In computing, data recovery is a process of retrieving deleted, inaccessible, lost, corrupted, damaged, or formatted data from

secondary storage Computer data storage is a technology consisting of computer components and recording media that are used to retain digital data. It is a core function and fundamental component of computers. The central processing unit (CPU) of a comput ...

removable media Expandable storage is a form of computer storage that is designed to be inserted and removed from a system. Some forms of removable media, such as optical discs, require a reader to be installed in the computer, while others, such as USB flash dri ...

or files, when the data stored in them cannot be accessed in a usual way. The data is most often salvaged from storage media such as internal or external

hard disk drive A hard disk drive (HDD), hard disk, hard drive, or fixed disk is an electro-mechanical data storage device that stores and retrieves digital data using magnetic storage with one or more rigid rapidly rotating platters coated with magneti ...

s (HDDs),

solid-state drive A solid-state drive (SSD) is a solid-state storage device that uses integrated circuit assemblies to store data Persistence (computer science), persistently, typically using flash memory, and functioning as secondary storage in the Computer ...

s (SSDs),

USB flash drive A USB flash drive (also called a thumb drive) is a data storage device that includes flash memory with an integrated USB interface. It is typically removable, rewritable and much smaller than an optical disc. Most weigh less than . Since first ...

magnetic tapes Magnetic tape is a medium for magnetic storage made of a thin, magnetizable coating on a long, narrow strip of plastic film. It was developed in Germany in 1928, based on the earlier magnetic wire recording from Denmark. Devices that use magnet ...

, CDs,

DVD The DVD (common abbreviation for Digital Video Disc or Digital Versatile Disc) is a digital optical disc data storage format. It was invented and developed in 1995 and first released on November 1, 1996, in Japan. The medium can store any kin ...

RAID Raid, RAID or Raids may refer to: Attack * Raid (military), a sudden attack behind the enemy's lines without the intention of holding ground * Corporate raid, a type of hostile takeover in business * Panty raid, a prankish raid by male college ...

subsystems, and other

electronic devices The field of electronics is a branch of physics and electrical engineering that deals with the emission, behaviour and effects of electrons using electronic devices. Electronics uses active devices to control electron flow by amplification ...

. Recovery may be required due to physical damage to the storage devices or logical damage to the

file system In computing, file system or filesystem (often abbreviated to fs) is a method and data structure that the operating system uses to control how data is stored and retrieved. Without a file system, data placed in a storage medium would be one lar ...

that prevents it from being

mounted Mount is often used as part of the name of specific mountains, e.g. Mount Everest. Mount or Mounts may also refer to: Places * Mount, Cornwall, a village in Warleggan parish, England * Mount, Perranzabuloe, a hamlet in Perranzabuloe parish, ...

by the host

operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common daemon (computing), services for computer programs. Time-sharing operating systems scheduler (computing), schedule tasks for ef ...

(OS). Logical failures occur when the hard drive devices are functional but the user or automated-OS cannot retrieve or access date stored in it. It can occur due to corrupt engineering chip, lost partitions, deleted data, firmware failure, failed formatting/re-installation. Data recovery can be a very simple or technical challenge. This is why there are specific software companies specialized in this field.

About

The most common data recovery scenarios involve an operating system failure, malfunction of a storage device, logical failure of storage devices, accidental damage or deletion, etc. (typically, on a single-drive, single- partition, single-OS system), in which case the ultimate goal is simply to copy all important files from the damaged media to another new drive. This can be accomplished using a

Live CD A live CD (also live DVD, live disc, or live operating system) is a complete bootable computer installation including operating system which runs directly from a CD-ROM or similar storage device into a computer's memory, rather than loading f ...

