For Guest posts or some help on specific problems please leave comments or Email me from Contact Us page!.

Friday, October 18, 2013

Data recovery with Recuva

So somebody accidentally or intentionally deleted your files? Or the drive was corrupted and you needed to format that. But all the data which was there is all gone now. Damn it was office and personal stuff!! Worry not we will try to recover that.

So lets start.

What you will need?
Drive or the directory (on which the recovery needs to be done)
A laptop or desktop with Windows OS
Recuva by piriform (software)

Skill: Novice
Difficulty: Medium
Time: Depending on the size of the drive and data to be recovered

So lets begin!

First thing first you need to install the software which is Recuva by piriform here take the link Recuva - Image and File Recovery and install it like every other installation (here I’m considering you know how to install a software or a utility)
installing Recuva
Here how it looks like in the end:
 Ok click on the Finish button, after that Recuva will auto start and will give you this nice looking window with its introduction now click on Next

Recuva after installation
click on the images to enlarge it.

Now select the file type you want to recover, there are plethora of options to choose from like I used Pictures to work with therefore I selected Pictures. If you want to recover all the files from the drive you can select the ‘All Files’ option. Ok now click next
Recuva File selection

Now comes the location, from where you want to recover the files. Choose the file location. If you are working with a local logical drive possibilities are that the files deleted are in the Recycle bin (unless and until you deleted it permanently with shift+delete). I was working with my flash drive( pendrive whatever you say). So I chose ‘In a specific location’ option, located my drive which is ‘CRAY’ here. Click next
selecting file location
selecting files

After that it will ask you to enable deep scan or not. Ok I will suggest you to enable it only if the previous scans were not able to recover any files, as Deep scan takes much more time than the normal ones. So if you have ample time in your hands then go for deep scan. Otherwise the normal scan can also do it. So I’m leaving this decision with you. I personally enabled it. Click on start afterwards
recuva deep scan
Ok now let Recuva do the work. It will take some time to do the recovery process, mean while you can have a drink or coffee relax have a walk (whatever). After the scan completes it will show you with the files it has found.
recovering files

Ok now start choosing the files you want to recover, mark the check boxes.
Then click on Recover at the bottom, afterwards it will ask you the location where you want to save these files. Give it an appropriate location and click ok.
files found by recuva

selecting the path to save the files

Now it will again take the time to save the files on the directory you opted for. 
recovering files with recuva

operation completed

As soon as it is done you can go and check the directory and voila the files are recovered!!!

Conclusion: how it recovered the file?? the answer to this question is very simple as  we have learned in Science "Energy can be neither created nor destroyed, but can change form" similar is with your data, can never destroy it, it is always located somewhere in the drive. and this is how Cyber forensics recover you data.

Thank you guys!! and have a nice day :)

No comments:

Post a Comment