Comparison of NTFS/MFT recovery software?

Joep wrote:

Either there's something wrong in my calculations (for which I then
appologize) or something is wrong with yours. Assuming my calcualtions are
correct, I find some of your claims hard to believe.

--
Joep

Sorry, Joep - I don't mean to mislead.

For obvious reasons, I need to have plain facts and figures on my
website. There *are* individuals who will try to take advantage of me,
and I need to keep that to a minimum.

However, there has not been one single case where the recovery of more
than 30GB of data has resulted in the total charge being assessed.

Additionally, I will often forego the charge to copy the data to the
media. Certainly if there are only 5GB of data required (a common
volume) the charges will be complete. But for 30GB? No way.

The different service levels are there for a reason but, again, I am not
going to take a Priority Plus fee for something if there is a recovery
machine not busy with someone else's recovery. If the client is
desperate for the data and I don't have to interrupt other processes, I
am not going to charge extra.

This will come as a huge surprise to you and many others, but I am NOT
in the business of stitching people up.

I have never had a complaint from a client, and I intend to keep things
that way.

Sure, any old bad guy can say he's one of the good guys - what's he got
to lose? But me? Well, I *am* one of the good guys!

There is every chance some of my existing clients will be reading this.
I know for a fact that not one will complain or even have cause to raise
an issue. My confidence is valid!


Odie
--

RetroData
Data Recovery Experts
www.retrodata.co.uk

"Odie Ferrous" wrote in message
...
Joep wrote:

Either there's something wrong in my calculations (for which I then
appologize) or something is wrong with yours. Assuming my calcualtions
are
correct, I find some of your claims hard to believe.

--
Joep

Sorry, Joep - I don't mean to mislead.


Okido ;-)

--
Joep

On 27 Aug 2004 08:34:41 -0400, (Al Dykes) wrote:
In article ,
*no spam* wrote:

There appear to be hundreds of software packages out there to restore
an NTFS partition with a corrupted MFT. Does anybody know of any
reviews with a feature comparison matrix?

I'd like to see that, too.

Do you mean recover or repair ?

I'd like tools to do either.

There's lots of good info in http://www.ntfs.com/.
Under recovery concepts the is nothing about corrupted MFT.

In my experience (many thousands of systems, from the first days of
NFTS file system (NT3.51?)) NTFS is a profoundly reliable file system.

All well and good, but it can only be as reliable as the hardware
allows it to be, and it can do nothing against malware attack, if the
malware enjoys the appropriate level of access (see Witty).

About the only way to kill it is for the underlying hardware to die.

Well, that happens. Losing data is not a matter of "Oh, that was
because the hardware was bad. That's OK then!"

I know that some people with more experience have seen an ocasional
problem. It's vastly superior to FAT32, esp for very large disks.

Do you have a problem, or is this a hypothetical question ?

I did find a number of tools, mainly Windows-based (meaning you'd have
to have a recovery PC, and will have to be careful to stop XP writing
SR junk on the at-risk volume). Most purported to pull stuff off,
recover partitions, undelete files etc. One in-place repair tool,
diskette-based, that didn't boot when I tested it.

I'd settle for an equivalent of Norton DiskEdit, i.e. show me the
structures, document them, let me scribble.

Still looking...



--------------- ----- ---- --- -- - - -
Hello DOS mode my old friend
I've come to hack with you again
--------------- ----- ---- --- -- - - -

In article ,
cquirke (MVP Win9x) wrote:
On 27 Aug 2004 08:34:41 -0400, (Al Dykes) wrote:
In article ,
*no spam* wrote:

There appear to be hundreds of software packages out there to restore
an NTFS partition with a corrupted MFT. Does anybody know of any
reviews with a feature comparison matrix?

I'd like to see that, too.

Do you mean recover or repair ?

I'd like tools to do either.

There's lots of good info in http://www.ntfs.com/.
Under recovery concepts the is nothing about corrupted MFT.

In my experience (many thousands of systems, from the first days of
NFTS file system (NT3.51?)) NTFS is a profoundly reliable file system.

All well and good, but it can only be as reliable as the hardware
allows it to be, and it can do nothing against malware attack, if the
malware enjoys the appropriate level of access (see Witty).

About the only way to kill it is for the underlying hardware to die.

Well, that happens. Losing data is not a matter of "Oh, that was
because the hardware was bad. That's OK then!"


sh*t happens. hardware dies. NTFS is much more reliable than the
disks we run it on. Your computer could be stolen, or your house
could burn down. One of the rules of this game is; Never Write Over
Your Only Backup. Murphy works overtime when you are screwing with
your disks.

The fact that you've "lost" two NTFS file systems ar once tells me you
don't have an MFR problem. It's partitions and there are tools (which
I've never needed so I have no experience with) to discver the
partition tables.