, or DVD by booting directly from a

ROM Rom, or ROM may refer to: Biomechanics and medicine * Risk of mortality, a medical classification to estimate the likelihood of death for a patient * Rupture of membranes, a term used during pregnancy to describe a rupture of the amniotic sac * R ...

or a USB drive instead of the corrupted drive in question. Many Live CDs or DVDs provide a means to mount the system drive and backup drives or removable media, and to move the files from the system drive to the backup media with a

file manager A file manager or file browser is a computer program that provides a user interface to manage computer files, files and folder (computing), folders. The most common Computer file#Operations, operations performed on files or groups of files inclu ...

optical disc authoring software Optical disc authoring, including DVD and Blu-ray Disc authoring, is the process of assembling source material—video, audio or other data—into the proper logical volume format to then be recorded ("burned") onto an optical disc (typ ...

. Such cases can often be mitigated by

disk partition Disk partitioning or disk slicing is the creation of one or more regions on secondary storage, so that each region can be managed separately. These regions are called partitions. It is typically the first step of preparing a newly installed disk, ...

ing and consistently storing valuable data files (or copies of them) on a different partition from the replaceable OS system files. Another scenario involves a drive-level failure, such as a compromised

or drive partition, or a hard disk drive failure. In any of these cases, the data is not easily read from the media devices. Depending on the situation, solutions involve repairing the logical file system, partition table, or

master boot record A master boot record (MBR) is a special type of boot sector at the very beginning of partitioned computer mass storage devices like fixed disks or removable drives intended for use with IBM PC-compatible systems and beyond. The concept of M ...

, or updating the

firmware In computing, firmware is a specific class of computer software that provides the low-level control for a device's specific hardware. Firmware, such as the BIOS of a personal computer, may contain basic functions of a device, and may provide h ...

or drive recovery techniques ranging from software-based recovery of corrupted data, to hardware- and software-based recovery of damaged service areas (also known as the hard disk drive's "firmware"), to hardware replacement on a physically damaged drive which allows for the extraction of data to a new drive. If a drive recovery is necessary, the drive itself has typically failed permanently, and the focus is rather on a one-time recovery, salvaging whatever data can be read. In a third scenario, files have been accidentally " deleted" from a storage medium by the users. Typically, the contents of deleted files are not removed immediately from the physical drive; instead, references to them in the directory structure are removed, and thereafter space the deleted data occupy is made available for later data overwriting. In the mind of

end user In product development, an end user (sometimes end-user) is a person who ultimately uses or is intended to ultimately use a product. The end user stands in contrast to users who support or maintain the product, such as sysops, system administrato ...

s, deleted files cannot be discoverable through a standard file manager, but the deleted data still technically exists on the physical drive. In the meantime, the original file contents remain, often several disconnected fragments, and may be recoverable if not overwritten by other data files. The term "data recovery" is also used in the context of

forensic Forensic science, also known as criminalistics, is the application of science to Criminal law, criminal and Civil law (legal system), civil laws, mainly—on the criminal side—during criminal investigation, as governed by the legal standard ...

applications or

espionage Espionage, spying, or intelligence gathering is the act of obtaining secret or confidential information (intelligence) from non-disclosed sources or divulging of the same without the permission of the holder of the information for a tangibl ...

, where data which have been

encrypted In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can deci ...

, hidden, or deleted, rather than damaged, are recovered. Sometimes data present in the computer gets encrypted or hidden due to reasons like virus attacks which can only be recovered by some computer forensic experts.

Physical damage

A wide variety of failures can cause physical damage to storage media, which may result from human errors and natural disasters.

CD-ROM A CD-ROM (, compact disc read-only memory) is a type of read-only memory consisting of a pre-pressed optical compact disc that contains data. Computers can read—but not write or erase—CD-ROMs. Some CDs, called enhanced CDs, hold both compute ...

s can have their metallic substrate or dye layer scratched off; hard disks can suffer from a multitude of mechanical failures, such as

head crash A head crash is a hard-disk failure that occurs when a read–write head of a hard disk drive makes contact with its rotating platter, slashing its surface and permanently damaging its magnetic media. It is most often caused by a sudden seve ...

