Comparison of NTFS/MFT recovery software?

There appear to be hundreds of software packages out there to restore
an NTFS partition with a corrupted MFT. Does anybody know of any
reviews with a feature comparison matrix?

What utilities do you recommend?

I recommend OnTrack's Recovery Software. Their software has saved me
many times even after a repartition/format (which actually doesn't
destroy any data but does make it difficult to get the data back without
specialized software).

Check it out at www.ontrack.com

----
Nathan McNulty


*no spam* wrote:
There appear to be hundreds of software packages out there to restore
an NTFS partition with a corrupted MFT. Does anybody know of any
reviews with a feature comparison matrix?

What utilities do you recommend?

In article ,
*no spam* wrote:
There appear to be hundreds of software packages out there to restore
an NTFS partition with a corrupted MFT. Does anybody know of any
reviews with a feature comparison matrix?

What utilities do you recommend?

If it's corrupted, why do you want to restore it ? Do you mean recover
or repair ? Can you point to one or two packages for example, I'm not
sure what you are referring to.

A google for "NTFS partition with a corrupted MFT" doesn't come up
with any obvious packages.

There's lots of good info in http://www.ntfs.com/.
Under recovery concepts the is nothing about corrupted MFT.

In my experience (many thousands of systems, from the first days of
NFTS file system (NT3.51?)) NTFS is a profoundly reliable file system.
About the only way to kill it is for the underlying hardware to die.
I know that some people with more experience have seen an ocasional
problem. It's vastly superior to FAT32, esp for very large disks.

Do you have a problem, or is this a hypothetical question ?


--
Al Dykes
-----------
adykes at p a n i x . c o m

Hi,


Al Dykes wrote:
In article ,
*no spam* wrote:
There appear to be hundreds of software packages out there to restore
an NTFS partition with a corrupted MFT. Does anybody know of any
reviews with a feature comparison matrix?

What utilities do you recommend?

If it's corrupted, why do you want to restore it ? Do you mean recover
or repair ? Can you point to one or two packages for example, I'm not
sure what you are referring to.

A google for "NTFS partition with a corrupted MFT" doesn't come up
with any obvious packages.

There's lots of good info in http://www.ntfs.com/.
Under recovery concepts the is nothing about corrupted MFT.

In my experience (many thousands of systems, from the first days of
NFTS file system (NT3.51?)) NTFS is a profoundly reliable file system.
About the only way to kill it is for the underlying hardware to die.

What about when you get from ChkDSK: "Unable to determine Volume Version and
State"

Tools, documentation, help from friendly people all failed to allow for
recovery of two (2) ~50 Gig partitions on a 200 Gig Firewire HD.

I remain convinced that there was a simple error causing my problems, but I
still have no clue as to where it was.

"NTFS is a profoundly reliable file system." ... NOT!!!

Sorry to break in, but loosing a complete partition, perhaps to a corrupted
MFT makes NTFS worthless in most cases.

That is unless you are willing to spend big $$$$. Then paying for one of
the expensive data recovery programs whose "demo's" indicate nothing is
wrong, but without the $$$$ they will recover one file, maybe.

--
Stephen H. Fischer




I know that some people with more experience have seen an ocasional
problem. It's vastly superior to FAT32, esp for very large disks.

Do you have a problem, or is this a hypothetical question ?

Stephen H. Fischer wrote:
[snip]
"NTFS is a profoundly reliable file system." ... NOT!!!

Oh I don't know. I've been running systems on it for years and had very few
problems considering. I run the occasional chkdsk for the sake of good
health and i've never had a file system problem on these system that was not
ultimately down to a hardware fault. Maybe my experiences are not typical,
but that doesn't make them any less true.

Sorry to break in, but loosing a complete partition, perhaps to a
corrupted MFT makes NTFS worthless in most cases.

As opposed to what other file system thats immune to corruption? If a file
system becomes corrupted then you risk losing what is on it, which is why we
always tell people to back up on a regular basis.

Hi,

Robert Moir wrote:
Stephen H. Fischer wrote:
[snip]
"NTFS is a profoundly reliable file system." ... NOT!!!

