next in the software to see if it can mount the volume. Did the volume mount successfully?

If the volume does mount, you have the ability to test certain file types by right clicking on them and selecting view. This works with jpg files, so test a few files and see if the data can be recovered successfully, then you will need to purchase the license key in order to save the data.

RAID Recovery for Windows software reads the file system to give you access to the data, so if your data does not appear when you click next, it is just because there is some type of file system damage. At this point you will need to use RAID Reconstructor followed by GetDataBack for NTFS for the recovery. That is covered next.

If RAID Recovery for Windows does not mount the volume successfully, then you should move to RAID Reconstructor. Add all the drives that belong to the array and click Open drives, then click Analyze. Allow the analysis to complete and the software will say give you one of two responses. It will say either “Recommendation” or it will say “This Result is not Significant”. Which response did you receive?

If you received “Recommendation”, then the parameters of the array were found successfully. You will need to purchase the software in order to save any of the outputs listed in step 3. Once you have purchased the license, you can save to three different options, a virtual image, a full image, or write the data to a new physical disk. If you want the quickest option of these three, you will choose the option for the virtual image. It is a small 1kb XML document that tells the rest of our software how to pull the data from the drives on the fly. The second option is to create a full image. It will make an image file that is the size of the array. So if you have a 3TB array, you will need 3TB of data to save the image to. The third option is to write the data to a physical disk. This will require you to have a drive or array that is the same size as the original or larger. It will erase all data on this drive. Now if you ran Raid Recovery for Windows and it did not produce any files, this will only result in a new volume with the same issues your current array has, so it is not recommended in this case.

If you receive “This Result is not Significant”, there are a number of reasons this could happen. The first reason is the drive uses a proprietary rotation. The second reason if there is major file system damage that prevents the software from determining the parameters correctly. The third reason is there are drives that are missing or do not belong to the array. This could happen if you think you have a 4 drive array, but in actuality, you have a 3 drive array with a hot spare. If you include all 4 drives, then the analysis will fail. Luckily we have a RaidProbe service that can resolve most of these issues and we can give you the parameters of the array so you can continue your recovery. You can find more information about it at http://www.runtime.org/raid.htm#raidprobe

Once you have created your output in RAID Reconstructor, you can install the demo version of GetDataBack for NTFS. Then choose your scenario in the first screen, but do not use the default option. Choose the option for Systematic or Sustained file system damage.

If you created the virtual image, in step 1, choose the selection Virtual Images (Load more…). Then click next to scan the virtual image. Once the scan finishes, choose the best file system in step 2 and click next to see your data. You will have the ability to double click on certain files to ensure the data is recoverable. If you wish to recover your data, you will need to purchase a license.

If you created a full image, in step 1, choose the select Image files (Load more…). Then click next to scan the full image file. Once the scan finishes, choose the best file system in step 2 and
click next to see your data. You will have the ability to double click on certain files to ensure the data is recoverable. If you wish to recover your data, you will need to purchase a license.

There are a few other scenarios that have not been covered. The first is an array that just has file system damage but is still structurally intact, meaning the drives are still attached to the controller and in working order, but for example the volume was formatted or damaged.

In a Windows array, you can just use GetDataBack for NTFS as the array will show as one physical drive that you can select in step 1 of GetDataBack for NTFS.

In a NAS array under these same circumstances, we do not have a recovery option. You will need to find a different way to recover the data.

The second scenario is for an array that the controller has just died. The drives are intact and there is no file system damage, just the controller has died.

If the array is a windows array and if you just want the data, you can run Raid Recovery for Windows. You should be able to see your data and recover it all. However if the array was bootable for example, it will not be after the data is copied, as the software does not copy the partition table or boot sector.

If the array is a windows array and it matches the scenario of the controller being dead, and you want to restore the array to a working volume, then you should use RAID Reconstructor and in step 3, you will want to choose the option for physical disk and you will need a physical volume that is exactly the same size (Be careful here, A 2TB Western Digital is not the exact same size as a 2TB Seagate or any other brand) or larger. Write the array volume back to the drive, and then you will need to restart the computer in order to see the data! If you do not restart, the volume will show up as blank. A restart is required for the OS to see the new data on the drive. You should have full access to the data after the restart and if the array was bootable, it should be so now as well. If for some reason, after the restart, the drive is not showing correctly, this is due to some type of file system damage and you should run GetDataBack for NTFS on the volume to recover the data.