es, PCB failure, and failed motors; tapes can simply break. Physical damage to a hard drive, even in cases where a head crash has occurred, does not necessarily mean there will be a permanent loss of data. The techniques employed by many professional data recovery companies can typically salvage most, if not all, of the data that had been lost when the failure occurred. Of course, there are exceptions to this, such as cases where severe damage to the hard drive

platters The Platters was an American vocal group formed in 1952. They are one of the most successful vocal groups of the early rock and roll era. Their distinctive sound bridges the pre-rock Tin Pan Alley tradition and the new burgeoning genre. The ac ...

may have occurred. However, if the hard drive can be repaired and a full image or clone created, then the logical file structure can be rebuilt in most instances. Most physical damage cannot be repaired by end users. For example, opening a hard disk drive in a normal environment can allow airborne dust to settle on the platter and become caught between the platter and the

read/write head A disk read-and-write head is the small part of a disk drive which moves above the disk platter and transforms the platter's magnetic field into electrical current (reads the disk) or, vice versa, transforms electrical current into magnetic fi ...

. During normal operation, read/write heads float 3 to 6

nanometers 330px, Different lengths as in respect to the molecular scale. The nanometre (international spelling as used by the International Bureau of Weights and Measures; SI symbol: nm) or nanometer (American and British English spelling differences#-re, ...

above the platter surface, and the average dust particles found in a normal environment are typically around 30,000 nanometers in diameter. When these dust particles get caught between the read/write heads and the platter, they can cause new head crashes that further damage the platter and thus compromise the recovery process. Furthermore, end users generally do not have the hardware or technical expertise required to make these repairs. Consequently, data recovery companies are often employed to salvage important data with the more reputable ones using class 100 dust- and static-free

cleanroom A cleanroom or clean room is an engineered space, which maintains a very low concentration of airborne particulates. It is well isolated, well-controlled from contamination, and actively cleansed. Such rooms are commonly needed for scientif ...

Recovery techniques

Recovering data from physically damaged hardware can involve multiple techniques. Some damage can be repaired by replacing parts in the hard disk. This alone may make the disk usable, but there may still be logical damage. A specialized disk-imaging procedure is used to recover every readable bit from the surface. Once this image is acquired and saved on a reliable medium, the image can be safely analyzed for logical damage and will possibly allow much of the original file system to be reconstructed.

Hardware repair

A common misconception is that a damaged

printed circuit board A printed circuit board (PCB; also printed wiring board or PWB) is a medium used in electrical and electronic engineering to connect electronic components to one another in a controlled manner. It takes the form of a laminated sandwich struct ...

(PCB) may be simply replaced during recovery procedures by an identical PCB from a healthy drive. While this may work in rare circumstances on hard disk drives manufactured before 2003, it will not work on newer drives. Electronics boards of modern drives usually contain drive-specific adaptation data (generally a map of bad sectors and tuning parameters) and other information required to properly access data on the drive. Replacement boards often need this information to effectively recover all of the data. The replacement board may need to be reprogrammed. Some manufacturers (Seagate, for example) store this information on a serial

EEPROM EEPROM (also called E2PROM) stands for electrically erasable programmable read-only memory and is a type of non-volatile memory used in computers, usually integrated in microcontrollers such as smart cards and remote keyless systems, or as a ...

chip, which can be removed and transferred to the replacement board. Each hard disk drive has what is called a ''system area'' or ''service area''; this portion of the drive, which is not directly accessible to the end user, usually contains drive's firmware and adaptive data that helps the drive operate within normal parameters. One function of the system area is to log defective sectors within the drive; essentially telling the drive where it can and cannot write data. The sector lists are also stored on various chips attached to the PCB, and they are unique to each hard disk drive. If the data on the PCB do not match what is stored on the platter, then the drive will not calibrate properly. In most cases the drive heads will click because they are unable to find the data matching what is stored on the PCB.

Logical damage

The term "logical damage" refers to situations in which the error is not a problem in the hardware and requires software-level solutions.

Corrupt partitions and file systems, media errors

In some cases, data on a hard disk drive can be unreadable due to damage to the

partition table Disk partitioning or disk slicing is the creation of one or more regions on secondary storage, so that each region can be managed separately. These regions are called partitions. It is typically the first step of preparing a newly installed disk, ...

