Users who have at least once used a file recovery tool know how helpful this kind of software can be if you need it. Those who have never done it can’t imagine how grave can be the data loss problem. Even today, when every computer user knows how the operating system works (at least on the primitive level), the cases when someone can lose the data are quite widespread. And the problem hides not only in the low level of computer knowledge. To delete the files from your computer, you need to approve the removal twice because of Recycle Bin functionality, so even low-skilled users may stop the unwanted process. However, malware-based hazards that can lead to data loss became more active. The demand for file recovery tools remains quite high. So, let’s check which file recovery programs are best.
How files can be lost?
First, let’s name the most popular reasons for losing the files. Of course, the most massive file losses happen after the disk drive breakdown, but nothing can help you in such cases. When we are talking about ransomware, the scale of the problem remains very high. Still, file recovery appears possible, especially if you have previously removed the virus to the recovery operations.
But some features of the ransomware mechanism together with the key principles of file system interactions with physical disks give the chance to revive the encrypted files. Ransomware encryption procedure feature is next: it encrypts every file byte-by-byte, after that saves a file copy, removing (and not overwriting!) the original document1. For this reason, the info about placing the file on the physical disk is shed. However, the initial document is not erased from the physical disk. The sector where this file was kept can still hold this file, but it is not detailed by the file system and can be overwritten by the information that has been placed on this drive after the deletion. Thus, it is possible to revive your documents by utilizing special apps.
Several words about the file systems
Depending on the file system type, the recovery process may take from 10 minutes up to several hours. All variants of FAT have no journaling. Hence, neither user nor the programs can check the logs for any information about the last deleted/edited files and their location on the disk. So, the recovery app is forced to do a full disk analysis. NTFS, that is typical for all modern Windows versions, has the journaling2, so the file recovery utility you use for files restoration will just search the journal for the operations with the files you need, and then just pick them up from the corresponding disk sector, in case if this memory unit was not overwritten.
You can check the file system that is used for the disk, which will be involved in the recovery process. Open the list of your disks in the file system explorer, then press the right mouse button on the disk you want to recover and choose “Properties”. You will see all properties of this disk, including the amount of free space and its file system.
Restrictions to file recovery tools usage
Do not try to recover data from the possibly damaged drives. If you spilled water on it, it fell hard, made strange noises, or suffered a significant power surge, it is dangerous to plug it in. If you have no special equipment for disk recovery, it is recommended to bring the disk to the service, where such equipment is likely to present and proper file recovery applications. In the case of plugging such a drive, your information may be lost without any chances of recovery.
SSD and modern operating systems. Modern OS, such as Windows 10 and Windows 11, the last version of macOS, and even Linux after the specific setup is capable of complete deletion of data from the solid-state drives. Besides deleting the information about the removed file from the file system, it also sends the TRIM command to the drive, so the cell where the deleted document was stored will be cleaned up. This setting is set up by default for Windows 10 and macOS, so if you use these OS with SSD, have not changed any system settings, and are trying to recover your data, you may stop – unfortunately, it is not possible to do it.
Several more words about Windows interaction with solid-state drives. Defragmentation and Optimization – a built-in function enabled in Windows by default, may optimize your HDD with defragmentation operation, but for SSD, it has another mechanic. While defragmentation is just sorting the files by clusters in a consistent order, so every file/program will be located in the same physical area of the disk, optimization of SSD means using the described TRIM command to clean the cells where the deleted files were stored, and may still be located. Such action allows to avoid transistors degradation with the time flow (they are getting worse while used constantly), but multiplies by zero the chances of file recovery on your device.
Do not perform the file recovery procedure without backing up your system. There are a lot of recovery utilities on the Internet that are distributed as really efficient and helpful. And there are quite a large number of such tools. However, useless or possibly harmful tools are even more widespread. They may break your file system attempting to perform the declared functions, and it is very hard to restore the system without making use of backup.
Checking the file recovery tools
|R-Studio||Windows, Linux, macOS||FAT, NTFS, HFS/HFS+, UFS, EXT, APFS|
|GetDataBack||Windows||FAT, exFAT, NTFS, HFS+, EXT, APFS|
|DMDE||Windows, macOS, Linux, MS-DOS||Supports HFS, HFS+, APFS, FAT, NTFS|
|ReclaiMe||Windows||FAT, exFAT, NTFS, ReFS, EXT2/3/4, XFS, BTRFS, APFS, HFS and HFS+|
|UFS Explorer||Windows, macOS||FAT, exFAT, NTFS, ReFS, EXT2/3/4, XFS, BTRFS and APFS|
|EaseUS||Windows, macOS, Android, iOS.||HFS/HFS+, NTFS/ReFS, FAT32, APFS, ext3|
|Recuva||Windows (XP and later)||FAT32, exFAT, NTFS, ext3, ext4.|
|File Scavenger||Windows, Linux, macOS||Unspecified|
Quite a popular solution that can be met in computer repairing centers. The interface of this tool is a bit complicated. However, when you use it more often than one time per quarter, you will get used to it. Supports all popular operating systems (macOS, Linux, and Windows) and such file systems as FAT, NTFS, HFS/HFS+, UFS, EXT, and APFS. The developer, R-tools, states that it can file restoration after the malware attack.
