Using home computers affords many opportunities for errors and malfunctions. You probably have experienced at least one of these mishaps.

• Shortly after emptying the recycle bin, you realize it contained a file you should have restored.
• A CD, CD-ROM, or DVD is scratched and unplayable or unreadable.
• You formatted the memory card for your digital camera with vacation pictures you hadn't yet moved to your PC.
• Your computer won't boot, and you haven't backed up all your files.
• Your hard disk is beginning to report errors, and again it isn't backed up.
• You had a fire, a flood, or a power surge, and your hard disk is dead.

Surprisingly, you can probably recover some and perhaps most of your data in each of these cases, as you will see in this article and the two that follow it: Windows graphical tools, and command-line tools. As will become apparent, by far the best approach is prevention in the form of a good backup regimen, and if you haven't already, reading this series may inspire you to begin one.

Regardless of what happened, the first step is usually the same – turn off the equipment that contains the damaged medium. Don't power it up again until you have collected any equipment and software you need and have developed a good plan. If the plan involves using unfamiliar software, practice the procedures on a test medium until you are comfortable with them.

It's most important that you not write anything to the device from which you hope to recover the files. This implies several things.

• If the device is your system disk (C: for Windows users), you must not install any software before you have recovered the files. Ideally, you shouldn't even reboot from it.
• To recover files from your system disk you must remove the disk and mount it in a different PC (unless you have recovery software installed) or use a Linux live CD.
• When you recover files from a device, you must rewrite them to a different device.

The general approach depends on the nature of the problem.

• Complete device failure or physical damage from fire, water, electrical surge, or physical shock – You can't do anything and neither can your local shop; instead, you must send the device to a specialist. Expect the fees to start at above $1000, and they could be much higher. Reputable firms don't guarantee success, but many charge you only for what they are able to recover.
• Problems resulting from a gradually failing system disk – You must either move the drive to a new computer or boot from a live CD (which doesn't use the internal hard drive). Regardless of your approach, your first task is to move all the data from the failing device to a good one. The preferable way to do this is with a program such as gddrescue (discussed in part 3), which is designed to recover as much as possible from a corrupt filesystem.
• Problems resulting from a gradually failing storage device that is not a system disk – Since your system disk is fine, you can use your computer to salvage the data. Again, the first step is to move all the data to a good device.
• A computer that won't boot – Most likely, your data isn't affected, but you should move all your files to an external device before you try to repair the operating system.
• Problems resulting from malware or a software malfunction – If this occurs on a system disk, you must not boot from it, as this would allow the problem software to continue its mischief. Thus, you must use either a live CD or attach the disk to a clean computer. Once you do this, there will be no new damage, which means you can recover files at your leisure.
• Problems resulting from user errors – If these occur on a system disk, you should not boot from it until you have recovered the data. This is because each boot causes files to be written, which could overwrite what you are trying to recover. The best time to recover that data is immediately after you delete it, providing you had already installed the recovery software you need. Thus, this case is an exception to the rule that your first step should be to shut down your computer.

Your first decision is whether to attempt the recovery yourself or pay a shop to do it. If the data is very valuable or belongs to a business, strongly consider having a competent professional do the work. Also consider a professional if the medium is failing; here, you have little time, as data losses will continue. Ask what approach they will use, and if their strategy is different than what I discuss here, they should be able to justify it.

You must next decide whether you will use a tool in your native operating system or a Linux (probably command-line) tool. A strong advantage of working in your native environment is that it reduces the likelihood of serious errors. However, to recover files from a Mac or Microsoft system disk, you will have to remove it and connect it to a separate, healthy computer that has the appropriate recovery software. Rather than opening the healthy computer's system case to install the hard disk in it, consider buying a IDE to USB, a SATA to USB, or a laptop disk to USB adapter (depending on the drive you're working on). (Of course, this isn't necessary if the problem is on a removable medium, such as a memory stick or CD-ROM.) An alternative is to use a Linux live-CD, which runs from a CD-ROM or memory stick without accessing the hard disk at all, except to recover files from it. As a result, you don't have to move the hard disk to another PC. Even die-hard Windows users should consider acquiring and experimenting with a Linux-based maintenance disk, such as Parted Magic, to be ready in case of difficulty. (See my article in the April BCUG Bytes)

Next month we'll look at recovery tools that run under Windows. (I'm not able to test Mac procedures, but a Web search will find graphical recovery tools for the Mac.) The following month, we'll look at Linux command-line tools, two of which also run on both Mac and Microsoft operating systems. To decide between graphical and command-line tools, consider the following.

Graphical tool pros:

• familiar environment and
• intuitive procedures. (You probably don't need a manual.)

Graphical tool cons:

• need to remove the system disk from the PC,
• need a second PC and probably an adapter to work on the system disk, and
• you can work only on native filesystems (FAT and NTFS for Windows).

Command-line tool pros:

• handles a greater range of problems and
• if used with a live-CD, allows working on a system disk in place and on many different filesystems.

Command-line tool cons:

• user needs more expertise and
• if used with a Linux live-CD, the environment is probably unfamiliar.

From this I recommend that if you are familiar only with Windows or the Mac and are recovering files from a removable medium, use graphical tools that are native to your operating system. However, in part three, we'll look at two command-line tools (TestDisk and PhotoRec) that run on both Windows and the Mac as well as on Linux, and both are almost as easy to use as the graphical tools. If you have a system disk problem, use a Linux live-CD (such as Parted Magic), mount the disk in a second PC that has the proper recovery tools, or take the PC with the problem disk to a good shop. Of course, by far the best approach is to use an effective backup program, which lets you avoid this whole mess.