Comparison of well-known software capable of recovering data from ReFS drives
Foreword
The ReFS file system (also known as “Protogon”) is the latest out-of-the-box version of a system service from the Windows developers and has received many improvements to improve its overall performance and resiliency.
Structurally, it uses B + trees for its work. The main element is the “Catalog”, the key to which will be the object number, and the “leaves” will be the records. Records contain information about the directory, index information about items, structural information description, data about the file and its fragments.
In terms of security, the file system significantly exceeds the previous options. Unfortunately, sometimes in it you also need to resort to the operation of recovering files lost for various reasons. Next, we will compare different types of third-party recovery software and share our experience.
Selection of programs for analysis
To date, only a few popular software programs are able to detect and successfully interact with the new ReFS system service. Therefore, only a few samples will be included in the comparison.
We will put different files on a working disk with the ReFS system. Then we will delete some of the available files. Then we connect our media on which the deletion was performed to a PC running Windows 10 and perform a test run.
Finding files after deletion
RStudio
Let’s start RStudio. The attached ReFS media is detected, identified, and displayed. A quick scan did not recover all files, and does not show the contents of the returned files.
The option of a full disk scan made it possible to detect the lost elements and presented them in a window for further actions.
The program was able to recover the lost data, but the whole process was too long.
Hetman Partition Recovery
The program immediately showed the ReFS disk and correctly identified its name. Let’s do a quick search for items.
All deleted files are found and marked with a red cross. They are shown together as remaining on disk. The general structure of the drive and the labeling of the elements are preserved. We look through the files, mark and restore.
UFS Explorer
UFS Explorer detected the drive but marked it as inoperative. System type and name are undefined. The quick check was disappointing. Wasted a lot of time, more than in RStudio, and nothing was found. The full scan also did not recover the files it was looking for.
The program failed the test, the data was not recovered. Therefore, she will no longer participate in further experiments.
Easeus Data Recovery Wizard
The utility shows the drive, but there is no system name and type. The quick check option is also not available. The full analysis did not recover all the deleted files. Some of them were not found by the program. Disk structure and object names are missing. Files are divided into folders according to their extension. No marking of deleted files.
It is difficult to find refurbished ones. You need to check each folder, which takes a lot of time and effort.
Now let’s complicate the task and create more complex conditions.
Lost main volume header
RStudio
Drive detected, but no system name or type. In the previous test, the quick analysis was not impressive. Therefore, we immediately run a full disk scan. As a result, the disk is identified and the file system is displayed correctly.
The form of presentation of the disk contents has been saved, the deleted files have been found, they can be restored and saved. The program has successfully completed the test.
Hetman Partition Recovery
The program shows a test disk, but there is no name, and the system is defined in NTFS format.
Full disk scan helped to completely recover deleted files. Also, upon completion of the analysis, the disk file system and its name are displayed correctly. The structural representation of the contents of the volume is preserved, all files are in their original location.
Easeus utility
The drive is shown in the drive listing, but without the name and file system type.
After the analysis, the program repeated the previous result. The files are in folders according to their extensions, the content is unnamed and mixed, the structure is missing, the storage location is changed, some of the files are not displayed.
The test is complete, but the results are inferior to other samples.
Lost available copy of main header
RStudio
The file system of the disk is not detected, there is no name. However, after a complete analysis of the drive, its name and system type are correct.
The structured presentation of the content is saved, the names of all objects are specified correctly, the files are restored, they can be stored on any third-party disk.
Hetman Partition Recovery Software
The program repeated the result preceding this experiment. Namely, when connected, the disk was marked as NTFS. After analysis, all files were found, the name of the disk and its type were marked correctly, the form and order of the content were saved, the names were correct, the location of the files was established according to the primary location. You just need to mark the files you want and save.
Tool from Easeus
As in the earlier test, the program does not show the disk name and its type. According to the final scan, the utility did not find all the files, and some of them do not even display, which accordingly makes access impossible.
The recovery is not complete, the program has only the third result.
Lost access to superblocks on a volume
RStudio software
Removing all superblocks did not affect the program. The disk, as before, has no name, the file system is unknown. After completing a full scan of the disk, the program showed the missing information.
You can mark the recovered files, familiarize yourself with their contents and save them to any disk if you wish.
Hetman Partition Recovery Tool
Also, as before, Hetman’s tool detects the format of the disk and marks it with an NTFS label.
After performing a full scan of the media, we got the following results: all the lost data were returned, the structural form of the media was saved, the disk name and its type are now recorded correctly, all elements are under their own name and in their places. It remains only to select the files you are looking for and save.
Utility from Easeus
The program shows only the drive itself and its capacity is supplied. A complete analysis of the media, as before, does not recover all files, and besides, some of them are unavailable (content is undefined).
As before, the utility is inferior to the other two programs.
Missing checkpoints
RStudio tool
Missing checkpoints prevented the program from showing the disk name and prevented it from determining its file system. But as the full scan was performed, the missing drive information became available.
However, after going to the contents of the disk, it turned out that there was no data. The media was empty and contained only a few logs.
The last test turned out to be beyond the power of the program. With this type of damage, RStudio cannot recover deleted files.
Hetman Partition Recovery
After running the program after erasing all checkpoints, we observed that the initial disk name was not determined, the information about the system was not correct, although the program found the disk among the connected devices.
The full scan met our expectations. All objects were restored and the disk information was displayed correctly.
The presentation format, structural form, names and arrangement of elements corresponded to the original values. The files have been recovered and are ready to be written to any device.
Easeus software
The final value of the test check was similar to the previous results. The disk name and file system type are not defined, the drive structure and file names are lost. The marking of existing and deleted files does not differ in any way.
As before, a small amount of data is not available, the structure of the location of directories and files has been changed. Redistributing files with the significant storage capacities of modern storage devices will seriously complicate the ultimate search and recovery. Which is not a relief.
Output
After completing all kinds of tests, a simple conclusion can be drawn. We have completed the tasks of Hetman Partition Recovery and Easeus Data Recovery Wizard. RStudio was unable to pass the last test, so it comes in third place.
For the full version of the article with all additional video tutorials, see source… If you still have questions, ask them in the comments.