Oh I don't know. I've been running systems on it for years and had very
few problems considering. I run the occasional chkdsk for the sake of good
health and i've never had a file system problem on these system that was
not ultimately down to a hardware fault. Maybe my experiences are not
typical, but that doesn't make them any less true.

Well, as to the "normal" problems with file systems, I cannot fault NTFS.

The loss of everything is perhaps more likely to happen with hard drives
connected with FireWire or USB.

Recovery of NTFS may be better supported by "MSDOS" repair programs, but
they (not all) will not run under windows which must be up and running for
Firewire and USB drives to be accessed. I did note that one BIOS did have
booting support, so maybe more help may be possible in the future.

What was so disappointing with most (or all) of the NTFS recovery software I
looked at was they all were just trying to recover your data.

None provided any help to really understand what had gone wrong thus making
the repeating of the failure likely to occur.

With the number of years NTFS has been around, I was disheartened by the low
quality of documentation and the absence of recovery programs that look at
the MBR, the Partition table, the NTFS Boot sectors and the MFT and report
on possible problems. Just presenting all the information arranged on one
screen would be a step up.

What is error "1507"? (PM8)

So much of the non $$$$$$ recovery programs and those supplied with XP and
the various Resource kits just convert the naked bits to hex and build a
display or printout list that only a person who has been working for years
could look at and understand what is wrong.

If chkdsk can find something wrong, surely a program can be written to look
at the same things and provide more information.

Too many Firewire and USB cables will be pulled loose and persons will be
very unhappy. Even more so when they realize that their wonderful 300 Gig
drive cannot be backed up (only viable option, buy another HD that is bigger
to back up the first HD. What about backing up the backup?).

The NTFS recovery software has a ways to go to help the weekend computer
warriors with no money for the $$$$$$$$ recovery programs.

As to a Comparison of NTFS/MFT recovery software, demo's are available for
many so you can get a idea if your data lost by a particular failure can be
recovered before spending your money.

The recovery programs differ in what damage they can get past to get your
data back. "Zero assumptions recovery" looked great with my "almost nothing
wrong at all" failure, but the demo only would recover one file.

One other program produced a huge number of files with made up names but the
price was just as high.

Persons will praise the program that got their data back, but the same
program might not get yours back. Comparison of programs stop for most
people when they get their data back thus no comparison is published.

--
Stephen H. Fischer


Sorry to break in, but loosing a complete partition, perhaps to a
corrupted MFT makes NTFS worthless in most cases.

As opposed to what other file system thats immune to corruption? If a file
system becomes corrupted then you risk losing what is on it, which is why
we always tell people to back up on a regular basis.

Check out http://www.ntfs.com/ and http://www.filespecs.com/

--
The people think the Constitution protects their rights;
But government sees it as an obstacle to be overcome.


