I wanted tell everyone about a newer piece of data recovery software I have been using/ testing. It is “CNW Recovery.” I have been very impressed by the software!
This software has a whole lot of functionality and power “under the hood.” I have used it in a few cases/recoveries so far. Its results have been most impressive. For the readers information, my comparrison is to my other software such as Encase, X-ways, R-studio, and an assortment of other data recovery products that I have tested that are targeted at consumers and techs. Encase and X-ways are obviously much more mature pieces of software with a great deal of emphasis on forensic features. Most of the “data recovery” software targeted at the consumer market is not very powerful or versatile; and they milk their customers for every dime. (NTFS version, FAT version, CD-ROM version…on and on) With most of the consumer data recovery products the end user is not getting much for their money in results or functionality.
With CNW Recovery there has been a total departure from the what is the “norm” in consumer data recovery software. This software is a very powerful piece of data recovery software at reasonable cost. Currently a 30-day license is only $19.99! That is a super deal in the data recovery world.
The software actually functions at three different levels. These descriptions are mine for the reader, not the software authors mind you.
Wizard mode: This is where the average consumer would work. The software opens up the a screen that scans your computer for currently existing media. It asks you to choose what type of media you are working with. You choose from floppy, hard drive, dd image, cd-rom, flash, DVD, Jazz, or Zip drive. The software then walks the user through either an extraction of files or creating an image of the drive. The wizard mode might be somewhat confusing to the computer novice, but if you just trust the software and go through the process it would result in good recovery work.
Manual Mode: The manual mode of the software allows the user to go directly to the various functions. The major ones are Recover, Partition, Image, View, Properties, and Log. The recovery mode is where most of the work will be done for data recovery. This allows the user to use the File Table to recover files. Partition allows the user to locate the partitions and file tables. Partition also includes the ability to do repair operations on these structures, although I haven’t had the opportunity to test that feature. View allows the user to see the contents of the drive in a HEX editor sort of view. Properties displays fundamental information about the device. The log actually provides a print out of all the file names recovered or mapped for recovery including the physical location, parent directory, parent directory location, short file name, and directory path.
This manual mode allows the skilled computer user to do alot of very powerful data recovery. As far as data recovery work goes, it is very user friendly.
Expert mode: Although not explicitly a “mode” I wanted to note this usefulness of the program. Because of how robust the log is in displaying details about the files, if you understand all the data it is delivering the expert can actually jump directly into a hex editor and use the information to start manually carving out the data.
Forensic Edition: CNW is rapidly expanding the features in the forensic side of the software. While the interface to the data is much different than something like X-ways, it is still very informative. The logs and pop-ups while scanning the MFT allow a very granular view of the raw data the program in using. This provides for the investigator to have a more in-depth understanding of the data. While it is not as much of a “point and click” interface, this is actually a good thing for when you are trying to manually validate findings, educate yourself, or prepare for courtroom presentation of the evidence.
Just a couple notes on what I have personally used the program to do with success.
I was able to use the software to carve out previously existing image and videos from an NTFS hard drive. This resulted in very robust recovery of data. I compared the recovered data to work done on the same drive with X-ways Forensics. The recovered data was very consistent.
I used the software in a data recovery job that involved a hard drive with bad sectors, inconsistent reads, and a Master File Table (MFT) that would read very inconsistently due the errors the drive was having. CNW Recovery was able to read the MFT and retain the MFT information. I was then able to use CNW Recovery to gather the needed files from the sectors that they mapped to with the MFT. The recovery was very robust and complete.
A neat feature of CNW Recovery is during recovery work its directory pane maps the directory structure of the drive you are working on, but also shows you the directory structure of the recovery you are working on. This allows a quick reference to what has been recovered and what still needs to be recovered.
If at any point in using the program you are confused, you can go to the programs manual. Regardless though, I highly recommend reading this manual if you are interested in data recovery. The manual is a guide to the software, but CNW has done an awsome job of making their manual an education on data recovery also. There is a lot of good information within the manual. It is as beneficial a read as any computer forensic book I have ever purchased.
I can’t say enough positive things about this program, most especially at the current price point!!! The author has shared with me that he will continue development on the software this year. I expect the program to be truly amazing with the author’s continued enhancements!
If a consumer is looking for data recovery program, to try a do-it-yourself recovery of data this software would be my first choice. It is so affordable it is certainly worth trying before seeking out professional data recovery help.