Have you ever accidentally deleted a document and needed it? You could have removed the memory card from your camera incorrectly, and your precious photos and videos could have become unreadable. If you’ve used a file recovery tool at least once, you understand how useful such software can be. Those who have been lucky enough to avoid it can’t even imagine how serious the problem of data loss can be. Unfortunately, even today, when most computer users know how the operating system works (at least on a basic level), cases when users lose data, are common. And the problem lies not only in the low level of computer skills or human inattention. To delete files from your computer, you must confirm the deletion twice because of the Recycle Bin feature, so even inexperienced users can stop the unwanted process.
Nevertheless, since time immemorial, there have been malware-based threats that cause data loss. That’s why even now, in the era of cloud storage and backups, the demand for file recovery tools remains actual to this day. So, let’s check which file recovery software is best.
How files can be lost?
First, let’s find out the most widespread causes of file loss. Unfortunately, the most common causes of file loss are disk drive breakdown. However, in such cases, there is nothing you can do. Moreover, only some data recovery services will take on this task, and if they do, it will be costly. The scale of the problem remains very high when it comes to ransomware, the scale of the problem remains very high. Still, file recovery appears possible, especially if you have previously removed the virus to the recovery operations.
Fortunately, some features of the ransomware mechanism, coupled with key principles of how the file system interacts with physical disks, make it possible to recover encrypted files. A peculiarity of the ransomware’s encryption procedure is that it encrypts each file byte-by-byte and then saves a copy of the file, removing (and not overwriting!) the original document1. Consequently, the file’s placement information on the physical disk is shed. However, the original record is not erased from the physical disk, and the sector where the file was stored may still contain the file. Furthermore, since the system no longer details this file, it can overwrite it with the new information placed on this disk after it was deleted. Thus, using unique applications, you can still recover your documents under certain conditions.
Several words about the file systems
Depending on the file system type, the recovery process may take from 10 minutes up to several hours. All variants of FAT have no journaling. Hence, neither user nor the programs can check the logs for any information about the last deleted/edited files and their location on the disk. So, the recovery app is forced to do a full disk analysis. NTFS, that is typical for all modern Windows versions, has the journaling2, so the file recovery utility you use for files restoration will just search the journal for the operations with the files you need, and then just pick them up from the corresponding disk sector, in case if this memory unit was not overwritten.
You can check the file system that is used for the disk, which will be involved in the recovery process. Open the list of your disks in the file system explorer, then press the right mouse button on the disk you want to recover and choose “Properties”. You will see all properties of this disk, including the amount of free space and its file system.
Restrictions to file recovery tools usage
Do not try to recover data from the possibly damaged drives. If you spilled water on it, it fell hard, made strange noises, or suffered a significant power surge, it is dangerous to plug it in. If you have no special equipment for disk recovery, it is recommended to bring the disk to the service, where such equipment is likely to present and proper file recovery applications. In the case of plugging such a drive, your information may be lost without any chances of recovery.
SSD and modern operating systems. Modern OS, such as Windows 10 and Windows 11, the last version of macOS, and even Linux after the specific setup is capable of complete deletion of data from the solid-state drives. Besides deleting the information about the removed file from the file system, it also sends the TRIM command to the drive, so the cell where the deleted document was stored will be cleaned up. This setting is set up by default for Windows 10 and macOS, so if you use these OS with SSD, have not changed any system settings, and are trying to recover your data, you may stop – unfortunately, it is not possible to do it.
Several more words about Windows interaction with solid-state drives. Defragmentation and Optimization – a built-in function enabled in Windows by default, may optimize your HDD with defragmentation operation, but for SSD, it has another mechanic. While defragmentation is just sorting the files by clusters in a consistent order, so every file/program will be located in the same physical area of the disk, optimization of SSD means using the described TRIM command to clean the cells where the deleted files were stored, and may still be located. Such action allows to avoid transistors degradation with the time flow (they are getting worse while used constantly), but multiplies by zero the chances of file recovery on your device.
Do not perform the file recovery procedure without backing up your system. There are a lot of recovery utilities on the Internet that are distributed as really efficient and helpful. And there are quite a large number of such tools. However, useless or possibly harmful tools are even more widespread. They may break your file system attempting to perform the declared functions, and it is very hard to restore the system without making use of backup.
Checking the file recovery tools
|R-Studio||Windows, Linux, macOS||FAT, NTFS, HFS/HFS+, UFS, EXT, APFS|
|GetDataBack||Windows||FAT, exFAT, NTFS, HFS+, EXT, APFS|
|DMDE||Windows, macOS, Linux, MS-DOS||Supports HFS, HFS+, APFS, FAT, NTFS|
|ReclaiMe||Windows||FAT, exFAT, NTFS, ReFS, EXT2/3/4, XFS, BTRFS, APFS, HFS and HFS+|
|UFS Explorer||Windows, macOS||FAT, exFAT, NTFS, ReFS, EXT2/3/4, XFS, BTRFS and APFS|
|EaseUS||Windows, macOS, Android, iOS.||HFS/HFS+, NTFS/ReFS, FAT32, APFS, ext3|
|Recuva||Windows (XP and later)||FAT32, exFAT, NTFS, ext3, ext4.|
|File Scavenger||Windows, Linux, macOS||Unspecified|
Quite a popular solution that can be met in computer repairing centers. The interface of this tool is a bit complicated. However, when you use it more often than one time per quarter, you will get used to it. Supports all popular operating systems (macOS, Linux, and Windows) and such file systems as FAT, NTFS, HFS/HFS+, UFS, EXT, and APFS. The developer, R-tools, states that it can file restoration after the malware attack.