If you encounter a scenario that is not listed, contact us and we can tell you the best way to recover the data. Email us using our support@runtime.org email address or call us; 808-329-2202.

GetDataBack Version 4.02 Released

Monday, December 6th, 2010

GetDataBack for FAT and NTFS were updated to version 4.02 today. If you have directory with bad file names, there is now an “Ignore All” on “Could Not Create Directory” prompts.

A warning about formatting your drive in Vista and Windows 7

Wednesday, July 14th, 2010

We just want to warn people about formatting their drives in Windows Vista and Windows 7. If you uncheck the option for quick format, the operating system does a full destructive format, making data recovery impossible once it is finished.

So unless you are giving your drive away, or selling it, do not do a full format if there is a chance you will need the data on the drive, as the data will no longer be there, or recoverable.

Be sure you have the option for quick format selected.

I upgraded to Windows 7 and now I can not see any of my drives in your software!

Wednesday, October 28th, 2009

Q: After upgrading to Windows 7, I can not longer see my drives in any of your software.

A: This is due to the UAC that Windows Vista and Windows 7 have in place. In order to bypass this, you can simply right click on the icon of the program you are running and selecting “Run as administrator”. You will then have access to the physical drives at this point.

You must do this even if you are the administrator of the computer. If you have any questions regarding this, feel free to contact us.

Captain Nemo vs GetDataBack for NTFS

Tuesday, March 24th, 2009

When recovering the data after Raid Reconstructor has finished and you have a virtual image, we give people two options; You can use GetDataBack for NTFS or you can use Captain Nemo.

If your controller card went out or you had a drive physically fail in a raid 5, then you can generally use Captain Nemo. Captain Nemo is a file system mounter. It’s only job is to mount the file system. If your file system is in good shape, then you will see your data and directory structures almost immediately and copy them at that point. If the file system is damaged, then Nemo will give you an error about the partition or file system and will not present you with any of your data.

This is where GetDataBack comes in. GetDataBack is a data recovery tool.

  • If you need to recover deleted files, then you must use GetDataBack.
  • If your file system is damaged, then you must use GetDataBack.
  • If Captain Nemo give you any problems at all, then use GetDataBack to recover your data.
  • If you see your data in Captain Nemo but can not see the files you are looking for, use GetDataBack.

Here is a breakdown of the differences between GetDataBack and Captain Nemo. You can easily see where and when you would want to use GetDataBack vs Captain Nemo.

Tasks
GetDataBack
Captain Nemo
Shows deleted files
X
Shows Lost Files
X
Recovers from damaged file systems
X
Immediate Recovery
X

Why does your software crash under Vista or Server 2008?

Wednesday, July 9th, 2008

This is because of our copy protection. There is an easy way to fix this though inside Vista and Server 2008.

When you start our software in Vista or Server 2008, you may get a screen that looks like this:

Click on the option to close the program. Then to fix this, you need to go to your run command and type the following:

You will be given the System Properties box. Click on Advanced -> Performance Settings:

You will then arrive at Performance Options. Click on Data Execution Prevention:

Click the add button and path to whatever version of our software you are using. We used RAID Reconstructor in this case. RAID Reconstructor should be C:\Program Files\Runtime Software\RAID Reconstructor\raid.exe. All of our software will be found in C:\Program Files\Runtime Software\.

Once RAID Reconstructor is in the list, click OK to close the Performance Options and OK again to close System Properties

Go ahead and start any of our software, and it should work with no problems now.

Four scenario options in step 1

Wednesday, April 16th, 2008

Q: What are the four options I am presented with when starting GetDataBack for FAT or GetDataBack for NTFS?

A: These options change the settings that are used when scanning the drive for data. Lets go into each one in detail.

Option #1 – I don’t know use default settings:

This option leaves all settings turned off. It does not recover deleted files, lost files, duplicate file names, and it does not do an excessive search.

Option #2 – Systematic file system damage, e.g. Format or FDisk:

This turns on none of the options as well.

Option #3 – Sustained file system damage, e.g. a new operating system was installed

This turns on the option to recover deleted files and allows duplicate file names to be recovered.

Options #4 – I want to recover deleted files

This also turns on the option to recover deleted files and allows duplicate file names to be recovered.

You can find all of these options by clicking on Tools>Options.

You can then click the environment tab for additional options.

Stayed tune for the next post. We will go over what each of the options really do.

I reinstalled Windows, can I recover my data?

Friday, April 4th, 2008

Q: I have reinstalled Windows and all of my software, but I forgot to backup all my pictures and music before the re-install. Can you I recover that data now?