, or to (intermittent) media errors. In the majority of these cases, at least a portion of the original data can be recovered by repairing the damaged partition table or file system using specialized data recovery software such as

Testdisk TestDisk is a free and open-source data recovery utility that helps users recover lost partitions or repair corrupted filesystems. TestDisk can collect detailed information about a corrupted drive, which can then be sent to a technician for furthe ...

; software like

ddrescue GNU ddrescue is a data recovery tool for disk drives, DVDs, CDs, and other digital storage media. It copies raw blocks of storage, such as disk sectors, from one device or file to another, while handling read errors in an intelligent manner to ...

can image media despite intermittent errors, and image raw data when there is partition table or file system damage. This type of data recovery can be performed by people without expertise in drive hardware as it requires no special physical equipment or access to platters. Sometimes data can be recovered using relatively simple methods and tools; more serious cases can require expert intervention, particularly if parts of files are irrecoverable.

Data carving File carving is the process of reassembling computer files from fragments in the absence of filesystem metadata. Introduction and basic principles All filesystems contain some metadata that describes the actual file system. At a minimum, this inc ...

is the recovery of parts of damaged files using knowledge of their structure.

Overwritten data

After data has been physically overwritten on a hard disk drive, it is generally assumed that the previous data are no longer possible to recover. In 1996, Peter Gutmann, a computer scientist, presented a paper that suggested overwritten data could be recovered through the use of magnetic force microscopy. In 2001, he presented another paper on a similar topic. To guard against this type of data recovery, Gutmann and Colin Plumb designed a method of irreversibly scrubbing data, known as the Gutmann method and used by several disk-scrubbing software packages. Substantial criticism has followed, primarily dealing with the lack of any concrete examples of significant amounts of overwritten data being recovered. Although Gutmann's theory may be correct, there is no practical evidence that overwritten data can be recovered, while research has shown to support that overwritten data cannot be recovered.

Solid-state drive A solid-state drive (SSD) is a solid-state storage device that uses integrated circuit assemblies to store data Persistence (computer science), persistently, typically using flash memory, and functioning as secondary storage in the Computer ...

s (SSD) overwrite data differently from hard disk drives (HDD) which makes at least some of their data easier to recover. Most SSDs use

flash memory Flash memory is an electronic non-volatile computer memory storage medium that can be electrically erased and reprogrammed. The two main types of flash memory, NOR flash and NAND flash, are named for the NOR and NAND logic gates. Both us ...

to store data in pages and blocks, referenced by logical block addresses (LBA) which are managed by the

flash translation layer A flash memory controller (or flash controller) manages data stored on flash memory (usually NAND flash) and communicates with a computer or electronic device. Flash memory controllers can be designed for operating in low duty-cycle environments ...

(FTL). When the FTL modifies a sector it writes the new data to another location and updates the map so the new data appear at the target LBA. This leaves the pre-modification data in place, with possibly many generations, and recoverable by data recovery software.

Lost, deleted, and formatted data

Sometimes, data present in the physical drives (Internal/External Hard disk, Pen Drive, etc.) gets lost, deleted and formatted due to circumstances like virus attack, accidental deletion or accidental use of SHIFT+DELETE. In these cases, data recovery software is used to recover/restore the data files.

Logical bad sector

In the list of logical failures of hard disks, a logical bad sector is the most common fault leading data not to be readable. Sometimes it is possible to sidestep error detection even in software, and perhaps with repeated reading and statistical analysis recover at least some of the underlying stored data. Sometimes prior knowledge of the data stored and the error detection and correction codes can be used to recover even erroneous data. However, if the underlying physical drive is degraded badly enough, at least the hardware surrounding the data must be replaced, or it might even be necessary to apply laboratory techniques to the physical recording medium. Each of the approaches is progressively more expensive, and as such progressively more rarely sought. Eventually, if the final, physical storage medium has indeed been disturbed badly enough, recovery will not be possible using any means; the information has irreversibly been lost.

