How to perform external hard drive recovery

An external hard drive is a portable storage device that allows Windows and Mac users to store, transfer, and back up critical data. Even if modern computers typically have extensive built-in storage space, large media files (movies, audio files) can gradually fill up the primary hard drive, leading to storage space issues. External storage devices can ease the load on the primary drive to safely store essential files without overloading your system.

However convenient though, external hard disks are liable to numerous data-loss scenarios. Users may need to initiate external hard drive recovery due to the following reasons:

• Accidental deletion or formatting
• File corruption
• Physical hard drive damage
• Viruses, worms, and malware
• Hacking attacks
• Insider threats
• Software corruption
• Power outages, failures, and surges
• System crashes
• Partition structure compromise
• Critical file system structure compromise

This article will explore how to recover files from an external hard drive, optimal solutions to ensure streamlined restoration, and the required actions to avoid common process pitfalls.

Professional data recovery services aim to salvage any recoverable files from the external hard drive, piece them together, and copy the data stored on the corrupted device to a fresh storage device. Moreover, external hard drive recovery software supports various capabilities to try and restore the damaged hard drive to its previous, unaffected state. However, if the drive has suffered severe physical damage, putting it back into working order can be challenging and, sometimes, nearly impossible.

Nonetheless, even if the drive is beyond repair, the best data recovery tools can still manage to retrieve lost data or corrupted files (up to an extent). The most suitable restoration method depends on numerous factors, such as device age, hardware complexity, and the degree of the external hard drive failure, whether physical or logical. In the case of physical damage, data recovery specialists can try to repair the drive by replacing compromised hardware components. In contrast, logical damage can require the dedicated data recovery tool to clone raw data and copy it to a new, properly operating device to restore files.

An essential aspect of external drive data recovery is understanding how hard drives handle data writing operations. As the drive receives a new data writing order (from the OS), it searches for storage blocks marked as "free" to write the new data to them. However, unless such an order comes through, even permanently deleted files can be restored without much hassle. This is why the most critical step in a data compromise scenario is to stop using the external hard drive immediately after detecting a problem. This way, you won't risk overwriting lost or deleted data, which, in turn, significantly increases the chances of recovering the contents of the external disk.

When faced with a compromised hard drive, users can utilize free data recovery tools to try to remediate the issue. Such options include the File Recovery tool (for the Windows operating system) and Disk Utility for macOS users. Let's explore how to use both approaches below.

Windows File Recovery is a command-line software utility created by Microsoft to recover deleted data. Because it is a command-line tool, it doesn't offer a graphical interface. Your machine must run Windows 10 or 11 to use it, as the utility isn't supported on older Windows versions.

Keep in mind that the success of the recovery via the File Recovery tool depends on the external hard drive and the extent of the corruption or damage. For example, if you have continuously used the drive to write new data following accidental deletion, the data may already be overwritten; in such a case, the data recovery wizard won't be able to restore the deleted files.

However, if you have stopped using the drive immediately after the compromise event, you can use the tool in multiple modes to try and salvage essential data. Let's explore them below.

First, you must install the File Recovery tool from the Microsoft Store. You can browse the store or use the search filter to locate it. Once installed, you can access it via the Start menu search ("File Recovery"). Once launched, you must click "Yes" to accept the UAC prompt. Afterward, you will see the Command Prompt window (with Admin access enabled) to run the File Recovery commands.

The free data recovery program relies on the winfr command to specify which drives you wish to search for deleted files, the preferred destination to save the data, and the available switches to customize the search. You must save the restored file to a different drive than the original.

The basic command is as follows:

winfr source-drive: destination-drive: /switches

Here, the "source-drive" should be pathing to your external hard drive. The destination drive can be any other relevant drive you deem appropriate.

After you run the command, the recovery tool will automatically create a "Recovery_[date and time]" directory on the specified destination drive.

Before recovering deleted files, you must specify the mode you wish to use to scan for the missing data. You can choose from three recovery modes - Default, Segment, and Signature.

