Data Recovery Service, Information Security and Information Forensic Articles.

Archive for the ‘Data Recovery Software’ Category

How to repair file demage by Virus (Kspoold)

Monday, February 22nd, 2010

Anyone heard about Kspoold virus?. The virus is changing files *. doc and *. xls to be *. exe file. In addition, this virus also damaged dbf database files namely MDF and LDF. This virus became a celebrity in the world in 2007, rivaling the popularity of the famous eagle virus last year. Because of this virus I lost a lot of files and makes my head dizzy. :)

To recovery Microsoft Word and Excel file with exe extension can be done with some of these applications are:

1. Doc / xls recover obtainable from http://adilmakmur.wordpress.com/2007/05/25/doc-xls-recover/

2. Exe 2 Doc that can be obtained from http://www.ahlul.web.id/download/kespo

3. PCMAV RC19 Cleaner which can be obtained from the DVD / CD Media Magazine PC or can be downloaded from the routine www.maseko.com uploading this anivirus each month.

4. Gucup Antivirus can be obtained from http://www.softpedia.com/get/Antivirus/GAV.shtml

5. Ansav which can be downloaded at www.ansav.com

6. Yayat Antivirus which can be obtained from www.chanal.biz or from www. vaksin.com / removal.htm

7. The bundled applications in Power Remover can be downloaded at www.donixsoftware.web.id

8. Recover my files which can be found at www.ebsoft.web.id

9. DocRecover from DarkXerion at www.geocities.com / darkxerion / docrestore.zip

and many other applications.

Compared to how to recover doc or xls, recover dbf file is much more complex. The result take long time since the emergence of Kspoold, there has been no application to restore damaged dbf yag. Fortunately, there is an interesting article in the http://vaksin.com/2007/0707/kespo-dbf.htm the contents is a way to restore the dbf from Kspoold. The snippet of the article is as follows:


Steps to recover a damaged DBF files by virus Kspoold (Contributions Bp. Ismuddin, a veteran dbf Indonesia). Damage to data caused by viruses Kspoold is changing the header from DBF extension files (If you reply dbf data files had been changed the extensions are not being attacked). Because the header of each dbf file is not the same size, it depends on the number of fields, so for a number of files fieldnya slightly, the virus can attack the record. I noticed this because the author is deliberate in order not to change the file size. “

To fix header damaged dbf file can be done with the help utility UltraEdit which can be downloaded trial version at: http://www.tucows.com/preview/194610

Step by step to repair dbf corrupt file;

1. Open the damaged dbf file with UltraEdit.

2. Open the file that was still good with the same structure with the damaged file, or create a new file with the same structure of damaged files.

3. Block header clean data from the header line with the record until the beginning of the file, right click select copy.

4. Header block corrupted data from the boundary between the header with a record until the beginning of the file, right click select paste.

5. Save the damaged data at this go to Menu, Select File and then Save. The first phase of the data repair is complete, the results can still be read by VFP, because the number of records recorded on the damaged data is not the same as that in the Copy.

6. The next improvement I use a tool that serves to improve dbf file header is not reply severe damage with Table Repair Utility (Program Attached).

7. Click Select File, locate the file saved by UltraEdit.

8. Click the Change button in the line of Record

9. Click the button Change the file size in line

10. If your reply File Recover has a Memo field while his memo file is not available, change the flag to be Has Table CDX File, then click Change.

11. Click Open File … to open a file that is in the recover, at the bottom there are records of garbage, throw it .. ! Corrupted data can be saved. Here is my program also included for repairs after running the second phase UltraEdit-Fix dbf.zip (REPAIR.EXE and MODULS.EXE) which can be downloaded at www.vaksin.com / files / fix-dbf.zip.

Tags: ,

Data Recovery Software Reviews and Comparison

Sunday, February 21st, 2010

Keep in mind, Your data is priceless! Sometime it cost million of Dollar, don’t use any cheap software if you have a very expensive data, let the professional done it to you. When you done your self with the wrong way, your data will lost forever.