"Stephen H. Fischer" wrote in
message
ink.net...
| Hi,
|
| Robert Moir wrote:
| Stephen H. Fischer wrote:
| [snip]
| "NTFS is a profoundly reliable file system." ... NOT!!!
|
| Oh I don't know. I've been running systems on it for
years and had very
| few problems considering. I run the occasional chkdsk
for the sake of good
| health and i've never had a file system problem on these
system that was
| not ultimately down to a hardware fault. Maybe my
experiences are not
| typical, but that doesn't make them any less true.
|
| Well, as to the "normal" problems with file systems, I
cannot fault NTFS.
|
| The loss of everything is perhaps more likely to happen
with hard drives
| connected with FireWire or USB.
|
| Recovery of NTFS may be better supported by "MSDOS" repair
programs, but
| they (not all) will not run under windows which must be up
and running for
| Firewire and USB drives to be accessed. I did note that
one BIOS did have
| booting support, so maybe more help may be possible in the
future.
|
| What was so disappointing with most (or all) of the NTFS
recovery software I
| looked at was they all were just trying to recover your
data.
|
| None provided any help to really understand what had gone
wrong thus making
| the repeating of the failure likely to occur.
|
| With the number of years NTFS has been around, I was
disheartened by the low
| quality of documentation and the absence of recovery
programs that look at
| the MBR, the Partition table, the NTFS Boot sectors and
the MFT and report
| on possible problems. Just presenting all the information
arranged on one
| screen would be a step up.
|
| What is error "1507"? (PM8)
|
| So much of the non $$$$$$ recovery programs and those
supplied with XP and
| the various Resource kits just convert the naked bits to
hex and build a
| display or printout list that only a person who has been
working for years
| could look at and understand what is wrong.
|
| If chkdsk can find something wrong, surely a program can
be written to look
| at the same things and provide more information.
|
| Too many Firewire and USB cables will be pulled loose and
persons will be
| very unhappy. Even more so when they realize that their
wonderful 300 Gig
| drive cannot be backed up (only viable option, buy another
HD that is bigger
| to back up the first HD. What about backing up the
backup?).
|
| The NTFS recovery software has a ways to go to help the
weekend computer
| warriors with no money for the $$$$$$$$ recovery programs.
|
| As to a Comparison of NTFS/MFT recovery software, demo's
are available for
| many so you can get a idea if your data lost by a
particular failure can be
| recovered before spending your money.
|
| The recovery programs differ in what damage they can get
past to get your
| data back. "Zero assumptions recovery" looked great with
my "almost nothing
| wrong at all" failure, but the demo only would recover one
file.
|
| One other program produced a huge number of files with
made up names but the
| price was just as high.
|
| Persons will praise the program that got their data back,
but the same
| program might not get yours back. Comparison of programs
stop for most
| people when they get their data back thus no comparison is
published.
|
| --
| Stephen H. Fischer
|
|
| Sorry to break in, but loosing a complete partition,
perhaps to a
| corrupted MFT makes NTFS worthless in most cases.
|
| As opposed to what other file system thats immune to
corruption? If a file
| system becomes corrupted then you risk losing what is on
it, which is why
| we always tell people to back up on a regular basis.
|
|

*no spam* wrote:

There appear to be hundreds of software packages out there to restore
an NTFS partition with a corrupted MFT. Does anybody know of any
reviews with a feature comparison matrix?

What utilities do you recommend?

There are hundreds of thousands of permutations from which I
(successfully, normally) choose.

Chipsets, CPU, operating system, slave / master - just to kick off.

Can't tell you how I am so successful, but don't think for one second
it's all down to one or other software package.

Practice is essential - years of it.

I know this is not a commercial group, but I would be happy to do a
fixed-price repair of this drive for £120 plus cost of media to store
recovered data.

I have clients across the globe - not restricted to the UK by any means.

I also consider myself to be better than the "big boys" for almost all
types of recovery - and at less than 10% of the cost.


Odie
--

RetroData
Data Recovery Experts
www.retrodata.co.uk

"Stephen H. Fischer" wrote in message
news:sqzYc.2547
The loss of everything is perhaps more likely to happen with hard drives
connected with FireWire or USB.


Loss of everything is often caused by partition table or boot sector
corruption. This can happen on any disk, not only FireWire or USB. Partition
table and boot sector damage can often be fixed in place in a relatively
safe manner. I recommend not to attempt to fix data loss caused by anything
beyond partition table / boot sector damage. By doing so you often enter the
path of no return. Although software exists that claims to be able to undo
for example reformats of NTFS drives, I have found this software to be very
unreliable and dangerous. 'Repairs' could not be undone.


What was so disappointing with most (or all) of the NTFS recovery software
I
looked at was they all were just trying to recover your data.


And there's good reason for that.

None provided any help to really understand what had gone wrong thus
making
the repeating of the failure likely to occur.


Data recovery software is written with the intent to recover data, not to
lecture you on file system structures. The strength of data recovery
software is often the ability to ignore errors and rebuild a virtual file
system structure regardless present errors. This virtual file system is
often simplified - it holds just enough info to copy lost data, it's not
enough to actually repair a file system in place.

Although I have seen chkdsk bring back lost data (on a clone), in a data
loss scenario chkdsk should be avoided as long as no sector by sector clone
is avalable.

With the number of years NTFS has been around, I was disheartened by the
low
quality of documentation and the absence of recovery programs that look at
the MBR, the Partition table, the NTFS Boot sectors and the MFT and report
on possible problems. Just presenting all the information arranged on one
screen would be a step up.