The Default mode is the quickest, with Segment mode adding more complexity to the search, while Signature mode can also search for specific file formats (types). It supports JPEG, MP3, ASF, PDF, MPEG, PNG, and ZIP file formats. (the "ZIP" specification can also locate MS Office documents in the following formats: DOCX, PPTX, and XLSX)

Next, you must know the file system corresponding to the external hard drive. To find it, open "File Explorer" -> right-click the external drive (under "This PC") and select "Properties" -> the file system will be displayed on the "General" tab.

Below are several examples of when to use each of the three recovery modes:

1. You can use the Default mode when trying to restore recently deleted files on an NTFS-formatted drive.
2. You can use Segment mode to try and restore files you deleted some time ago or restore them from a formatted (NTFS) or corrupted drive. You can also pair this search type with a Signature mode search after.
3. The Signature mode can be used to recover deleted files in an external hard disk stored on ReFS, FAT, or exFAT file systems, as the previous two modes operate only on NTFS file systems.

Usually, you can try using the Default mode and then follow up with the Segment and Signature modes if the first attempt doesn't yield results. Let's see how to restore data from external hard drives via all the modes below.

The Default mode is generally used via "/n" followed by a specific search path. For example, to search for a file labeled plan.docx, you can use the following command:

/n plan.docx

You can also specify the full path for the file (if you remember it). An example line would be as follows:

/n ExternalDriveFolderNameplan.docx

To search for all recoverable files in a folder labeled "X" on your external hard drive, you can use the following command:

/n ExternalDriveX

You can also search for all DOCX files within the X folder on the external drive via the following command:

/n ExternalDriveX* .docx

Now, to search for all recoverable DOCX files from an external hard drive (E:) and copy them to another drive (for example, drive D:), you can use the following command:

winfr E: D: /n *.docx

Once the command is inserted, you must type "y" to proceed. As discussed, you will find all recovered files in the "Recovery_[date and time]" directory on the specified destination drive.

You can also search for specific files (for example, documents) containing the word "plan" anywhere in their name via wildcards (*). The command is as follows:

winfr E: D: /n *plan*

You can also combine multiple searches within one command. For example, combining several /n switches can locate all PowerPoint, Word, and Excel files via the following command:

winfr E: D: /n *.pptx /n *.docx /n *.xlsx

To locate a specific document labeled "critical_data.pdf", located in the X folder on the external hard drive, and save the file to drive D:, use the following command:

winfr E: D: /n ExternalDrive/X/critical_data.pdf

Segment mode is similar to Default mode but focuses on examining file record segments (hence, its name) via the additional /r command. If a default mode search doesn't yield results, you can try locating important files via the Segment mode.

You can initiate a Segment mode recovery command like you would via the Default mode, but you must add the /r. For example, to locate all .docx files from external hard drive storage, you can use the following command:

winfr E: D: /r /n *.docx

The Signature mode differs from the two previous options. It focuses on locating specified file types and can only locate deleted files corresponding to the file-type search specification. Signature mode searches require using /x to specify Signature mode and /y: to list all relevant file type groups you wish to locate.

You can inspect all supported file types by the Signature mode via the following command:

winfr /#

Now, an example command to search the external hard drive (E:) for PDF files and save them to the D: drive will look like this:

winfr E: D: /x /y:PDF

You can also add multiple file groups to the search by listing them accordingly. An example to locate PDF, JPG, and MP4 files will look like this:

winfr E: D: /x /y:PDF,JPG,MP4

Recovering data on a hard drive mounted to a Mac can be done manually in several ways.

Disk Utility can scan, detect, and fix formatting and directory structure errors on Mac storage devices. You can run First Aid on each hard disk volume and container or directly on the storage device to see if there's an issue with the external drive. To do so, follow the steps below:

1. Select View -> Show All Devices in the Disk Utility app on your Mac machine.
2. Select your preferred volume in the sidebar -> click the First Aid button.
3. In the following dialog box, select Run -> follow the instructions on the screen.
4. Wait for the First Aid process to complete -> click Done.
5. Repeat steps 2, 3, and 4 for each storage media volume.
6. Select a container in the sidebar -> click the First Aid button.
7. In the following dialog box, select Run -> follow the instructions on the screen.
8. Wait for the First Aid process to complete -> click Done.
9. Repeat steps 6, 7, and 8 for each storage device container.
10. Select the storage device in the sidebar -> click the First Aid button.
11. In the following dialog box, select Run -> follow the instructions on the screen.
12. Wait for the First Aid process to complete -> click Done.