Remote data recovery

Recovery experts do not always need to have physical access to the damaged hardware. When the lost data can be recovered by software techniques, they can often perform the recovery using remote access software over the Internet, LAN or other connection to the physical location of the damaged media. The process is essentially no different from what the end user could perform by themselves. Remote recovery requires a stable connection with an adequate bandwidth. However, it is not applicable where access to the hardware is required, as in cases of physical damage.

Four phases of data recovery

Usually, there are four phases when it comes to successful data recovery, though that can vary depending on the type of data corruption and recovery required. ; Phase 1: Repair the hard disk drive : The hard drive is repaired in order to get it running in some form, or at least in a state suitable for reading the data from it. For example, if heads are bad they need to be changed; if the PCB is faulty then it needs to be fixed or replaced; if the spindle motor is bad the platters and heads should be moved to a new drive. ; Phase 2: Image the drive to a new drive or a disk image file : When a hard disk drive fails, the importance of getting the data off the drive is the top priority. The longer a faulty drive is used, the more likely further data loss is to occur. Creating an image of the drive will ensure that there is a secondary copy of the data on another device, on which it is safe to perform testing and recovery procedures without harming the source. ; Phase 3: Logical recovery of files, partition, MBR and filesystem structures : After the drive has been cloned to a new drive, it is suitable to attempt the retrieval of lost data. If the drive has failed logically, there are a number of reasons for that. Using the clone it may be possible to repair the partition table or

(MBR) in order to read the file system's data structure and retrieve stored data. ; Phase 4: Repair damaged files that were retrieved : Data damage can be caused when, for example, a file is written to a sector on the drive that has been damaged. This is the most common cause in a failing drive, meaning that data needs to be reconstructed to become readable. Corrupted documents can be recovered by several software methods or by manually reconstructing the document using a hex editor.

Restore disk

The

Windows Windows is a group of several Proprietary software, proprietary graphical user interface, graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, W ...

operating system can be reinstalled on a computer that is already licensed for it. The reinstallation can be done by downloading the operating system or by using a "restore disk" provided by the computer manufacturer. Eric Lundgren was fined and sentenced to U.S. federal prison in April 2018 for producing 28,000 restore disks and intending to distribute them for about 25 cents each as a convenience to computer repair shops.

List of data recovery software

Bootable

Data recovery cannot always be done on a running system. As a result, a

boot disk A boot disk is a removable digital data storage medium from which a computer can load and run ( boot) an operating system or utility program. The computer must have a built-in program which will load and execute a program from a boot disk meeting ...

live CD A live CD (also live DVD, live disc, or live operating system) is a complete bootable computer installation including operating system which runs directly from a CD-ROM or similar storage device into a computer's memory, rather than loading f ...

live USB A live USB is a portable USB-attached external data storage device containing a full operating system that can be booted from. The term is reminiscent of USB flash drives but may encompass an external hard disk drive or solid-state drive, tho ...

, or any other type of live distro contains a minimal operating system. * BartPE: a lightweight variant of

Microsoft Windows XP Windows XP is a major release of Microsoft's Windows NT operating system. It was release to manufacturing, released to manufacturing on August 24, 2001, and later to retail on October 25, 2001. It is a direct upgrade to its predecessors, Wind ...

Windows Server 2003 Windows Server 2003 is the sixth version of Windows Server operating system produced by Microsoft. It is part of the Windows NT family of operating systems and was released to manufacturing on March 28, 2003 and generally available on April 24, ...

32-bit operating systems, similar to a Windows Preinstallation Environment, which can be run from a live CD or live USB drive. Discontinued. * Finnix: a

Debian Debian (), also known as Debian GNU/Linux, is a Linux distribution composed of free and open-source software, developed by the community-supported Debian Project, which was established by Ian Murdock on August 16, 1993. The first version of Deb ...