I know that some people with more experience have seen an ocasional
problem. It's vastly superior to FAT32, esp for very large disks.

Do you have a problem, or is this a hypothetical question ?

I did find a number of tools, mainly Windows-based (meaning you'd have
to have a recovery PC, and will have to be careful to stop XP writing
SR junk on the at-risk volume). Most purported to pull stuff off,
recover partitions, undelete files etc. One in-place repair tool,
diskette-based, that didn't boot when I tested it.

I'd settle for an equivalent of Norton DiskEdit, i.e. show me the
structures, document them, let me scribble.

Still looking...



--------------- ----- ---- --- -- - - -
Hello DOS mode my old friend
I've come to hack with you again
--------------- ----- ---- --- -- - - -


--
Al Dykes
-----------
adykes at p a n i x . c o m

"cquirke (MVP Win9x)" wrote in message

I did find a number of tools, mainly Windows-based (meaning you'd have
to have a recovery PC

Not perse ... some run from BartPE (http://www.nu2.nu/pebuilder/), for
example iRecover (http://www.diydatarecovery.nl/~tkuurstra/irecoverpe.htm).
If you can still download recovery software, then it may be assumed you have
access to an additional PC anyway.

, and will have to be careful to stop XP writing
SR junk on the at-risk volume). Most purported to pull stuff off,
recover partitions, undelete files etc. One in-place repair tool,
diskette-based, that didn't boot when I tested it.


Maybe the DOS or Linux version on the diskette didn't boot - that doesn't
tell you much about the tool itself. The tool itself probably doesn't boot,
it needs to be started once the OS (DOS/Linux) runs.

--
Joep

On Mon, 30 Aug 2004 20:35:44 UTC, "cquirke (MVP Win9x)"
wrote:


I'd settle for an equivalent of Norton DiskEdit, i.e. show me the
structures, document them, let me scribble.

Still looking...

In that case you might want to check out my DFSee tool:

http://www.dfsee.com/dfsee.htm

That will display many filestructures (including most NTFS stuff)
is a readable (decoded) format, or when needed as HEX dumps.

Apart from displaying, it has lots of specific 'fix' commands to
repair 'common' problems like damaged bootsectors
or partition-table problems.

It also has file copy/recover commands for undeleting
and saving data from damaged filesystems.

The program is NOT free, but it is not that expensive either.

You can download the evaluation version and play with that
for a month or so to see what it can do.

There is a Windows (console, NT/W2K/XP only), plus a DOS
and an OS2 version in the same package, and a native Linux
one will be added to the package shortly ...

Regards, JvW

--
Jan van Wijk; Author of DFSee: http://www.dfsee.com

Jan van Wijk wrote:

snip

The program is NOT free, but it is not that expensive either.

You can download the evaluation version and play with that
for a month or so to see what it can do.

Top man - you could never know what it means to be able to test software
properly.

Programs that supposedly let you "see" what they could deliver with the
full version suck.


Odie
--

RetroData
Data Recovery Experts
www.retrodata.co.uk

Hi,

The current state of NTFS recovery software (I.E. supplied with the O.S.)
appears to me to violate "The Goal of Trustworthy Computing", Reliability:
The customer can depend on the product to fulfill its functions.

There appears to be a dichotomy in the handling of file system errors.

CHKDSK will run or CHKDSK will not run is the dividing point.

If CHKDSK will run, it does its work and repairs the file system with
minimal reporting. The decision apparently has been made to have it do its
work now behind a blank screen during the boot process. Thus it has passed
into to the realm of programs that to weekend computer warriors will always
succeed as it is started and runs without input from the user.

As the years have gone by, less and less information on what it has done is
being reported. This has been mirrored by Norton, appearing to long term
Norton users that they are getting less and less for their money.

If CHKDSK will not run, then there is no path to recover. That is the
violation.

Persons who are trying to protect their rice bowl think this is just fine
and apparently are stifling any improvement in documentation, reporting of
what is wrong and actually doing the repair.

To those who say that the only method of repair if CHKDSK will not run is to
hire a person who has many years of experience and makes a living doing data
recovery just adds to the dichotomy. CHKDSK is trusted (and Norton) to
repair the file system all by its self for the second case.

That it cannot be trusted for the first case is a false position. The rules
for discovering what is wrong and what to do to repair the file system can
be included in the CHKDSK program and need not as data recovery persons say,
be kept only in the human brain. The rules for finding what is wrong when
CHKDSK will run were transferred from the human brain, why not the rules for
when it will not run.

Repair in place I have stated is the only viable solution for gargantuan
sized external hard drives that cannot be backed up currently. Until sugar
cubes holding more data bits than grains of sand in the universe are
perfected, this will be the case.

It may be useful to keep copies of various data structures to aid in the
recovery by CHKDSK., that is what I wish to do now but my list is incomplete
I suspect.