After the check, Disk Utility may report that the external disk is repaired or is "OK". In such a case, you can check if the issue is fixed and inspect the remediation details for more information about the repair process. If the problem persists, you may need to opt for one of the options below:

1. If you get a report of an "overlapped extent allocation" error, this can mean that two (or more) files occupy the same disk space on the external drive, with at least one of those files potentially corrupted. In such a case, you can check each of the listed files to detect if they are, indeed, corrupted. (most of the listed files will have aliases in a "DamagedFiles" folder at the top disk level) .

After the manual check is complete, you can delete a corrupted file as long as you can replace or recreate it.

If the file can't be replaced but contains data you need to access, you can open it and examine the information that has avoided corruption.

If you can't access the file at all, it's best to restore it from a reliable backup or turn to professional data recovery software.

2. If you receive a report stating that the First Aid process failed, you can rerun it to try to repair the external disk. If the process fails again, you can back up as much data as possible from the drive and then opt for data recovery solutions. If you have a reliable full system backup, you can reformat the external drive, reinstall your macOS instance, and then restore all data from the backup.

Suppose you accidentally delete a file on external storage media mounted to your Mac. In that case, the files are moved to the Trash folder and, depending on your settings, will remain there either for 30 days or indefinitely until you delete them manually from Trash. This applies not only to external hard drives but also to other storage devices, such as a USB flash drive or a memory card.

To recover data after accidental deletion, you can follow the steps below:

1. Click the "Trash" icon in the Dock.
2. Browse and select which files you want to recover.
3. Right-click the selected files and choose "Put Back" to restore them from Trash.

Sometimes, the Trash folder may be missing from your Dock, or the deleted files may not appear in the Trash folder. In such scenarios, you can open the .Trashes folder via Finder and check for the desired files there. To open the folder, simultaneously press the Shift + CMD + G keys. In the "Go to Folder" dialog box, type "Trash" to go directly to the Trash folder or open .Trashes -> Trash. Then, you can right-click the files you wish to restore and select "Put Back".

While free data recovery software can yield results in some scenarios, recovering lost or corrupted data from an external hard drive is often more challenging for free solutions. To ensure a successful data rescue following a system crash, hardware failure, or virus attack, it's best to rely on a dedicated data recovery solution, such as Acronis True Image.

• Full image, incremental, and differential backups, real-time disk cloning, recovery drive, dissimilar hardware restores, reliable disaster recovery;
• Selective file and folder backups, file sync and sharing, Microsoft 365 backup, dual backup protection, and cloud restores;
• End-to-end cryptography, user-specified encryption keys, fortified data storage infrastructure;
• 2FA, antivirus, anti-ransomware, and cryptojacking protection; real-time protection, malicious URL filtering, vulnerability assessments, on-demand antivirus scans; behavioral analysis engine, signature-based threat analysis, quarantine and exclusion management, and videoconference security;

You can control all Acronis True Image features from a unified cyber protection dashboard, allowing flexible process management, remote data access, and unlimited mobile device protection.

1. Download the ACPHO installation file from your Acronis account or the purchase confirmation email. It's best to use the latest available product build.

For a Windows computer, follow the steps below:

1. Double-click the installation file to run it. The product will check for available updates and offer to download a newer version (if available). After the check, you can select the installation mode:Select Install for a default installation.Select Custom installation to customize the required components.Here, you can configure the following components:Backup and core componentsAnti-ransomware protectionActive protection, Antivirus scans, and Web filtering
2. Select Install for a default installation.
3. Select Custom installation to customize the required components.Here, you can configure the following components:Backup and core componentsAnti-ransomware protectionActive protection, Antivirus scans, and Web filtering
4. Backup and core components
   
5. Anti-ransomware protection
   
6. Active protection, Antivirus scans, and Web filtering
7. Post-configuration (or after choosing the default installation option), the product will be installed on the system partition (typically - C:)
8. A computer reboot may be required to finalize the installation process. Following successful installation, you must activate your copy of Acronis True Image.

