Goondu DIY: Recovering data “lost” in a hard drive

Of all the things that can happen during Chinese New Year this week, I accidentally made the data on my network attached storage (NAS) device unreadable – and could easily have wiped out all the years of reports, financial statements and holiday pictures I’ve stored on those two 1TB drives.

After days of pulling hair out, I eventually salvaged everything. But the entire episode prompted me to ask if I was really as prepared as I thought if I had accidentally deleted my data or, in this case, plugged my drives into a new NAS without backing things up.

The answer lies in a series of software tools you can use at home, before really going to the pros in data recovery for help. Here are a few that I tried out while panicking through my attempt at rescuing my data.

Before we start, let’s remember to always back up important data, like your wedding day photos or your personal financial records.

A note to all small business owners like me – RAID – or mirroring your data on multiple hard drives on your NAS is not backup. You have to have more than one copy of your data on another DEVICE, not just another drive. That means even if your NAS dies, you have a portable drive somewhere with an up-to-date copy of the data.

Looking back, I don’t know what possessed me to plug two 1TB drives from an old QNap TS-209 II NAS into a new QNap TS-419P+ NAS. Perhaps it had to do with the retailer at the store confidently telling me that sure, I can just plug in the drives and they’d be recognised by another QNap NAS. Or perhaps I was overly confident about QNap.

Either way, I ended up with two 1TB drives that could not be recognised by the new NAS or the old one, when I tried plugging them back in. Not even with QNap’s Live CD, which boots up your PC with the company’s version of Linux, or when I plugged a drive into a Windows PC supporting the Linux EXT2/EXT3 file system, could I try to extract the data on the disks, which had not been formatted.

The reason: the disks had been re-partitioned by the new NAS during setup and the partition information for the portion of the disk containing the data could not be read by almost any other device.

1. iCare Recovery
The first tool I used, fearing the worst that the data on my drive cannot be read again, was iCare Recovery and the plan was to go “nuclear”. Heck, just read me the sectors on the drive and see what you can recover. That’s what this tool, iCare Recovery, does quite well in.

Like with other such demo versions, I could see some of my files with a test and I was super elated to be able to save a couple of them at least. I bought the software digitally for US$62.95 in my haste. Hey, having some data back is better than none. At this time, I had given up hope of folks from QNap replying (it was during Chinese New Year earlier this week, but they still haven’t replied today at the time of writing) or from help from its online forum.

So I went ahead and scanned one of the drives with iCare Recovery. It found loads of stuff, really too much in the end. These included long-ago deleted files when one of the drives was used in another computer. Now, that should tell you how scary things are – “delete” and “format” don’t really wipe data, not all of it anyway.

The main problem, though, was that iCare worked more or less in the assumption that this was a last gasp solution. It sorted things out according to the type of files it thinks the bits and bytes are. So, you get thousands of files, all renamed to something unrecognisable and ordered as, say, JPEG files or PDF documents.

At least with pictures, I could still run them in thumbnails, but I had to recognise ALL the hundreds of thousands of files individually. Worse, I had to open some of the files, like PDFs, to see what they were first. I gave up after an evening doing this. Getting a whole load of data in a mess was just slightly better than no data at all.

2. R-Studio
I looked to R-Studio, another application which took an even more detailed look at the hard disk and could return everything in the right directories with the right filenames.

I was suffering from tonsillitis during this time, and you can imagine, even with that, my mood lifted knowing I could get at least most of my data back. I clicked on the “buy” button immediately when I found that I could recover several files – like my yearly statements to the tax man – with R-Studio.

The bad news about R-Studio was that it took a lot of system memory to do the job. It would take my quad-core i7 CPU three hours to scan one disk, but worse, it would crash for lack of memory when trying to enumerate and list the many thousands of files in the drive. I stuck a spare 4GB RAM module into my existing 6GB machine to make 10GB but I still had problems showing all the files I wanted to recover.

It was frustrating being so close yet so far. The software would stop and do nothing for half an hour if I tried to list more than, say, 40 per cent of the files. It had detected an astonishing “17TB” of data – most of it including repetitive entries – from a 1TB drive and was trying to load that data in the PC’s memory because it doesn’t want to write to any of the disks to prevent more damage.

The downside: my machine was too slow to run R-Studio. Stopping the file listing halfway, I could get back perhaps 70- 80 per cent of the data but I was not sure they were the latest versions (several versions could have been detected when I stopped the process).

TestDisk
Finally, more in hope than expectation, I downloaded TestDisk, an excellent open-source recovery tool (free!) after reading the experiences of fellow QNap users in the forum. I hadn’t expected much from a small 3.3MB application after supposedly more sophisticated tools had not been the answer.

To my surprise, TestDisk even has a “GUI” that lets you avoid typing in commands by moving through the options available on a menu with your keyboard. It’s easy to use and guess what, it managed to find the lost partition on the disk “troubled” by the QNAp installation procedure.

This meant I could mount the drive and read the partition containing my data files and select them to be copied elsewhere. All I had to do was simply select the folders which I wanted to back up to an external drive and that’s all, 100 per cent of my data could be returned to what it was.

The only advice I’d have here is to hide the deleted files – otherwise you’d also copy over deleted files that include the annoying temporarily files that Microsoft Office generates when you have an open Word document, for example.

I’m just so glad that I managed to get the data out of the corrupted disks. Indeed, I learnt that there are many ways to get your data back. Unfortunately, instead of trying the least desperate measure, I panicked and went straight for the nuclear option and ended up spending unnecessary dollars.

Still, this somewhat illuminating episode also shows that you can sometimes save the data on your own drives, before deciding to send them to third-party companies. Okay, not everyone has Edison Chen-type photos but hey, it’s always better if you can solve things yourself, say, when you need the data over a long holiday, for example.

Share your own data recovery stories here and give others tips!