-based Live CD with a focus on being small and fast, useful for computer and data rescue * Disk Drill Basic: capable of creating bootable

Mac OS X macOS (; previously OS X and originally Mac OS X) is a Unix operating system developed and marketed by Apple Inc. since 2001. It is the primary operating system for Apple's Mac (computer), Mac computers. Within the market of ...

USB drives for data recovery *

Knoppix KNOPPIX ( ) is an operating system based on Debian designed to be run directly from a CD / DVD (Live CD) or a USB flash drive (Live USB), one of the first live operating system distributions (just after Yggdrasil Linux). Knoppix was developed ...

: contains utilities for data recovery under Linux * SpinRite: a

FreeDOS FreeDOS (formerly Free-DOS and PD-DOS) is a free software operating system for IBM PC compatible computers. It intends to provide a complete MS-DOS-compatible environment for running legacy software and supporting embedded systems. FreeDOS ca ...

-based data recovery tool for hard disks and magnetic storage devices * SystemRescueCD: an Arch Linux based live CD, useful for repairing unbootable computer systems and retrieving data after a system crash *

Windows Preinstallation Environment Windows Preinstallation Environment (also known as Windows PE and WinPE) is a lightweight version of Windows used for the deployment of PCs, workstations, and servers, or troubleshooting an operating system while it is offline. It is intended t ...

(WinPE): A customizable Windows Boot DVD (made by Microsoft and distributed for free). Can be modified to boot to any of the programs listed.

Consistency checkers

CHKDSK In computing, CHKDSK (short for "check disk") is a system tool and command in DOS, Digital Research FlexOS, IBM/Toshiba 4690 OS, IBM OS/2, Microsoft Windows and related operating systems. It verifies the file system integrity of a volume and at ...

: a consistency checker for

DOS DOS is shorthand for the MS-DOS and IBM PC DOS family of operating systems. DOS may also refer to: Computing * Data over signalling (DoS), multiplexing data onto a signalling channel * Denial-of-service attack (DoS), an attack on a communicatio ...

and Windows systems * Disk First Aid: a consistency checker for

Mac OS 9 Mac OS 9 is the ninth major release of Apple's classic Mac OS operating system which was succeeded by Mac OS X (renamed to OS X in 2011 and macOS in 2016) in 2001. Introduced on October 23, 1999, it was promoted by Apple as "The Best Internet O ...

Disk Utility A disk utility is a utility program that allows a user to perform various functions on a computer disk, such as disk partitioning and logical volume management, as well as multiple smaller tasks such as changing drive letters and other mount poin ...

: a consistency checker for

fsck The system utility fsck (''file system consistency check'') is a tool for checking the consistency of a file system in Unix and Unix-like operating systems, such as Linux, macOS, and FreeBSD. A similar command, CHKDSK, exists in Microsoft Window ...

: a consistency checker for UNIX *

gparted GParted (acronym of GNOME Partition Editor) is a GTK front-end to GNU Parted and an official GNOME partition-editing application (alongside Disks). GParted is used for creating, deleting, resizing, moving, checking, and copying disk partitio ...

: a GUI for

GNU parted GNU Parted (the name being the conjunction of the two words PARTition and EDitor) is a free partition editor, used for creating and deleting partitions. This is useful for creating space for new operating systems, reorganising hard disk usage, co ...

, the GNU partition editor, capable of calling fsck

File recovery

* CDRoller: recovers data from

optical disc In computing and optical disc recording technologies, an optical disc (OD) is a flat, usually circular disc that encodes binary data (bits) in the form of pits and lands on a special material, often aluminum, on one of its flat surfaces. ...

* EaseUS Data Recovery Wizard: Windows and Mac file recovery utilities by EaseUS * Disk Drill Basic: data recovery application for Mac OS X and Windows * dvdisaster: generates error-correction data for optical discs * from

Nero AG Nero AG (known as Ahead Software AG until 2005) is a German computer software company that is especially well known for its CD/DVD/ BD burning suite, ''Nero Burning ROM''. The company's main product is Nero 2019, a piece of software that comp ...