For a Mac computer:

1. Double-click the ACPHO setup file (it has a .dmg extension).
2. Double-click "Install Acronis True Image" in the Acronis True Image window.
3. Follow the steps in the installer.
4. Upon being prompted, provide your administrator credentials. The solution will then be installed.

Manually testing terminal commands or leveraging expensive data recovery software can successfully recover data from an external drive. However, the process may be challenging and cumbersome; it can also fail to restore all lost files, leading to permanent data loss.

Dedicated, continuous backups are a more accessible and reliable way to recover files after accidental deletion, hardware failure, or a malware attack. Acronis True Image allows users to quickly create backups, recover single files or entire systems, and manage all backups from a centralized, user-friendly console. You can create partial or image-based backups, employ military-grade encryption to all backup data, and recover deleted files flexibly whenever needed.

As long as you've configured a relevant backup schedule and retention rate, your external hard drive files will always be readily available for recovery regardless of the data loss scenario.

If you decide to leverage ACHPO to create regular, reliable backups of all primary and external device data, you can follow the steps below to recover lost files on an external hard drive in just a few clicks.

1. Log in to your Cyber Protection console -> select the machine (or, in this case, the external device) for which you want to recover deleted files -> click Recovery.
2. Select the corresponding backup location from which you want to restore lost data.
3. If the backup contains multiple recovery points, select the most relevant one for your case.
4. To restore individual files from a full system backup, select Recover... -> Files/Folders from the drop-down menu.To restore deleted files from a file/folder backup, select Recover files/folders.
5. Select which files (or folders) to recover and click Recover.
6. Choose the target (recovery) destination to download or restore the backup data to.
7. Click Start recovery to initiate the restoration process.

If you accidentally delete a file on your external hard drive, you can typically restore the data from the Recycle Bin folder (on Windows machines) or the Trash (for Mac users). You can simply open the Recycle Bin, select the files, and restore them to their original location.

However, if you have already emptied the Recycle Bin (or if the file is erased or deleted due to a complex data loss scenario), there's a risk that the deleted file will be overwritten by new data.

When your system marks the hard drive space as "free" following deletion, it can automatically send new data to the same location on the external hard drive where previous data used to reside. In such a scenario, the external drive's magnetic domains are re-magnetized, erasing all previous information. This will replace the overwritten data with new data without a way to recover the original contents. The simplest solution to such a problem is to have a reliable backup of your external hard drive data. In such a case, you can quickly restore all essential files from the backup and proceed with your day-to-day tasks. However, not having a reliable backup copy means you need to restore the files either on your own (manually) or via dedicated data recovery software.

To avoid permanent data loss on your external hard drive, taking as much precaution as possible before and during the recovery process is best. Let's explore some standard best practices below.

Identifying physical damage to external disks relies on observation. As you can't physically open the drive, you must monitor its behavior to detect signs of physical damage. Let's explore some of those below.

 If you can't access external hard drive contents, you can follow the steps below to inspect the issue and try to remediate it, either manually or with the help of professional services.

Unless you have a reliable backup to restore files from external hard drives, the recovery process can be highly complex. Some hard drive issues require advanced recovery techniques, such as deep scanning and corrupted partition recovery.

A data recovery tool can typically rebuild deleted files via two primary methods. The first one - quick and easy - is to locate the file in the file directory information. This approach will list all recoverable files with their original names and attributes.