For 9 out of 10 users (but probably more) this info would only be confusing
and intimidating. BTW, there are plenty of tools that look at the partition
tables and boot sectors and repair those if possible.

So much of the non $$$$$$ recovery programs and those supplied with XP and
the various Resource kits just convert the naked bits to hex and build a
display or printout list that only a person who has been working for years
could look at and understand what is wrong.

And yet you are still suprised that people who have spent all that time
looking at all the naked Hex don't give away their software for free?

--
Joep

"Odie Ferrous" wrote in message
...
*no spam* wrote:

I also consider myself to be better than the "big boys" for almost all
types of recovery - and at less than 10% of the cost.


a.. The initial recovery deposit payable is £65 plus VAT (£76.38.) Please
include the payment with your hard drive. (Cheques must be payable to D
Clarke.)


a.. The first Gigabyte of data recovered is included in the initial deposit.
Thereafter, the recovery process costs £2.00 plus VAT (£2.35) per Gigabyte.

Assume a 80 Gb drive containing 50 Gb of data. 50 x £2.35 = 117.50

a.. Transferring recovered data to CD or DVD costs £1.50 plus VAT (£1.76)
per Gigabyte, which includes the cost of media. Please let us know whether
you would prefer the data on CD or DVD. This is a fairly lengthy process,
which maintains your original directory / folder structure, and is designed
to be absolutely trouble-free to copy the data back once you receive your
returned drive and the CD or DVD media.

Assuming all 50 Gb is recovered 50 x £1.76 = 88

BTW ... this is all the Standard service, if you need your data faster it
will be more expensive.

Adds up to:

76.38
117.50
88.00
---
In US Dollars = $ 533,26 ... this means the big boys would ask $5330 (as you
do it for 10% or less)? Or, DiskLabs according to their online quote form
asks $ 690. 10% would mean you'd do it for $ 69?

Either there's something wrong in my calculations (for which I then
appologize) or something is wrong with yours. Assuming my calcualtions are
correct, I find some of your claims hard to believe.

--
Joep

Joep wrote:

Either there's something wrong in my calculations (for which I then
appologize) or something is wrong with yours. Assuming my calcualtions are
correct, I find some of your claims hard to believe.

--
Joep

Sorry, Joep - I don't mean to mislead.

For obvious reasons, I need to have plain facts and figures on my
website. There *are* individuals who will try to take advantage of me,
and I need to keep that to a minimum.

However, there has not been one single case where the recovery of more
than 30GB of data has resulted in the total charge being assessed.

Additionally, I will often forego the charge to copy the data to the
media. Certainly if there are only 5GB of data required (a common
volume) the charges will be complete. But for 30GB? No way.

The different service levels are there for a reason but, again, I am not
going to take a Priority Plus fee for something if there is a recovery
machine not busy with someone else's recovery. If the client is
desperate for the data and I don't have to interrupt other processes, I
am not going to charge extra.

This will come as a huge surprise to you and many others, but I am NOT
in the business of stitching people up.

I have never had a complaint from a client, and I intend to keep things
that way.

Sure, any old bad guy can say he's one of the good guys - what's he got
to lose? But me? Well, I *am* one of the good guys!

There is every chance some of my existing clients will be reading this.
I know for a fact that not one will complain or even have cause to raise
an issue. My confidence is valid!


Odie
--

RetroData
Data Recovery Experts
www.retrodata.co.uk

"Odie Ferrous" wrote in message
...
Joep wrote:

Either there's something wrong in my calculations (for which I then
appologize) or something is wrong with yours. Assuming my calcualtions
are
correct, I find some of your claims hard to believe.

--
Joep

Sorry, Joep - I don't mean to mislead.


Okido ;-)

--
Joep

On 27 Aug 2004 08:34:41 -0400, (Al Dykes) wrote:
In article ,
*no spam* wrote:

There appear to be hundreds of software packages out there to restore
an NTFS partition with a corrupted MFT. Does anybody know of any
reviews with a feature comparison matrix?

I'd like to see that, too.

Do you mean recover or repair ?

I'd like tools to do either.

There's lots of good info in http://www.ntfs.com/.
Under recovery concepts the is nothing about corrupted MFT.