A: It really depends on how much data you had before you did the re-install and how much data you have written since.

When you reinstall Windows, it formats the drive. This takes all the clusters of data and marks them so they can be overwritten. The data is still on the drive after the format and can still be retrieved. The damage happens when you reinstall Windows. You need to follow all the directions as outlined at http://runtime.org/howto_datarecovery.pdf. When you get to step 3 of our software, the first thing that people assume is that since they can see the file name, the data is recoverable. This is an incorrect assumption. In the NTFS file system, the file’s name, size, date, time and the clusters used by the data are stored in the Master File Table (MFT) Entry.

When you test a file in the demo version of GetDataBack for NTFS, it reads this information and reaches out to the clusters of data that are used by that file and retrieves them. If those clusters have not been overwritten by the re-installation of Windows, then the file will be recoverable. However if the re-installation of windows has written anything to these clusters, it still grabs these clusters and you either see ascii characters in your documents, it will tell you it needs to convert the document or it will simply tell you there is no preview available.

Re-installing just Windows XP alone will easily overwrite 2GB. Windows Vista overwrites 10GB+. If you have a System Restore CD that you have used from HP, Compaq, Dell, Gateway, Sony, or whatever company your computer was built by, this does a considerable amount of damage. A Windows XP System Restore with all the demo software does about 30GB of overwriting, while a Vista System Restore does between 30 to 50GB of overwriting. This means any MFT entries that were in those locations are overwritten as well. This means you files, if those clusters were not overwritten themselves, will not have any file names, directory structures, or possibly the correct sizes and you will need to do a Lost File Recovery with our software to see if that data is retrievable.

I understand this is a lot of technical jargon to most people, but it important information to know when trying to do a recovery. If you have any questions, feel free to contact us at info@runtime.org.

Is Doing Data Recovery Easy?

Friday, December 14th, 2007

I recently stumbled upon a review of our software in the December edition of “Smart Computing In Plain English” by Jennifer Farwell. Her bottom line is that our software is not so simple and even gives some ill advice on how to use our software differently than suggested.

Data is very easy to damage and in the “Caveat Emptor” section of her article she complains that you can not install the program on the problematic drive, even if it is functional. She then says if the drive is not crashed, then you can use the software to recover corrupt or deleted data by just installing it to a secondary drive or be prepared to be disappointed. Let me explain this to you right now, DO NOT DO THIS. By doing this, most people assume that they will not write any data to the drive and everything will be fine, just as Jennifer has assumed. However Windows is still working and writing data to the drive. If you do not have enough memory to store all of GetDataBack’s findings, then it will increase the swap file which could destroy GigaBytes of data easily. When you get to step 3 of the software and start to test files, they are being written to the boot drive as temp files, yet destroying more data. Installing the software to a secondary drive is not the correct way and can damage any chance of recovering your data.

Do not take the fast and easy approach or else there is a chance you will not be able to recover your data correctly. It is easy to make the drive a slave in a working system in order to recover the data correctly. We know everyone does not have a hardware background and it may seem overwhelming when you look at it. We will be releasing some video tutorials over the next few weeks on how to open an external drive and install it internally or how to remove your internal drive and install it as a slave in a working secondary machine so you can see how easy it really is. We will post them here when they are available.

The New Captain Nemo Pro…

Tuesday, November 20th, 2007

We have now released Captain Nemo Pro version 4.0. This is not the Nemo you are used to. You can now mount a reconstructed RAID in seconds, saving many hours over scanning the image in GetDataBack. Captain Nemo can still mount Linux and Netware devices.

Lets take a quick walk through the process.

You will need to start with RAID Reconstructor.

Now you will need to start Captain Nemo Pro Version 4.0.

Open a few files in order to test them. The fact that you see the folders, files, file names, the right file size, etc. is a good sign but does not necessarily mean that the file content is there and those files will be usable. You will not be able to test huge files or files that need to be imported correctly into their native application, like for example, Outlook PST files.

Select files that are easy to check – for example Word documents, pictures, or mp3. Open these files by double clicking them or by using the built-in viewer(F3). Please note: To open files by double clicking them, their associated application needs to be installed on the recovery computer.

Do the files open fine. meaning you can see the file content, the text, picture?
If so repeat the same process with a couple of more files in different folders.
If all or at least the majority of files open okay, your recover is looking good.

You should purchase the software from our website and copy the data to a different drive.