This tool is exclusively for Windows, however, supports also HFS+, EXT and APFS, so you can try to perform the file recovery connecting the disks with these file systems to your PC on Windows. Of course, Windows native FSs – FAT, exFAT and NTFS – are also supported.
Quite an expensive utility, however, beloved by repairing centers, that can be run in macOS, Windows and Linux, and even DOS. Supports HFS, HFS+, APFS, FAT and NTFS. The interface is much more complicated than in other file recovery tools. That’s why I can recommend it only for experienced users.
This tool supports likely the biggest variety of different file systems : all possible Windows standards (FAT, exFAT, NTFS, ReFS), the majority of Linux popular FSs (EXT2/3/4, XFS, BTRFS), and all modern file systems by Apple – APFS, HFS and HFS+. The important feature is that this utility is capable of whole file system recovery, besides photo or video reviving.
UFS Explorer is a very complicated file recovery tool that can do much more than just deleted video recovery. Like ReclaiMe, it supports many file systems, with one exclusion – HFS is available in access-only mode (you cannot recover the deleted files, only read the disk). It can also work with damaged disks and read RAID disks. It also has a free mode, which has a bit of restricted functionality. But the amount of even restricted functionality is enough for file recovery.
EaseUS was developed as an omni-purpose tool. It can serve for disk recovery after the file system failure and for file recovery after the unintentional deletion. It supports HFS/HFS+, NTFS/ReFS, FAT32, and even mobile types of the file system – APFS and ext3 – they are used in iOS and Android, correspondingly. There is a free version, and two types of paid licenses (for a single device and an unlimited number of ones), but even paid versions can be tested during the trial period. Compatible with macOS and Windows.
This program is quite popular among unprofessional users. However, it is far away from the professional tool, like UFS Explorer. Created by the team of CCleaner, Recuva supports only Windows (up from XP) and supports a minimal amount of file systems (mostly Windows-specific) – FAT32, exFAT, and NTFS. Developers also state that this tool supports ext3 and ext4, but, as practice shows, there are a lot of bugs with these FS. Besides lack of functionality and file systems support, this tool has quite a simple interface, so it is a good solution for simple operations with disks and files. You can choose between a free and premium type of license with no critical differences.
That app is created especially for deleted files recovery so that it will help you with file recovery after the ransomware attack. The developers of this utility state that it is compatible “with almost all file systems”. However, there is no exact specification for the supported FS types. Like UFS Explorer, it has a free mode. Its interface is straightforward, so File Scavenger is recommended for low-skilled PC users.
Well-proven free tools
Windows File Recovery
An unpretentious app that Microsoft created is a console tool for file recovery. It can be used only with Windows (obvious characteristic) and can recover the files from NTFS, FAT, exFAT, and ReFS. Console usage is quite a complicated task, and this app has several significant issues, but it is enough if the only thing you need is to recover 2-3 documents. Of course, this tool is 100% safe because it was created for Windows by Microsoft.
This program is quite effective as a free tool. Such effectiveness was caused by joint actions with another tool of the same developer – TestDisk, which is distributed together with PhotoRec. TestDisk serves as a disk restoration tool: it can recover your master boot record or the partition table at all in case of critical issues with it. PhotoRec functions are complementary to TestDisks abilities. Their developers state that you can revive the files of 480 different formats. The amount of OS where PhotoRec can be run is inspiring: Linux, Free/Net/OpenBSD, DOS/Windows 9x, Windows XP and later, and even Sun Solaris. CGSecurity (the developer of this app) also says that it can file recovery from CDs, memory cards, USB drives, and DD raw images.
About free file reviving tools
Free file recovery programs are not as bad as you can think. Paid is not a synonym of the best. There are a lot of free solutions with excellent functionality. However, we are talking about free recovery tools, which are distributed as a part of a bundle with different programs. These apps state that they are the best ones and able to recover any files, any time. And some of them are trying to do so, but their unskilled developers, who have no time and money for proper testing of their program, often create programs that carry a real danger for your file system.
Crushing of the file system may lead to complete file loss because your operating system fails to understand where the files it needs are located. And after such an occasion, you will be forced to use paid/made a good showing of oneself programs to get the files you need back (the whole file system cannot be restored after its failure). As an alternative, you will carry your drive to the computer service center, where the professionals perform a recovery process with one of the described programs. But isn’t it easier to do everything correctly and initially?
Subscribe to our Telegram channel to be the first to know about news and our exclusive materials on information security.
User Review( votes)
- More information about ransomware- wikipedia.org/Ransomware
- About different file systems
- How to use PhotoRec Video Tutorial: https://youtu.be/XzwClL9etlI