In my experience (many thousands of systems, from the first days of
NFTS file system (NT3.51?)) NTFS is a profoundly reliable file system.

All well and good, but it can only be as reliable as the hardware
allows it to be, and it can do nothing against malware attack, if the
malware enjoys the appropriate level of access (see Witty).

About the only way to kill it is for the underlying hardware to die.

Well, that happens. Losing data is not a matter of "Oh, that was
because the hardware was bad. That's OK then!"

I know that some people with more experience have seen an ocasional
problem. It's vastly superior to FAT32, esp for very large disks.

Do you have a problem, or is this a hypothetical question ?

I did find a number of tools, mainly Windows-based (meaning you'd have
to have a recovery PC, and will have to be careful to stop XP writing
SR junk on the at-risk volume). Most purported to pull stuff off,
recover partitions, undelete files etc. One in-place repair tool,
diskette-based, that didn't boot when I tested it.

I'd settle for an equivalent of Norton DiskEdit, i.e. show me the
structures, document them, let me scribble.

Still looking...



--------------- ----- ---- --- -- - - -
Hello DOS mode my old friend
I've come to hack with you again
--------------- ----- ---- --- -- - - -

In article ,
cquirke (MVP Win9x) wrote:
On 27 Aug 2004 08:34:41 -0400, (Al Dykes) wrote:
In article ,
*no spam* wrote:

There appear to be hundreds of software packages out there to restore
an NTFS partition with a corrupted MFT. Does anybody know of any
reviews with a feature comparison matrix?

I'd like to see that, too.

Do you mean recover or repair ?

I'd like tools to do either.

There's lots of good info in http://www.ntfs.com/.
Under recovery concepts the is nothing about corrupted MFT.

In my experience (many thousands of systems, from the first days of
NFTS file system (NT3.51?)) NTFS is a profoundly reliable file system.

All well and good, but it can only be as reliable as the hardware
allows it to be, and it can do nothing against malware attack, if the
malware enjoys the appropriate level of access (see Witty).

About the only way to kill it is for the underlying hardware to die.

Well, that happens. Losing data is not a matter of "Oh, that was
because the hardware was bad. That's OK then!"


sh*t happens. hardware dies. NTFS is much more reliable than the
disks we run it on. Your computer could be stolen, or your house
could burn down. One of the rules of this game is; Never Write Over
Your Only Backup. Murphy works overtime when you are screwing with
your disks.

The fact that you've "lost" two NTFS file systems ar once tells me you
don't have an MFR problem. It's partitions and there are tools (which
I've never needed so I have no experience with) to discver the
partition tables.


I know that some people with more experience have seen an ocasional
problem. It's vastly superior to FAT32, esp for very large disks.

Do you have a problem, or is this a hypothetical question ?

I did find a number of tools, mainly Windows-based (meaning you'd have
to have a recovery PC, and will have to be careful to stop XP writing
SR junk on the at-risk volume). Most purported to pull stuff off,
recover partitions, undelete files etc. One in-place repair tool,
diskette-based, that didn't boot when I tested it.

I'd settle for an equivalent of Norton DiskEdit, i.e. show me the
structures, document them, let me scribble.

Still looking...



--------------- ----- ---- --- -- - - -
Hello DOS mode my old friend
I've come to hack with you again
--------------- ----- ---- --- -- - - -


--
Al Dykes
-----------
adykes at p a n i x . c o m

"cquirke (MVP Win9x)" wrote in message

I did find a number of tools, mainly Windows-based (meaning you'd have
to have a recovery PC

Not perse ... some run from BartPE (http://www.nu2.nu/pebuilder/), for
example iRecover (http://www.diydatarecovery.nl/~tkuurstra/irecoverpe.htm).
If you can still download recovery software, then it may be assumed you have
access to an additional PC anyway.

, and will have to be careful to stop XP writing
SR junk on the at-risk volume). Most purported to pull stuff off,
recover partitions, undelete files etc. One in-place repair tool,
diskette-based, that didn't boot when I tested it.


Maybe the DOS or Linux version on the diskette didn't boot - that doesn't
tell you much about the tool itself. The tool itself probably doesn't boot,
it needs to be started once the OS (DOS/Linux) runs.

--
Joep