Drive Recovery - RAW Hard Disk

A drive recovery will attempt to recover, if possible, all files on the drive with their complete file and folder structure.

Quick Start Tips

Don't panic, most deleted or missing data can be recovered;
Minimize the use of your computer until you have had the opportunity to try data recovery software;
Avoid writing any new data to the problem drive (or you may overwrite and destroy files that could otherwise have been recovered).

Try Before You Buy

Run Recover My Files in evaluation mode. If you can see your files (view the photos and read the documents) in the search results screen, then purchase an activation key to save them (you do not need to run a second search).

What is the best way to run Recover My Files?

Ensure that you install and run Recover My Files with full administrator rights. This is needed for low level disk access to recover your files.

A good methodology, if possible, is to connect the problem drive to another computer as the secondary drive. This enables you to

install Recover My Fils on the C: drive of the 'good' computer, and
use it to scan the secondary 'problem' drive to recover your files.

This methodology make it far less likely that Windows, or you, will write new data to the drive.

Of course this methodology is not always practical, as you may well have lost your files from your current C: drive and have no alternative that to continue to use Windows on this drive. Recover My Files is a small program (approximately 10mb), so installation of the software onto the problem drive, whilst not recommended, is a small risk.

If you see your files - Save Them!

It may sound silly, but when attempting to recover data, if you get to the position where you can see your missing files in the Recover My Files preview window - save them! Don't mess about trying lots of different options or ideas, or put off the saving to another day. Once the files are recovered and you have a nice secure copy of these files on another drive, then you can experiment all you want.

The "Recover Drive" options is best used when:

a drive has been formatted;
a drive has been formatted and windows has been reinstalled;
a Windows recovery or system restore has resulted in a fresh installation of Windows and the previous user created files are missing;
a drive letter has gone missing;
the drive is recognized by your PC as RAW and not files can be read;
or some other problem has effected the entire contents of the drive.

To recover a drive, click the "Recover Drive" button then "Next" to proceed. (Note: If your data loss problem relates to the deletion of individual files, select instead try the "Files Recovery" option).

A RAW or Unallocated hard drive is one which does not contain a recognized partition and therefore will not show up as a drive letter on your computer. This is usually because your existing partition has become corrupt and is no longer recognized by the operating system. Common causes are malicious virus infection, or a system crash.

The term RAW means "not having undergone processes of preparing, dressing, finishing, refining, or manufacture", which describes how hard disk were once sent from the factory, without a partition. RAW and Unallocated are the terms used in Windows Disk Management (right click on My Computer > Manage > Disk Management) to describe the state of the drive:

RAW and Unallocated hard drives are relatively simple to recover as it is usually only the partition information that has become corrupt and the remaining data is intact. Recovery of full file and folder structure is possible.

Selecting the Drive to Search

When running a "Recover Drive" it is usually best to select and search the entire "Hard Disk" (learn when to select the drive letter).

Select "Hard Disk #" by clicking it with your mouse (as shown in blue below), then press "Next".

+ Drive Selection: Learn more about the information displayed in the drive selection window.

The drive selection window displays the following information:

· logical drive letter, e.g. "C:"

· the drive label (if no label has been give it will display "{no label}"

· the size of the drive, eg. 453.99 GB (note that the actual size of the drive is usually smaller than what the drive is labelled. Drive manufactures usually round up the drive capacity, so a 453.99 GB drive may be marketed as a 500GB).

· the format of the drive, e.g.

§ NTFS

§ FAT

· describes the way in which the drive is connected to the computer

§ SCSI - Small Computer System Interface, is a set of standards for physically connecting and transferring data between computers and storage devices

§ ATA - an interface standard for the connection of storage devices such as hard disk and CD-ROM in computers. Includes Parallel ATA (PATA) and Serial ATA (SATA)

§ 1394 - The IEEE 1394 interface (commonly referred to as FireWire) is a standard for high-speed communications used commonly for digital audio of multimedia drives

§ SSA - Serial Storage Architecture is a serial transport protocol used to attach drives to servers.

