Even in modern times, when the level of knowledge about computer usage is higher than it has ever been, the risk of losing the files is still high. Accidental deletion, data loss in the process of disk partition, malware attacks – all these factors causing a big amount of search queries, like “how to restore deleted files” or “how to restore permanently deleted photos”. File recovery tool usage is very popular advice, but how to choose the tool you need? Let’s figure this thing out.
How files can be lost?
Ransomware attack is one of the most dangerous types of malware activity. While other malware can lead to system malfunctioning, or data leaks, ransomware makes your computer impossible to use. There is no way to make use of your PC in the usual way when you are not able to open any file.
But some features of the ransomware mechanism together with the key principles of file system interactions with physical disks gives the chance to revive the encrypted files. Ransomware encryption procedure feature is next: it encrypts every file byte-by-byte, after that saves a file copy, removing (and not overwriting!) the original document1. For this reason, the info about placing the file on the physical disk is shed, however, the initial document is not erased from the physical disk. The sector where this file was kept, can still hold this file, but it is not detailed by the file system and can be overwritten by the information that has been placed on this drive after the deletion. Thus, it is possible to revive your documents by utilizing special apps.
Several words about the file systems
Depending on the file system type, the recovery process may take from 10 minutes up to several hours. All variants of FAT have no journaling, hence, neither user nor the programs are able to check the logs for any information about the last deleted/edited files, as well as about their location on the disk. So, the recovery app is forced to do a full disk analysis. NTFS, that is typical for all modern Windows versions, has the journaling2, so the file recovery utility you use for files restoration will just search the journal for the operations with the files you need, and then just pick them up from the corresponding disk sector, in case if this memory unit was not overwritten.
You can check the file system that is used for the disk, which will be involved in the recovery process. Open the list of your disks in the file system explorer, then press the right mouse button on the disk you want to recover and choose “Properties”. You will see all properties of this disk, including the amount of free space and its file system.
Restrictions to file recovery tools usage
Do not try to recover data from the possibly damaged drives. If you spilled water on it, it fell down hard, made strange noises or suffered a significant power surge, it is dangerous to plug it in. If you have no special equipment for disk recovery, it is recommended to bring the disk to the service, where such equipment is likely to present, as well as proper file recovery applications. In the case of plugging such a drive, your information may be lost without any chances of recovery.
SSD and modern operating systems. Modern OS, such as Windows 10, last version of macOS, and even Linux after the specific setup is capable of complete deletion of data from the solid-state drives. Besides deleting the information about the removed file from the file system, it also sends the TRIM command to the drive, so the cell where the deleted document was stored will be cleaned up. This setting is set up by default for Windows 10 and macOS, so, if you use these OS with SSD, have not changed any system settings, and are trying to recover your data, you may stop – unfortunately, it is not possible to do it.
Do not perform the file recovery procedure without backing up your system. There are a lot of recovery utilities on the Internet that are distributed as really efficient and helpful. And there are quite a big number of such tools, however, useless or possibly harmful tools are even more widespread. They may break your file system attempting to perform the declared functions, and it is very hard to restore the system without making use of backup.
Checking the file recovery tools
|R-Studio||Windows, Linux, macOS||FAT, NTFS, HFS/HFS+, UFS, EXT, APFS|
|GetDataBack||Windows||FAT, exFAT, NTFS, HFS+, EXT, APFS|
|DMDE||Windows, macOS, Linux, MS-DOS||Supports HFS, HFS+, APFS, FAT, NTFS|
|ReclaiMe||Windows||FAT, exFAT, NTFS, ReFS, EXT2/3/4, XFS, BTRFS, APFS, HFS and HFS+|
|UFS Explorer||Windows, macOS||FAT, exFAT, NTFS, ReFS, EXT2/3/4, XFS, BTRFS and APFS|
|EaseUS||Windows, macOS, Android, iOS.||HFS/HFS+, NTFS/ReFS, FAT32, APFS, ext3|
|Recuva||Windows (XP and later)||FAT32, exFAT, NTFS, ext3, ext4.|
|File Scavenger||Windows, Linux, macOS||Unspecified|
Quite a popular solution that can be met in computer repairing centers. The interface of this tool is a bit complicated, however, when you use it more often than 1 time per quarter, you will get used to it. Supports all popular operating systems (macOS, Linux and Windows), and such file systems as FAT, NTFS, HFS/HFS+, UFS, EXT and APFS. The developer, R-tools, states that it is capable of file restoration after the malware attack.