Data Recovery Software Comparison will discuss base on Interface contrast, scanning speed, Information display, recovery time and resource used;

a. User interface

1. FinalRecovery

As an outstanding data recovery software, FinalRecovery the main interface has been designed to be eye-catching. All features are in an orderly manner, integrating the four buttons in the operation very smoothly together. And its “IDE hard drives health diagnosis” feature is also a similar software, a technology rare. Can be adjusted very easily get to the hard disk SMART data to help us early to judge the performance of the hard disk may be hidden.

2. EasyRecovery

And compared to similar software, EasyRecovery the main interface, rather some nobility of the gas. The interface has been around roughly be divided into two parts, namely, the software displays the main categories and subcategories. The wizard-style operating philosophy was perfectly used in every corner of the software. Let the novice and fields and then, can also easily get to.

3. FinalData7

In contrast, FinalData the main interface, the number of looked shabby some of it. The classification of the window is not pretty, nor easy recovery wizard, but these have not prevented it, and become the most professional one of the data recovery software. At the interface area, FinalData completely draw everyone familiar Explorer style. All features, can be found at the top of the main toolbar. And this design, although there is no feature at all. But flexible manipulation of the performance, but it is hard to match for other software.

4. Recovery 4 All

Although, Recovery 4 All of the interface style, with the FinalData is very similar. However, the absence of the main toolbar, therefore, in terms of ease of use, or to be less certain. But, compared to similar software, Recovery 4 All of the volume, but it definitely can be considered as the smallest one. This allows us to put it, easily installed in the U disk of carry.

2, scanning speed and the number of

In the data recovery, scan is an essential step. It is only through scanning, to find traces of deleted files in order to finally complete the restoration. The tests in this section, we will use to restore software for a “quick scan” and “full scan” mode, for a FAT32-formatted hard disk partition, for testing. And thus the data recorded sections of the software, scanning speed and scan results.

Note: The cases of the “scan results” are to restore the software at all “full scan” on the basis of access. Taking into account the measurement of different software in different ways, so the “restore volume” column shows the actual recovery was all the recoverable files, use the Resource Manager summary values.

b. Recovery

c. information display and search

After a lengthy scan, the software will often give us a long list of results listed in a string. In these results, how can you quickly find what we need documents? Clearly, software, information display and search capabilities is strong, it has become a decisive factor. So, in this part of the test, in the end who can jump out in front then?

1. FinalRecovery

FinalRecovery the information that a more comprehensive, in addition to common file name, extension, file size, creation time, there are file type, the current status (deleted files or regular file) and some other auxiliary information. In this interface, we can just work area will be the lower right corner, switch to the “Find” tab, will be able to immediately conduct a file search operation. In this interface, users can easily through the “File name”, “Date Created”, “modified date”, “date of the visit”, “document size” of these four parameters to find out. But the trouble is that a bit, where the search, you must use the full name of the file (that is, you must use the “File Name + Extension” format), does not support we are more familiar with the fuzzy lookup.

  1. EasyRecovery

    In contrast, EasyRecovery message that the less a “file type.” Although the majority of fields and then they can be an extension, informed of this property. But the lack of Chinese language tips, as well as the direct use of English instead of the “conditions” column (equivalent to FinalRecovery in the “File status”), but new users will just get started and bring a lot of trouble. And FinalRecovery like, EasyRecovery also can use the “filter” (or “search” function), locate the target file. Although, in this software, we still can not achieve the convenience of fuzzy-type search (must be through “the file name + extension” of the format). But through the menu, but they can directly filter out a certain type of file (such as the “Office Files”, “web document”, “Image File”, etc.), thus greatly reducing the user’s search intensity.

    3. FinalData

    In this part of the test, FinalData finally demonstrated their professional demeanor. Can be seen from the chart, in the information display area, FinalData the display of the most comprehensive. Not only all of the information used in all Chinese language tips, and the status of the file identification is also very detailed. However, even more excited about is that in the eligible, four recovery software, only FinalData using fuzzy-style query mechanism. In other words, when we want to search for a file, simply fill in the search box part of the file name (for example, to find “the WCB. Doc” file, just type “water” or “the WCB”), on the be able to quickly find the file.

