With a badly corrupted disk, a very good way to extract files can be using raw file recovery. This can be both very successful, though sometimes limited in it’s outcome.

The major success of this method, is that files can be recovered with no operating system details intact. The downside, is that typically, filenames are lost, and there is normally a problem with fragmented files. For CD, or memory chip storing photos, this approach will actually achieve exceptional results, as often the name of the file is meaningless anyway. For a full hard drive, with many documents, documents may be recovered, but names may not be very accurate, or totally missing. However, this technique will work on disks where the complete operating system has been corrupted, or even changed to a new operating system.

The method works by scanned the complete disk, and typically testing the start of each block for a signature. For instance, a TIF file will always start with either II or MM, and a Word document with the hex string D0h 0Ch F1h, and an EXE file with MZ. The tests are often more comprehensive, and at times a file name may be extracted. For instance, on some photos, it is is possible to extract the time the photo was taken, and this is then added to the file name.

The list of file where the file name is extracted from the raw file is increasing. It is not always 100% but may often give an indication of original filename. The current list includes

• JPEG/JPG  The date and time taken and name of camera, or photoshop metadata
• PDF The file title
• WMF The name of the track
• MP4 The name of the track
• DOC Often the document title