This tool is exclusively for Windows, however, supports also HFS+, EXT and APFS, so you can try to perform the file recovery connecting the disks with these file systems to your PC on Windows. Of course, Windows native FSs – FAT, exFAT and NTFS – are also supported.
Quite an expensive utility, however, beloved by repairing centers, that can be run in macOS, Windows and Linux, and even DOS. Supports HFS, HFS+, APFS, FAT and NTFS. Interface is much more complicated than in other file recovery tools, that’s why I can recommend it only for experienced users.
This tool supports likely the biggest variety of different file systems : all possible Windows standards (FAT, exFAT, NTFS, ReFS), the majority of Linux popular FSs (EXT2/3/4, XFS, BTRFS), and all modern file systems by Apple – APFS, HFS and HFS+. The important feature is that this utility is capable of whole file system recovery, besides photo or video reviving.
UFS Explorer is a very complicated file recovery tool that can do far much more than just deleted video recovery. Like ReclaiMe, it supports a huge amount of file systems, with one exclusion – HFS is available in access-only mode (you are not able to recover the deleted files, only read the disk). It also can work with damaged disks, as well as read RAID disks. It also has a free mode, which has a bit restricted functionality. But the amount of even restricted functionality is enough for file recovery.
EaseUS was developed as an omni-purpose tool. It can serve for disk recovery after the file system failure, as well as for file recovery after the unintentional deletion. It supports HFS/HFS+, NTFS/ReFS, FAT32, and even mobile types of file system – APFS and ext3 – they are used in iOS and Android, correspondingly. There is a free version and two types of paid licence (for single device and for unlimited number of ones), but even paid versions can be tested during the trial period. Compatible with macOS and Windows.
This program is quite popular among unprofessional users, however, it is far away from the professional tool, like UFS Explorer. Created by the team of CCleaner, Recuva supports only Windows (up from XP), and supports an extremely limited amount of file systems (mostly Windows-specific) – FAT32, exFAT and NTFS. Developers also state that this tool supports ext3 and ext4, but, as practice shows, there are a lot of bugs with these FS. Besides lack of functionality and file systems support, this tool has quite a simple interface, so it is a good solution for simple operations with disks and files. You can choose between a free and premium type of license, which have no critical differences.
That app is created especially for deleted files recovery, so it will definitely help you with file recovery after the ransomware attack. The developers of this utility state that it is compatible “with almost all file systems”, however, there is no exact specification for the supported FS types. Like UFS Explorer, it has a free mode. Its interface is very easy, so File Scavenger is definitely recommended for low-skilled PC users.
Well-proven free tools
Windows File Recovery
An unpretentious app, that was created by Microsoft, is a console tool for file recovery. It can be used only with Windows (obvious characteristic), and can recover the files from NTFS, FAT, exFAT and ReFS. Console usage is quite a complicated task, and this app has several notable issues, but it is enough if the only thing you need is to recover 2-3 documents. Of course, this tool is 100% safe, because it was created for Windows by Microsoft.
This program is quite effective as a free tool, and such effectiveness was caused by joint actions with another tool of the same developer – TestDisk, which is distributed together with PhotoRec. TestDisk serves as a disk restoration tool: it can recover your master boot record, or the partition table at all in case of critical issues with it. PhotoRec functions are complementary to TestDisks abilities. Their developers state that you can revive the files of 480 different formats. The amount of OS where PhotoRec can be run is really exciting: Linux, Free/Net/OpenBSD, DOS/Windows 9x, Windows XP and later, and even Sun Solaris. CGSecurity (the developer of this app) also says that it is capable of file recovery from CD, memory cards, USB drives and DD raw image.
About free file reviving tools
Free file recovery programs are not as bad as you can think. Paid is not a synonym of the best. There are a lot of free solutions with really good functionality, however, we are talking about free recovery tools, which are distributed as a part of a bundle with different programs. These apps state that they are the best ones, and able to recover any files, any time. And some of them are really trying to do so, but their unskilled developers, who have no time and money for proper testing of their program, often create programs that carry a real danger for your file system.
Crushing of the file system may lead to complete file loss, because your operating system fails to understand where the files it needs are located. And after such an occasion, you will be forced to use paid/made a good showing of oneself programs to get the files you need back (the whole file system cannot be restored after its failure). As an alternative, you will carry your drive to the computer service center, where the professionals perform a recovery process with one of the described programs. But isn’t it easier to do everything properly and initially?
User Review( votes)