: "Data Reliability" feature generates redundant and checksum data in the remaining space of optical discs. * GetDataBack: a Windows recovery program * Hetman Partition Recovery: data drive recovery solution *

IsoBuster IsoBuster is a data recovery computer program by Smart Projects, a Belgian company founded in 1995 by Peter Van Hove. As of version 3.0, it can recover data from damaged file systems or physically damaged disks including optical discs, hard disk ...

: recovers data from optical discs, USB sticks, flash drives and hard drives * Mac Data Recovery Guru: Mac OS X data recovery program which works on USB sticks, optical media, and hard drives * MiniTool Partition Wizard: for Windows 7 and later; includes data recovery *

Norton Utilities Norton Utilities is a utility software suite designed to help analyze, configure, optimize and maintain a computer. The latest version of the original series of Norton Utilities is Norton Utilities 16 for Windows XP/Vista/7/8 was released 26 Oc ...

: a suite of utilities that has a file recovery component *

PhotoRec PhotoRec is a free and open-source utility software for data recovery with text-based user interface using data carving techniques, designed to recover lost files from various digital camera memory, hard disk and CD-ROM. It can recover the files ...

: advanced multi-platform program with

text-based user interface In computing, text-based user interfaces (TUI) (alternately terminal user interfaces, to reflect a dependence upon the properties of computer terminals and not just text), is a retronym describing a type of user interface (UI) common as an ...

used to recover files *

Recover My Files Recover My Files is a data recovery program that uses file carving to extract lost files from unallocated clusters. Recovery is based on the interpretation of file content, usually through the process of reverse engineering a file type. It can b ...

: proprietary software for Windows 2000 and later—FAT, NTFS and HFS * Recovery Toolbox: freeware and shareware tools plus online services for various Windows 2000 and later programs * Recuva: proprietary software for Windows 2000 and later—FAT and NTFS * Stellar Data Recovery for Mac: data recovery utility for Mac OS * Stellar Data Recovery for Windows: data recovery utility for Windows * Stellar Photo Recovery: photo recovery utility for Mac OS and Windows *

TestDisk TestDisk is a free and open-source data recovery utility that helps users recover lost partitions or repair corrupted filesystems. TestDisk can collect detailed information about a corrupted drive, which can then be sent to a technician for furthe ...

: free, open source, multi-platform. recover files and lost partitions *

TuneUp Utilities AVG TuneUp, previously called AVG PC Tuneup, and TuneUp Utilities, is a utility software suite for Microsoft Windows designed to help manage, maintain, optimize, configure, and troubleshoot a computer system. It was produced and developed by Tun ...

: a suite of utilities that has a file recovery component for Windows XP and later * Windows File Recovery: a command-line utility from Microsoft to recover deleted files for Windows 10 version 2004 and later

Forensics

* Foremost: an open-source

command-line A command-line interpreter or command-line processor uses a command-line interface (CLI) to receive commands from a user in the form of lines of text. This provides a means of setting parameters for the environment, invoking executables and pro ...

file recovery program, originally developed by the U.S. Air Force Office of Special Investigations and NPS Center for Information Systems Security Studies and Research * Forensic Toolkit: by AccessData, used by law enforcement * Open Computer Forensics Architecture: An open-source program for Linux * The Coroner's Toolkit: a suite of utilities for assisting in forensic analysis of a UNIX system after a break-in * The Sleuth Kit: also known as TSK, a suite of forensic analysis tools developed by Brian Carrier for UNIX, Linux and Windows systems. TSK includes the Autopsy forensic browser.

Imaging tools

Clonezilla Clonezilla is a suite of open source drive cloning, drive imaging and system deployment utilities used to simplify deployment and maintenance of a group of computers. Clonezilla Server Edition uses multicast technologies to deploy a single ima ...

: a free disk cloning, disk imaging, data recovery, and deployment boot disk * dd: common byte-to-byte cloning tool found on Unix-like systems *

: an open-source tool similar to dd but with the ability to skip over and subsequently retry bad blocks on failing storage devices * Team Win Recovery Project: a free and open-source recovery system for Android devices