This tool is exclusively for Windows, however, supports also HFS+, EXT and APFS, so you can try to perform the file recovery connecting the disks with these file systems to your PC on Windows. Of course, Windows native FSs – FAT, exFAT and NTFS – are also supported.
Quite an expensive utility, however, beloved by repairing centers, that can be run in macOS, Windows and Linux, and even DOS. Supports HFS, HFS+, APFS, FAT and NTFS. The interface is much more complicated than in other file recovery tools. That’s why I can recommend it only for experienced users.
This tool supports likely the biggest variety of different file systems : all possible Windows standards (FAT, exFAT, NTFS, ReFS), the majority of Linux popular FSs (EXT2/3/4, XFS, BTRFS), and all modern file systems by Apple – APFS, HFS and HFS+. The important feature is that this utility is capable of whole file system recovery, besides photo or video reviving.
UFS Explorer is a very complicated file recovery tool that can do much more than just deleted video recovery. Like ReclaiMe, it supports many file systems, with one exclusion – HFS is available in access-only mode (you cannot recover the deleted files, only read the disk). It can also work with damaged disks and read RAID disks. It also has a free mode, which has a bit of restricted functionality. But the amount of even restricted functionality is enough for file recovery.
EaseUS was developed as an omni-purpose tool. It can serve for disk recovery after the file system failure and for file recovery after the unintentional deletion. It supports HFS/HFS+, NTFS/ReFS, FAT32, and even mobile types of the file system – APFS and ext3 – they are used in iOS and Android, correspondingly. There is a free version, and two types of paid licenses (for a single device and an unlimited number of ones), but even paid versions can be tested during the trial period. Compatible with macOS and Windows.
This program is quite popular among unprofessional users. However, it is far away from the professional tool, like UFS Explorer. Created by the team of CCleaner, Recuva supports only Windows (up from XP) and supports a minimal amount of file systems (mostly Windows-specific) – FAT32, exFAT, and NTFS. Developers also state that this tool supports ext3 and ext4, but, as practice shows, there are a lot of bugs with these FS. Besides lack of functionality and file systems support, this tool has quite a simple interface, so it is a good solution for simple operations with disks and files. You can choose between a free and premium type of license with no critical differences.
That app is created especially for deleted files recovery so that it will help you with file recovery after the ransomware attack. The developers of this utility state that it is compatible “with almost all file systems”. However, there is no exact specification for the supported FS types. Like UFS Explorer, it has a free mode. Its interface is straightforward, so File Scavenger is recommended for low-skilled PC users.
Well-proven free tools
Windows File Recovery
An unpretentious app that Microsoft created is a console tool for file recovery. It can be used only with Windows (obvious characteristic) and can recover the files from NTFS, FAT, exFAT, and ReFS. Console usage is quite a complicated task, and this app has several significant issues, but it is enough if the only thing you need is to recover 2-3 documents. Of course, this tool is 100% safe because it was created for Windows by Microsoft.
This program is quite effective as a free tool. Such effectiveness was caused by joint actions with another tool of the same developer – TestDisk, which is distributed together with PhotoRec. TestDisk serves as a disk restoration tool: it can recover your master boot record or the partition table at all in case of critical issues with it. PhotoRec functions are complementary to TestDisks abilities. Their developers state that you can revive the files of 480 different formats. The amount of OS where PhotoRec can be run is inspiring: Linux, Free/Net/OpenBSD, DOS/Windows 9x, Windows XP and later, and even Sun Solaris. CGSecurity (the developer of this app) also says that it can file recovery from CDs, memory cards, USB drives, and DD raw images.
About free file reviving tools
Free file recovery programs are not as bad as you can think. Paid is not a synonym of the best. There are a lot of free solutions with excellent functionality. However, we are talking about free recovery tools, which are distributed as a part of a bundle with different programs. These apps state that they are the best ones and able to recover any files, any time. And some of them are trying to do so, but their unskilled developers, who have no time and money for proper testing of their program, often create programs that carry a real danger for your file system.
Crushing of the file system may lead to complete file loss because your operating system fails to understand where the files it needs are located. And after such an occasion, you will be forced to use paid/made a good showing of oneself programs to get the files you need back (the whole file system cannot be restored after its failure). As an alternative, you will carry your drive to the computer service center, where the professionals perform a recovery process with one of the described programs. But isn’t it easier to do everything correctly and initially?
Subscribe to our Telegram channel to be the first to know about news and our exclusive materials on information security.
User Review( votes)