    4. Recovery 4 All

    And compared to similar software, Recovery 4 All the biggest bright spot is the file “to restore the probability” of the show. With other software, it will only identify the different obscure technical terms. Recovery 4 All files are automatically according to the level of coverage, calculate the probability of recoverability, and then in the form of a percentage to submit to the user. In this feature’s help, we not only have to worry about whether the data out of a full recovery, but also greatly reduces the previous work useless. But does not support file search for this shortcoming, it has become the biggest mistake of the software.

d. Recovery time and documents with the availability.

Scan the document does not mean that can be successfully resumed. In fact, as the data source, a lot of files to restore them, are not normally open. Well, today, we will temporarily remove through the restoration of a group of files, to verify what the capacity of the software in this area.

5, sub function comparison

In addition to the direct deletion of the most common addition, in real life, there are many kinds of data loss mode. Such as hard disk accidentally formatted removable storage device data is lost, has been restored file does not open and so on. Therefore, most data recovery software will contain a number of subsidiary functions. Here, we were a subsidiary of the sections of the software capabilities to carry out some comparison.

e. resource occupation

After reading a feature comparison, let us look at the sections of the software at different stages of the resource occupancy bar. To minimize testing errors, for each parameter measurement data will be tested three times, and to three times, on average, included in the following table.

Summary

from the test results can be seen, Recovery 4 All in the full scan, takes the longest. But the ultimate amount and recoverable volume scanning, but also four Cenping one of the highest software. The FinalRecovery and EasyRecovery in this test, indulge in moderation, in addition to have a good scanning speed, the search results are sufficient to meet daily needs. But what is surprising is that had previously acclaimed FinalData, both in quantity and scan the whole area to use when you have nothing good performance. Arising from such an outcome, that there are some eye-popping.

Note: Because a lot of file deletion, will also leave traces of multiple locations in the system. Therefore, the scan results are only for reference, not as a judge to restore the authority of good and bad elements of the software.

Tags:

How to Recover Data from Unreadable CD DVD

Saturday, December 5th, 2009

I have seen so many ways how to recover data from scratches CD or DVC, some people say you can use banana then apply it to CD surface, the other say you can use peanut butter with coke also, I saw it in YouTube.  I think it will work great to minimize the CD/DVD surface scratches. But if there is other way by using Recover Disk software.

 Here is a show you step by step how to recover your data from Recovers data from;

  • scratched and damaged CD/DVD,
  • Recovers data from incorrectly burned CD/DVD
  • Retrieves data from all sessions on multi-session discs

 

 

Step 1: Insert a CD/DVD Disc and Analyze It

Recover Disc starts reading the content of inserted CD/DVD disc immediately after you run the program. It will take some time to read and analyze disc content. Then the program displays folder tree in the left pane of the window. You can browse the content of any folder right like you do in the Windows Explorer.

  dis1

 

If you insert a disc when the program is already running or change discs in the CD/DVD reading device, then you should click the “Refresh” button on the toolbar to start reading the inserted disc.

 

If there are several CD/DVD reading devices on your computer, you can switch between them using combo-box at the top of the left pane.

 

 

Step 2: Find Required Files on the Disc

You can browse the content of your CD/DVD right like you do in the Windows Explorer. When you select a folder in the left pane, you see its content in the right pane. Now you can select files and folders that you want to recover and get to the next step.

 dis2

 

If you do not see required files on the disc, it may be that they were recorded in previous sessions and were not included in the TOC (table of contents) of the last session on the disc. Sometimes this happens on multisession discs either intentionally or by mistake. Recover Disc allows viewing such files in a special Expert View mode. This mode shows the full disc structure with all recorded sessions and tracks. Click the “Expert View” button  on the toolbar to switch to the Expert View mode.

Now you can see all sessions recorded on the CD/DVD disc. You can browse the content of each session separately to find the required files.