The argument that confusing and intimidating information must not be shown
to the users is an strong argument towards eliminating the dichotomy and
doing the job without the user being involved.

Furthermore, keeping information from all persons because some may not
understand is elitist and should not be condoned.

The recording of what CHKDSK has done behind the blank screen when booting
is being done is perhaps a model of presenting the information to persons
who can understand it and not showing it to others.

-----------------------------------------

What will follow now I suspect will be a massive attempt by persons wishing
to stop their rice bowls from being broken.

I am not saying that they do not provide a useful, needed and valuable
service.

Stephen H. Fischer


Joep wrote:
"Stephen H. Fischer" wrote in message
news:sqzYc.2547
The loss of everything is perhaps more likely to happen with hard drives
connected with FireWire or USB.


Loss of everything is often caused by partition table or boot sector
corruption. This can happen on any disk, not only FireWire or USB.
Partition table and boot sector damage can often be fixed in place in a
relatively safe manner. I recommend not to attempt to fix data loss
caused by anything beyond partition table / boot sector damage. By doing
so you often enter the path of no return. Although software exists that
claims to be able to undo for example reformats of NTFS drives, I have
found this software to be very unreliable and dangerous. 'Repairs' could
not be undone.


What was so disappointing with most (or all) of the NTFS recovery
software I looked at was they all were just trying to recover your data.


And there's good reason for that.

None provided any help to really understand what had gone wrong thus
making the repeating of the failure likely to occur.


Data recovery software is written with the intent to recover data, not to
lecture you on file system structures. The strength of data recovery
software is often the ability to ignore errors and rebuild a virtual file
system structure regardless present errors. This virtual file system is
often simplified - it holds just enough info to copy lost data, it's not
enough to actually repair a file system in place.

Although I have seen chkdsk bring back lost data (on a clone), in a data
loss scenario chkdsk should be avoided as long as no sector by sector
clone is avalable.

With the number of years NTFS has been around, I was disheartened by the
low quality of documentation and the absence of recovery programs that
look at the MBR, the Partition table, the NTFS Boot sectors and the MFT
and report on possible problems. Just presenting all the information
arranged on one screen would be a step up.


For 9 out of 10 users (but probably more) this info would only be
confusing and intimidating. BTW, there are plenty of tools that look at
the partition tables and boot sectors and repair those if possible.

So much of the non $$$$$$ recovery programs and those supplied with XP
and the various Resource kits just convert the naked bits to hex and
build a display or printout list that only a person who has been working
for years could look at and understand what is wrong.

And yet you are still suprised that people who have spent all that time
looking at all the naked Hex don't give away their software for free?

"Stephen H. Fischer" wrote in message
news
Hi,

The current state of NTFS recovery software (I.E. supplied with the O.S.)
appears to me to violate "The Goal of Trustworthy Computing",

I think this is a far fetched point. I don't understand how my car works in
great detail, still I trust it. Also it appears to me, the main focus of
"Trustworthy Computing" is privacy: I don't want my information to become
available to others without my approval. And beside that, I don't appreciate
it that much, IMO it's mainly marketing.

Reliability:
The customer can depend on the product to fulfill its functions.


Wake up call: There is no softeware in the world that will under all
circumstances deliver what it is intended for. This can be due to software
bugs or external factors. Chkdsk's main purpose is file system consistency
and integrity, not data recovery per se. File system structures can simply
be beyond repair.

There appears to be a dichotomy in the handling of file system errors.

CHKDSK will run or CHKDSK will not run is the dividing point.

If CHKDSK will run, it does its work and repairs the file system with
minimal reporting.

You're making a mistake. The fact that chkdsk runs does not mean by
defintion it delivers and actually will repair the file system. In a data
loss scenario chkdsk may be the last thing you want ...

The decision apparently has been made to have it do its
work now behind a blank screen during the boot process.

If you want you can see chkdsk run and you can also learn what it actually
does. Just search the MS KB.

Thus it has passed
into to the realm of programs that to weekend computer warriors will
always
succeed as it is started and runs without input from the user.


To weekend computer warriors (who ever they are) software will always
succeed. Unfortunely this is not the case.

As the years have gone by, less and less information on what it has done
is
being reported. This has been mirrored by Norton,

Many weekend PC warriors actually prefer this. Many people are actually able
to use a PC because it's complexity is hidden from them. Many people say,
spare me the techno babble, I don't care how you do it, just do it. And they
want it to be as easy as possible. And this is normal, we all probably use
many machines, devices and techniques all day we do not have a very deep
understanding of, of how they work.

appearing to long term
Norton users that they are getting less and less for their money.


The problem with Norton is that they make you pay for non substantial
upgrades, but that is a different matter. Besides that, millions don't seem
to care as they happily upgrade every year.