The second approach is RAW recovery. Such a method may be necessary for a hard disk recognized as "RAW" by the primary machine. A RAW state for a file system indicates that the drive has no or an unknown file system, which can result from a missing or corrupted/damaged file system. RAW recovery will leverage deep scanning technology to search and rebuild files via individual traces of lost or deleted information. It relies on file signatures to "read" and recover deleted files. After the search, RAW recovery software will list all recovered files in the main interface according to the files' corresponding file types. Keep in mind, RAW recovery won't be able to restore files with their original names and data contents when restoring from a corrupted file directory. It will be up to you to check the recovered data bits to restore the original files.

While you can use dedicated partition recovery software, you can also fix the issue manually via the Command Prompt app. However, the diskpart command will only work in case of accidental deletion. If a partition is compromised due to a software failure, malware attack, data corruption, etc., the approach may be unable to restore the deleted files.

To initiate the CMD process, follow the steps below:

1. Type "cmd" in the Desktop Search Bar -> press Enter.
2. Select "Run as administrator" from the Command Prompt app.
3. Type "diskpart" -> press Enter.
4. Type "list disk" -> press Enter.
5. Type "select disk *" -> press Enter. (here, * is replaced with the lost partition's number)
6. Type "assign letter *" -> press Enter. (here, * refers to the specific drive letter)

After completion, you should be able to access the accidentally deleted files from your external disk partition. However, in such scenarios, it's still better to either restore your data from a reliable backup or use dedicated partition recovery tools.

External hard disk encryption ensures data confidentiality while reducing the risk of a data breach. Top-tier encryption provides an additional protection layer to ensure your data is readily available for you to access and that it can't be accessed by anyone else without the encryption key. However, encrypting an already-used external disk can raise a few challenges for users. Let's explore them below.

External hard drives are convenient for data storage and transfer but are liable to physical damage, system crashes, malicious attacks, and more. Ensuring their safety is crucial to protecting stored data's integrity and availability.

While numerous data recovery solutions can restore permanently deleted files from external hard disks, they don't guarantee success in all data loss scenarios. On the other hand, continuous backups can ensure your essential information is stored in multiple locations and can be accessed and restored whenever needed.

You can back up an external disk to several locations - other hard drives, USB flash drives, SD cards, your computer, NAS, or the cloud. While most available options require purchasing multiple physical devices, a dedicated cloud backup can save you resources while ensuring an efficient recovery of deleted files as long as you have a stable internet connection.

Backing up your external disk can be done manually or via a professional backup solution. Manual backups are straightforward. For example, you can connect two external drives to your computer and manually transfer data from one to the other. You can do so with other backup options and the cloud. However, manual backups demand your attention and time. You need to physically initiate the backup to ensure all new data on the external drive is backed up to another location.

While manual backups can give you more control over the backup process, automating backups ensures you won't miss a backup. Moreover, once you configure the backup and retention schedule, you won't need to interfere with future backups. You can only check process completion reports once they're done and audit backups occasionally to optimize storage space.

Accidentally deleting files from external storage devices can quickly be remedied - you can open the Recycle Bin folder (or Trash for Mac) and restore the deleted data to its original location. However, what if you don't notice that files are deleted and empty the Recycle Bin? Or what if your hard drive suffers physical damage and becomes inaccessible? What if a malware attack strikes and corrupts all data on the external drive?

External hard disks are liable to many potential data loss scenarios, so users must be aware of the challenges and proper techniques for restoring their data and protecting it post-recovery.

You can use Windows and Mac built-in tools to try to recover data, opt for dedicated data recovery software, or turn to professional services to inspect the hard drive and try to collect essential information. While all of the above can yield satisfactory results, the best way not to lose data from your external hard drive is via regular, continuous backups.

Instead of investing time, nerves, and resources to recover corrupted, erased, or otherwise inaccessible files on your external disk, you can ensure efficient recovery via dedicated backups. Robust solutions, such as Acronis True Image, can automate external disk backups to protect all newly created data by storing it in multiple locations - physical and the cloud - to satisfy the 3-2-1 Rule of Backup. Multiple data backups ensure that, even if your external drive is somehow compromised and you can't access its data, you can quickly initiate external hard drive recovery to the same or another storage device in just a few clicks.