 

Step 3: Extract Files from the Disc

After you select files and folders that you want to recover, click the “Extract” button  on the toolbar. The “Extract” dialog will be displayed.

 dis3

  

Output folder: Here you select a folder where you want to save the recovered files or folders.

 

Restore folder structure: If you check this option, the full branch of the folders tree containing selected files and folders will be recovered to the output folder.

 

If some disc appears to be partially unreadable with Recover Disc on your computer, you can try to extract all available data from the disc and then read that disc on another system or with different CD/DVD reading device. The program allows reading a part of a file on one device and a part of the same file on another device. When you extract a file from a disc and some problem areas cannot be properly read, the corresponding places in the extracted file are left blank (filled with zeroes). When you later try to extract the same file, the program reads only the blocks that were not extracted before and merges them with the previously extracted data.

 

The following options let you specify what to do when the program finds file with the same name in the output folder.

 

Merge: The program will merge the file being extracted with the existing one. Use this option to merge the newly extracted content with the previously saved data.

Overwrite: The program will overwrite the existing file with a newly extracted one.

Skip: The program will skip such files.

Ask: Each time the program finds a file that already exists in the output folder, it will ask you what to do. You will see the following dialog.

 

Select either “Overwrite”, “Merge” or “Skip”.

 You can check the “Apply to all” option if you want to apply the chosen action to other files as well. Then the program will perform the specified action automatically without asking you each time.

After you specify all options in the “Extract” dialog, click “OK” to start the extraction process.

 If there are several sessions on your disc containing a file being extracted, you will see the following dialog.

   

Here you should choose a file version that you want to extract – select a desired session in the displayed list and click “Extract”.

 You can check the “Choose this session automatically for remaining files” option if you want to use this session for other files as well.

 

For each of the files being extracted you can see the progress of extraction.

 

Settings: This button shows/hides program settings. You can change these settings during the extraction of files. Changes are automatically applied and saved.

 

Skip file: Click this button if you want to skip the extraction of the current file. You will see a dialog where you should confirm or cancel the operation. If you skip the file, the program will continue extracting other files from the disc.

 

Stop: Click this button if you want to stop the extraction process. You will see a dialog where you should confirm or cancel the operation.

 

If a file is partially extracted and you click the “Skip file” or “Stop” button, the program will ask you whether to delete the partially extracted file or not. Select “Yes” to delete it or “No” to save the partially extracted file in the output folder.

 

It may be that your file contains unreadable blocks. Read here how to handle this situation most efficiently.

 

  

Step 4: How to Deal with Bad Blocks

If your CD/DVD disc is scratched or damaged, then most probably it contains unreadable blocks and some of your files can be fully or partially unreadable. If the program is unable to read some block during the extraction, it will try to read that block again until either the block is successfully read or the number of retries reaches the maximum value of read retries specified in program settings.

 

You can change these settings during the extraction of files. They are displayed at the bottom of the extraction dialog.

 

 dis4

 

To change the maximum number of read retries, move the pointer to the left or to the right. If the number of read retries for some block reaches this value and the program is still unable to read it, the block is marked unreadable.

 

You can also specify what to do when such block is found. The program can either show a prompt message asking you what to do further, or automatically fill that block with zeroes.

 

Show prompt message: If you select this option, the program will show a prompt message asking you what to do after a block is found to be unreadable: either to continue the attempts to read that block, or to fill it with zeroes.

 Automatically fill it with zeroes and continue: After unreadable block is found, the program will automatically fill it with zeroes and continue reading the file.

The prompt message (for the “Show prompt message” option) is shown below.

 

Retry again: If you select this option, the program will retry reading that block until either it is successfully read or the number of retries reaches the maximum value of read retries.

 Skip block and fill it with zeroes: If you select this option, the program will skip the unreadable block and fill it with zeroes.

Skip all unreadable blocks: If you check this option, the program will automatically skip all unreadable blocks without showing the prompt message again.