If CHKDSK will not run, then there is no path to recover.

Yes there is ...

That is the
violation.


Untrue. In every simple PC magazine, in every manual it is repeated over and
over again to make backups. So no one can claim he wasn't warned that
something may go wrong.

Persons who are trying to protect their rice bowl think this is just fine
and apparently are stifling any improvement in documentation, reporting of
what is wrong and actually doing the repair.


Bull. I have a Saab, if there's something wrong, the car's computer will
tell me there's "engine trouble" and advises me to take it to the garage. I
am fine with that, I don't want it to talk about parts being broken I don't
know what they do anyway. If I take in my car for repairs, I want it
repaired, I don't want to be lectured in car maintenance. So the mechanic
hooks up the car to a computer which will give much more info. I pay the guy
for the service to interpret the info and do something about it. I can not
be knowledgable on every possible subject.

If I do want to know about car maintenance, I buy a book or do a course on
the subject. If I study the subject enough I can fix other peoples cars and
get payed for that or maybe even create tools allowing other to fix their
own car.

So if you insist of fixing your NTFS trouble yourself; happy reading!

To those who say that the only method of repair if CHKDSK will not run is
to
hire a person who has many years of experience and makes a living doing
data
recovery just adds to the dichotomy.

You can be stuborn, but that won't change the truth. Some scenarios require
extensive knowledge. See car example.

CHKDSK is trusted (and Norton) to
repair the file system all by its self for the second case.


I don't trust them to that. In data loss scenarios I'd even be against
running any of those 2.

That it cannot be trusted for the first case is a false position. The
rules
for discovering what is wrong and what to do to repair the file system can
be included in the CHKDSK program and need not as data recovery persons
say,
be kept only in the human brain.

There are books on NTFS and there is extensive open source and free NTFS
documentation available (http://linux-ntfs.sourceforge.net/ntfs/). Still,
many rather pay someone who studied that documentation and provides software
based on the knowledge.

The rules for finding what is wrong when
CHKDSK will run were transferred from the human brain, why not the rules
for
when it will not run.


It did tell why it didn't run: "Unable to determine Volume Version and
State".

Repair in place I have stated is the only viable solution for gargantuan
sized external hard drives that cannot be backed up currently.

Any disk can be backed up, just buy a same size disk.


It may be useful to keep copies of various data structures to aid in the
recovery by CHKDSK., that is what I wish to do now but my list is
incomplete
I suspect.


Tools you referred to (Norton) do keep copies of some structures, though
they may simply not be enough. NTFS itself keeps copies of some structures.
Don't you understand? Anything man made can be broken. And some things
simply can not be fixed or forseen. To increase your chances keep copies of
all structures and data, it's called a backup.


The argument that confusing and intimidating information must not be shown
to the users is an strong argument towards eliminating the dichotomy and
doing the job without the user being involved.


Nonsense. For years end users have asked to hide the techno babble - Linux
will grow as soon as they start to understand that. Those interested in the
techno side of stuff can do so. Try Linux. BTW, XP comes with loads of
command line tools that allow you to configure chkdsk and every thing else
you can't do from behind a nice GUI.

In Linux, everything is open source. It is however a misconception that all
people will know be able to understand how everything works. There's simply
too much info, plus many people don't even care.

Furthermore, keeping information from all persons because some may not
understand is elitist and should not be condoned.


Nothing to do with elite. It sounds good though, but it is a statement and
not a valid argument.

-----------------------------------------

What will follow now I suspect will be a massive attempt by persons
wishing
to stop their rice bowls from being broken.


Well, I do not feel like attempting to do *that* at all. I am not afraid of
that all. It's really easy to make statements like your last statement; to
anyone responding you can now say: "you see, told you so! He's trying to
protect his rice bowl, no matter what he says".

--
Joep

Hi Odie,

On Tue, 31 Aug 2004 15:12:38 UTC, Odie Ferrous
wrote:

The program is NOT free, but it is not that expensive either.

You can download the evaluation version and play with that
for a month or so to see what it can do.

Top man - you could never know what it means to be able to test software
properly.

Oh, I surely do.
I have been doing that professionally for over a decade :-)


Programs that supposedly let you "see" what they could deliver with the
full version suck.

I agree, so the DFSee evaluation version delivers everything the full
version will.

The evaluation version for my software is EXACTLY the same as the
'full" version.
The only difference is the right to use it for anything else than
evaluation ...

There is a timeout on un-registred versions (60 days from release),
but if you need further evaluation, simply download the latest ...
There is a new (minor) release almost once a month ...

The registration you pay for DFSee is NOT really for the software
itself,
it is simply for the right to use it legally and even more important
to receive support and help on using it ...

Regards, JvW

--
Jan van Wijk; Author of DFSee: http://www.dfsee.com