Recover
Recover manual
From the first check to putting your files back. Recover only reads the source drive, so you cannot break anything by looking. What does matter is the order.
Recovery
Hard disk and SSD HDD, SSD, external drives, flash cards RAID, NAS & SAN All levels, all controllers, virtualisation Smartphones and tablets iPhone, Android, iPad, Huawei Tapes LTO, DAT, DLT and older formats
Access after signing in.
EN · RU · ZH · ES
Recover
From the first check to putting your files back. Recover only reads the source drive, so you cannot break anything by looking. What does matter is the order.
To read physical drives Recover needs elevated rights. Image files do not.
Right-click Recover and choose "Run as administrator".
Command line, from an administrator prompt:
recover-cli.exe devices
recover-cli.exe info \\.\PhysicalDrive1Once, give Terminal Full Disk Access (System Settings → Privacy & Security), unmount the drive, and start Recover from Terminal.
diskutil list
diskutil unmountDisk /dev/disk2
sudo /Applications/Recover.app/Contents/MacOS/Recover
sudo recover info /dev/rdisk2 # command lineUse /dev/rdiskN (with the r): it reads much faster.
sudo -E ./Recover-gui-linux
sudo ./recover info /dev/sdbBefore Recover scans a physical drive, it asks you to confirm the drive has no physical symptoms. The dialog lists the signs that mean you should stop, and offers to make a disk image first.
Recover also reads the drive's own SMART data. If the drive reports it is failing, Recover refuses to scan. That is not a bug: long reads would damage the drive further.
Confirm with --disk-checked, or type YES when asked. Without confirmation Recover stops with exit code 3.
A disk image is a copy of the whole drive, sector by sector, in one file. Unreadable sectors are filled with zeros so the copy stays complete. You then work on the copy, and the drive itself is spared.
This is the recommended first step, certainly for a drive that seems doubtful. Imaging is never blocked by the health check.
recover image /dev/sdb /mnt/backup/schijf.imgYou then open the image file in Recover like any other drive.
Choose the source: a drive, a partition, an image file or a RAID set. Recover reads the partition table and the file system, and shows the folder tree with existing and deleted files.
At the same time Recover reads the search indexes of Windows, macOS or Linux. Files still listed there appear in their original folder, marked "In search index", even when the file system has forgotten them.
The location of the data is known and not reused. These files normally come back complete.
Part of the space has since been used by something else. The file comes back but may be damaged.
The space has been reused completely. What comes back is no longer the original file.
Click a file for a preview: pictures show directly, other files as a hex view. So you know before recovering whether a file is usable.
Select files, folders or everything, and choose a target folder on another drive. Recover keeps the original folder structure.
Note: you see the original dates in Recover, but they are not yet set on the recovered files. If you need the dates, note them from the list.
When the file system knows nothing any more, for example after formatting or with an unknown file system, Recover looks for files by their content. It recognises 334 formats with more than 560 extensions, from photos and documents to databases, video and mail archives.
The length of each file follows from the format's structure, not from searching for an end marker. With the option to search free space only, you skip files the file system still knows.
A RAID set is assembled read-only from separate drives or images, and then behaves like any other source. Recover reads RAID 0, 1, 5, 6, 10 and JBOD. If there is RAID metadata on the drives, Recover takes the layout from it; otherwise it works out the level, stripe size, order and parity itself. A missing drive is rebuilt: one for RAID 5, up to two for RAID 6.
If Recover cannot tell two layouts apart, it picks the most common one and says it is a preference, not a proof.
Detect automatically:
recover ls raid:/dev/sdb,/dev/sdc,/dev/sddGive the layout yourself, with one drive missing:
recover image raid:d1.img,d2.img,missing,d4.img --raid-level 5 \
--stripe 65536 --layout left-symmetric --order 1,2,3,4 out.imgEverything the graphical version does can also be done on the command line. The main commands:
| Command | What it does |
|---|---|
| devices | list the available drives |
| info | partitions and file systems of a source |
| ls | list the files (with --deleted only the deleted ones) |
| restore | recover files to a target folder |
| carve | search by content |
| image | make a disk image |
| languages | list the languages with their coverage |
| report off | switch usage reporting off |
With --lang you choose the language, for example --lang fr. The full options of a command are shown by --help.
Recover picks your system language. Through the Language menu you choose another; each language is listed with its coverage. Twelve languages are fully translated.
Recover anonymously reports the type of drive and which functions are used, never file names, paths or contents. Switch it off through Help → Usage reporting, or with recover report off.
If a message about unreadable sectors appears during the work, Recover shows the phone number and the link to a free analysis. Take that message seriously: a drive that starts losing sectors usually gets worse quickly.
Request a free analysis. In our lab we go further than software alone can.
Questions about your drive? An engineer is reading.