Unreadable blocks are marked with red on the progress bar during the extraction process. Healthy blocks are shown in green. Light green and light red colors on the progress bar are used to mark areas that have been already read before during the previous recovery attempt.

 

When the extraction is finished, you will see the following message:

 Finally let us resume what you can do to extract a corrupted file from a CD/DVD disc.

 Try to extract a desired file. If the program is unable to read some blocks, you can retry reading them.

 If the attempts to read the block are unsuccessful, choose the option to skip that block (fill it with zeroes). The corresponding part of extracted file in the output folder will be filled with zeroes.

 When a file is partially extracted on one CD/DVD reading device, you can try to read it on another system or with a different CD/DVD reading device and merge extracted parts of the same file.

 In addition you can try to physically wipe or polish your CD/DVD disc and then continue reading the problem file. But before doing that you should extract all the other data from your disc to avoid damaging it.

 

Viewing the results of data recovery

After the extraction process is finished, you can view the results of data recovery. Select any folder in the left pane and you will see its content in the right pane.

  dis5

 

For each extracted file you can see the status of extraction in the “Status” column. Green color indicates the successful extraction, while red parts correspond to unreadable blocks.

Tags:

Consideration Before you Buy Data Recovery Software

Tuesday, November 10th, 2009

Before you purchase a software package off the shelf at your local computer store to try to rescue your drive, know what to look for. There are six important issues to understand with regard to drive-checking and/or data-recovery software:

It must work from a floppy. If you buy a hard drive repair or recovery program that principally works from the hard drive itself (meaning, you have to install and run it from the problem hard drive), you may be stuck up the proverbial creek if you can’t access the hard drive enough to run the software. You need to get software that will run in emergency mode from a floppy disk. Make sure to add this disk to your PC Recovery Resource Kit.

You must be able to undo the changes it makes. Some of the best drive-checking and data-recovery software includes a feature that allows you to undo changes it may make as part of the recovery process. This is useful because you may discover later that the changes may not have corrected a problem and you need a way to undo them. Check the documentation carefully before using it to make sure you can reverse the changes.

It must support your version of Windows and your file system. Make sure the software you choose is compatible with your version of Windows and that it supports your file system type. Your file system type is probably FAT32, although some drives use FAT16 or the NTFS format available in Windows NT and XP.

It shouldn’t write to the problem drive. You have a problem if you use software that works by writing “recovered” files back to the drive you’re trying to salvage. Most good utilities only read from the problem drive; they write any recovery files to another drive or media type such as a floppy.

Use the software as directed. You generally can’t pick and choose what functions the software performs because there are set procedures it must follow to do its work. Read the documentation and follow the instructions carefully.

Make sure you understand what it can and can’t fix. The type of drive-recovery software you can either download as shareware or purchase off the shelf in your local computer store isn’t designed to salvage files off a physically damaged drive. For that, you need a drive-recovery service that uses sophisticated electronics and special tools to retrieve data, and their success rate can differ from drive condition to drive condition.

Warning If after reading the documentation and the web site supporting the product, you still can’t figure out how to use the software, don’t use it. This is not a good area in which to guess.

Tags: ,

Hard disk Problem Troubleshooting

Tuesday, November 10th, 2009

Problem hard drives often announce their displeasure in the form of on-screen errors and warnings or through error codes you find when running your manufacturer’s drive diagnostic utility. Let’s look at the major drive-related error messages and learn how to use them to figure out what’s wrong.

On-Screen Errors Related to Hard disk problem

Hard drive error messages and warnings usually appear when you first try to start the PC and after a brief wait (while the system tries in vain to access the drive), an error appears on the screen before Windows would load normally. Sometimes such messages appear as you work in Windows itself and usually, when you’re trying to read from or write to the affected drive.

