What does modern data recovery software lack?

[ReclaiMe]

Hi everybody.
We all know that there are many vendors developing data recovery software. This software is designed for the same kind of task and generally performs similarly. However, it is not a secret that most of you use several data recovery software rather than stick to a particular one. This is because one software is better for one task while the other for something else.

I'd like to poll your opinion about what modern data recovery software lacks. I made an approximate answer list; if you have something else in mind, feel free to post it. You can only choose one item from the list, so choose wisely.

 

[lcoughey]

I think this is tough to answer across the board...each program lacks different things. So, I just checked off integration with hardware imagers. But, even that is a little different than what I am thinking. It would be nice to bring up a file system on a drive that was cloned with DDI or with PC3K-DE, cross reference their sector map and be able to do the following:

- select all files based on condition of recoverability
- generate a file listing report of files, showing recoverability (in a HTML would be cool)

 

[Alt-RTT]

- select all files based on condition of recoverability
- generate a file listing report of files, showing recoverability (in a HTML would be cool)

I'd rather call that "possible recoverability", because even if there's no bad sectors inside a file, and all other file's properties look OK, still there's no guarantee that the file can be recovered successfully.

 

[Jared]

Makes sense to me. I think what Luke is suggesting is a system similar to what the Deepspar operations server does which can generate a file tree that can be displayed to the customer with a color coded probability of recovery. I'm not sure how it generates this list as I don't use it, but I'd assume it does some random scanning at different areas of media to see how many bad sectors it's hitting there. Even factors in the headmap and percentage of bad sectors on each platter, etc.

 

[Alt-RTT]

- select all files based on condition of recoverability

What criteria would you choose to decide that a file is recoverable?

 

[lcoughey]

- select all files based on condition of recoverability

What criteria would you choose to decide that a file is recoverable?

As R-Studio already seems to be identifying the files that have been fully imaged or not, I would say that you simply work with what you already have and just give us access to the field for filtering and searching.

 

[Alt-RTT]

I're thinking about this feature. But there are some file types (like text-based txt, html, sources, etc) that can be partially recovered even when some their sectors may be lost. What about them?

 

[lcoughey]

I're thinking about this feature. But there are some file types (like text-based txt, html, sources, etc) that can be partially recovered even when some their sectors may be lost. What about them?

I'm going with the assumption that the person who own R-Studio Tech and DeepSpar Imager with the network add-on must have a clue. I'm more interested in verifying that all the sectors of each file were read. If you want to throw in a header verification too, that would be nice. That said, DeepSpar classifies the files as follows (to the best of my knowledge):

Good - All sectors read with no errors& verifiable header
Medium - All sectors read, with some errors
Low - Most or all sectors aren't read
Unknown - All sectors read, unverifiable header (ie TXT) or 0MB file

But, it would just be nice to filter the directory tree to just files that are fully cloned and just recover them out to a destination drive, generate a file listing or just give the client the numbers:

Good files - 10,000 (43%)
Total files - 23,000

 

[HaQue]

you could implement a rudimentary background opener for each file type that this lends itself to. for example, there are multiple applications from many vendors that can open word docs. why not have a module that can open word docs without it opening graphically? See if there is an error such as when you try to open a .docx and Word pops a dialog box showing error... this could shade that filetree entry red, if no error, green. same with .txt, if an arbitrary number of non-ascii chars appear in a text file, it is possibly corrupt. some formats may be harder though if no way to detect successful opening. archives may be easier as each format usually has some error ID system.