Recovery starts by stopping writes. Install the tool on another disk. Land the recovered files on a third one. The source stays read-only.
Recuva
Recuva (Piriform) is a simple undelete. A wizard, the Recycle Bin, a signature scan. It hits when the NTFS or FAT volume is healthy, the file was deleted recently, and nobody has overwritten the clusters. You get a list, you tick rows, you copy them elsewhere.
It stops where the drive letter, the partition table, or the boot sector disappears. You will not open a ddrescue image in it the way you open one in a disk editor, and you will not rebuild a tree from a damaged $MFT.
DMDE
DMDE (DM Disk Editor) is a disk editor. It opens a physical disk or an image file. It searches for lost partitions, scans NTFS, FAT, exFAT, and ext, and shows raw sectors when the metadata is lying.
Reach for it when:
- the partition disappeared, or the volume was quick-formatted
- the boot sector is junk and the clusters are still there
- you are working from an image, not from the only live disk
- Recuva returns an empty list or broken names on a drive that still reads
The free edition limits how much you can recover at once. A larger directory tree needs a license. Know that before you promise a complete set of files.
The difference
Recuva extracts a file whose record still points at clusters. DMDE rebuilds the volume when Explorer can no longer see that map.
| Recuva | DMDE | |
|---|---|---|
| Healthy disk, yesterday’s Recycle Bin | this is what it is for | possible, usually a heavier tool than the job |
| Missing partition, image file | does not open that case | yes |
| Sector view, manual reconstruction | none | yes |
| Heads, TRIM, dead SSD controller | does not touch the hardware | does not touch the hardware |
Neither undoes TRIM, and neither reads NAND past a dead controller. On an HDD, deleted clusters often still sit on the platter. On an SSD the same Recycle Bin can be empty after a few minutes of the machine staying on. More on that split: Recovering data from an HDD in DMDE.
Make an image before you write anything back to the source. Intake and the copy step are in the forensics worksheet.