Errors Indicating a Problem with the Data or Drive

The following messages often indicate either physical damage to the drive or corruption of the data or file system on the drive:

Data Error Reading Drive <drive-letter>
Error Reading Drive <drive-letter>
I/O Error
Seek Error/Sector Not Found
Serious Disk Error Writing Drive <drive-letter>

With these errors, try to check the disk for errors if you can keep the PC working. For this, use ScanDisk or CHKDSK. If either ScanDisk or CHKDSK reports errors they can’t fix or mentions possible physical damage to the drive, immediately make your best attempt to back up the data on the drive. Then contact your hard drive manufacturer, try data-recovery software, or consult a data-recovery specialist. In any event, replacement of the hard drive will probably be necessary.

You should be aware that it’s possible to see some or most of these errors and warnings without actual damage to the drive or its data. Certain temporary or easily fixed situations like a loose or failing data cable or short-term overheating can generate errors. For example, if I’m operating a hot-running PC in a very warm room without good PC cooling practices, I might see a seek or reading drive error message. If I’m smart, I’ll shut down my PC properly and let it cool down before I attempt to do more work; this temporary problem could turn to drive or data damage if I don’t.

Overclocking, a practice where you modify BIOS settings past their recommended operating levels to achieve better speed and performance, can produce these errors, too. Errors can be the direct result of excessive settings and the overheating that accompanies pushing hardware to its limits. If you overclock and then begin to see drive errors, consider this a distinct possibility and reverse the changes you made to see if the errors stop.

You may hear the term head crash referred to in relation to hard drive failures. A head crash is a specific type of hardware failure where the read/write heads of the drive, normally positioned carefully to move over but not touch the drive’s platters, instead come into contact with the surface, damaging the platter and the data it contains. The result may leave you temporarily able to open files (or not), but you’ll notice a great deal of noise coming from the drive (clicking, grinding, or strain). This is something you cannot repair

Working with a Drive Stuck in MS-DOS Compatibility Mode

In pre-Windows XP versions (95/98/Me), you’ll sometimes see hard drives running in what is called MS-DOS Compatibility Mode. This means that the drives have failed to clear the Windows’ startup evaluation for whether such drives can load and run properly.

Unfortunately, you won’t always see an on-screen error message about this, and you may not even discover it until you go looking. Instead, what you may notice is a deadly slow system, particularly with any operation that involves the hard drive.

However, when you choose Start Ø Settings Ø Control Panel Ø System Ø Performance tab, you’ll find the message

Compatibility Mode Paging reduces overall system performance

This problem may occur due to

  • Failure of the hard drive’s on-board controller. This requires drive replacement because today’s hard disk controllers are typically built into IDE/ATA hard drives.
  • A virus. Use anti-virus software to perform a full scan.
  • A hardware conflict between the hard drive controller and another piece of hardware, for example, both devices trying to use the same IRQ. Check Device Manager for a yellow exclamation mark (!) indicating a conflict, find what else it’s conflicting with, and rearrange them.
  • Something (you or software) has disabled the hard drive controller in Device Manager, where it appears as a red x. Click the x, try to enable the controller again, and investigate what you may have installed that caused this problem.

I’ve seen Compatibility Mode crop up frequently with older laptops where you have to swap in and out different drives such as a CD-ROM and floppy drive. In this case, shutting the laptop down and restarting it often makes Compatibility Mode disappear.

Manufacturer-Specific Error Codes

In addition to the kinds of error messages your BIOS at bootup and Windows during your session produce related to hard drive problems, you may find that your drive manufacturer has a list of error codes their drives might report. Such messages are either generated by or only seen within the drive-management software that comes with some hard drives.

For example, Western Digital hard drives typically come with Data Lifeguard software that can report various errors, many of which mean “replace the drive if you get this error.” There is even an online version of the Data Lifeguard software to test your drive through your Internet connection and browser while connected to their site (http://support.wdc.com/dlg/onlinedlg.asp).

Many hard drive manufacturers do not accept a hard drive for a return or repair without first running their diagnostics. Call the manufacturer first and ask for a return authorization. At this point, they usually ask for the error code. If they ask for the error code, they expect you to run the diagnostics. If you send in a drive without the error code, they’ll simply return the drive to you without testing.

Tags: , ,