§ Fibre - Optic Fibre connection

§ USB - USB connection

§ RAID Types

o JBoD

o RAID 0

o RAID 5

· describes the means by which the drive is being accessed

§ S - SCSI Pass Through Interface

§ W - Windows

§ F - File

§ T - TCPIP

§ M - Mixture of the above types

Options in the drive selection window include:

This button is used in for RAID recovery. Learn more here.

This button is used to add image files to the drive selection list, including DD, EnCase, FTK, SafeBack, AFF (Recover My Files Professional only).

This button refreshes the list of available drives to search.

Check connections, is the drive alive?

Ensure the drive you are wanting to search is properly connected to your computer. Check all cables etc. Can you hear the drive spinning? If it is silent, or making and unusual noise, then it is likely that it is a physical hardware problem and you will need to contact a hardware data recovery service.

Does your computer know that a drive is connected? To find out, right click on

My Computer > Manage" > Disk Management

and you should see a "Disk X" that is the size of your problem drive. (Note: In the Windows Disk Management screen, "Disk0" is usually the physical drive on which your C:\ partition resides).

Is the file system damaged?

It is possible that your file system is damaged to the extent where you can no longer see your drive letter. Click the "Back" button to return to the search selection window and choose the "Recover Drive" option. Do you see the "Disk" listed (you should be able to identify it by it's displayed size). If the Disk is listed, continue with the Drive Recovery option.

Are you connecting directly to a digital camera?

Some digital cameras have a proprietary connection to your computer which Recover My Files cannot recognize as a drive letter. In this case you will need to use a digital camera card reader, an inexpensive device into which your digital camera memory card is inserted and then connected to your PC (usually via a USB connection).

Are you trying to connect to an iPod Touch, iPhone or similar device?

Some of these products have proprietary protection which prevents software from gaining access to the drive letters.

Drive Recovery - File type not in list

A Drive Recovery is targeted at the recovery of full Filesystem, with all files and folders. Selected files are used by Recover My Files as an aid to locating the Filesystem records.

If a specific file that you wish to recover is not in the list, it is of no consequence if you can select other files from the list that were also present on the problem drive.

Adding a File Type to Recover My Files

Adding a Lost File file type to Recover My Files requires a full understanding of the file structure. Some file structures are publicly documented, most are not. Depending on the file type, it can be a complex and time consuming task.

To request a file type to be added, contact technical support and provide as much information about the file type as possible, including the author web site and the version number of the program used to create the files (if applicable). Also send 3 sample files from your system. GetData will then advise if it is possible to add the file type and how long it will take.

Search Phase 1 - Partition Recovery

Phase 1 of the search attempts to locate and rebuild then entire lost partitions:

Partition recovery should take between 1 - 45 minutes to complete (depending on the size of the drive, the number of files that it contains and the speed of the computer / drive). Learn about steps within phase 1 - partition recovery.

If partitions are located and can be recovered, all of the missing folders and files structure will be displayed under "Folder" view at the end of Search Phase 1 (in order to find and display the full file and folder structure, it is necessary that the search be allowed to fully complete this phase).

A recovered partition is shown in "Folder" view of the results screen as:

Whilst the search is in progress, expand the recovered partition (using the '+') to determine if your missing files have been located. If they partition was found and you can click on your missing files and preview their content, STOP the search and save your files.

Learn more about the Drive Recovery search results screen here.

Search Phase 2 - Searching for File System records (FAT/XFAT/MFT) using selected file types

Once Phase 1 of the search is complete, Phase 2 of the search will automatically commence. Phase 2 uses the selected file types to help locate file system records on the drive.

The number of file system records found is displayed in the progress bar. Each Filesystem Record represents a file with its full file and folder name:

If you are in a hurry to recovery your data:

When the number of "Filesystem Records:" found reaches a high number (an average home computer has between 50,000 and 150,000 Filesystem records), stops increasing, and remains constant, it means the file system records located have been read. On your average home PC you should reach this point within 2 hours of searching. You can press the STOP button (note down the 'block' number that the search is up to in case you wish to recommence the search at a later time);

or, if time is not a concern to you, let the search run to the end.

Once you have stopped the search, or the search finishes, the search results will build and display in "Folder" view of the results screen as a "Virtual Partition". A virtual partition is displayed in the results screen as:

Expand the search results (using the '+') to determine if your missing files have been located.

Learn more about the Drive Recover search results screen here.