Using DiskSalvor

Install and start

DiskSalvor runs on Windows 10 and 11. It needs Python, a free program it's written in.

1. Install Python 3.9 or newer from python.org. In the installer, tick "Add python.exe to PATH".
2. Unzip DiskSalvor into a folder on your computer, for example Downloads. Not on the drive you want to rescue.
3. Double-click Run DiskSalvor.bat. A small black window opens (keep it open: closing it closes DiskSalvor) and your browser shows DiskSalvor. If you close the browser tab, press O in the black window to open it again.
4. Plug in the drive and pick it under Choose the drive. Windows asks for your OK the first time: reading a whole drive needs it. Disk images don't.

Want to try it first? Unzip demo\DiskSalvor-demo-failing-drive.zip and open the image with Open a disk image. It's a made-up failing drive, so you can watch a whole rescue without risking anything.

For a Start-menu shortcut with the logo, run tools\make-shortcut.bat once.

Rescue it for me

The simplest way: answer four questions, and DiskSalvor runs every step by itself, easiest files first, copying after each step.

1. Where should the files go? A folder on a different drive with room for them. DiskSalvor refuses a folder on the drive you're rescuing, and checks the room before each copy.
2. What matters most? (optional) Click the kinds of files in the order you care about them: Documents, Photos... They're copied first in every round, so if the drive gives out, they're already safe.
3. How far should it go? Standard doesn't read the whole drive and usually gets almost everything. Thorough also searches the whole drive for files whose index entry is gone: hours on a big drive, and harder on it.
4. If the drive turns out to be healthy: stop and say so, or copy the files anyway.

While it runs

Each step shows what it did, with Details read by read. Pause lets the read under way finish, then waits. Stop stops cleanly; nothing is lost and you can continue later. When the drive keeps hanging, DiskSalvor rests it with a countdown and tries again. It stops by itself if the drive disconnects or gets worse.

When it's done

You'll find your files in the folder you chose, with their folders and dates, and DiskSalvor rescue report.txt: what was recovered, what's missing and why, and what to do with the drive now.

Step by step: the rounds

Prefer to start each step yourself? Choose I'd rather go step by step. The left column then shows every step; the one to do next is marked Next.

What the drive's condition means

After the first look, and again as it learns more, DiskSalvor gives the drive a verdict, a severity and what to do. When the verdict changes, it says so.

Why a verdict, not just numbers: the same 10 bad sectors can be a one-off scratch or the start of a head failure. The verdict comes from where the problems are, whether they're growing, and what the health log says. How the health log works.

What Windows has seen

Windows keeps its own record of trouble with every drive: bad blocks, reads or writes it had to retry, sudden disconnects. The first look reads that record (nothing is read from the drive for it) and keeps only what happened while this drive was connected: Windows gives disk numbers in the order drives are plugged in, so DiskSalvor checks which drive had the number at the time. Problems grouped in one place point to the drive itself; on a memory card or stick, often where it was last written, which the drive's own tests can't see. Problems spread all over can just as well be the cable, the reader or the power.

Your recovered files

Files keep their names, folders and dates. Files on unreadable spots are copied anyway, with the unreadable parts filled with zeros, and marked damaged so you know which ones to check.

In the destination folder

What each result means

If a file of yours with the same name is already in the folder, DiskSalvor never replaces it: the copy is saved next to it as name (recovered).ext, and the report says so.

Files Windows stored compressed (NTFS compression) are unpacked as they're copied. Files Windows stored encrypted (EFS) are copied as they are on the drive: they open only on the Windows account that encrypted them.

File types: what knowing a type adds

DiskSalvor rescues every file it finds, whatever its type. A file of a type DiskSalvor has never heard of comes back exactly like a photo does. Knowing a type doesn't decide whether a file is rescued; it opens up more ways to find it and handle it:

By name: the groups

Everything else is rescued under "Other". Common types without a group of their own (settings, logs, program code, web pages, fonts, shortcuts) count as known; the rest are listed as new to DiskSalvor, so they can be sent in.

By content: what the first bytes say

Most file types start with a few fixed bytes, a "signature" (a JPEG photo starts FF D8 FF, a PDF with %PDF). DiskSalvor recognises these:

Plus plain text, XML, HTML, JSON, e-mail and mailbox files, recognised by what the text looks like. The signatures come from public format specifications and public references (the file command's magic list, the UK National Archives' PRONOM registry, Gary Kessler's signature table).

Teaching DiskSalvor a new type

On Rescue it for me, open File types: types that are new to DiskSalvor are listed (already rescued, like everything else) with what their first bytes say, taken from a copy already on your destination (nothing more is read from the drive). Send these types to the DiskSalvor team opens an e-mail in your own mail program with the extensions, how many files have each, the guess, and the first 16 bytes of one file each. Never file names. You see the e-mail before it's sent; for text files those 16 bytes can be readable words, so check them.

Safe copy: an image of the whole drive

A safe copy reads the drive once, easy parts first, into one big file (an image) on a healthy drive. After that, everything else happens on the copy, and the failing drive can be unplugged.

When to make one

When the drive is degrading, or when you expect to need several passes (a search by content, say): every pass on the copy is a pass the failing drive doesn't have to survive. For a drive with a few weak spots, the rounds above are usually enough.

Room it needs

Only your data copies the used parts of the drive. On an NTFS destination that takes about as much room as the data; exFAT and FAT32 can't store the empty parts as nothing, so they need the drive's full size. Everything always needs the full size.

Stopping, resuming, and what DiskSalvor remembers

Everything DiskSalvor learns about a drive is saved as it goes: the file list, which areas are unreadable or weak, what was copied where. When you open the same drive again, it offers to pick up from there, without reading anything from the drive.

1. Stop any time with Stop, or quit with Q in the black window. Closing the laptop is fine too.
2. Next time, open the same drive. Choose Use the saved results, then continue the rescue where it stopped. For a card, a stick or a drive without a serial number of its own, DiskSalvor first shows the drive the notes came from and asks whether it's the same one; it also compares the drive's first sectors, and never offers one drive's notes to another.
3. To start from zero (for a test), use Start over and tick forget what was learned. The old notes are kept as a dated backup.
4. To delete the notes for good (when you hand a drive back to its owner), use Reports & exports › Delete for good. Your recovered files aren't touched.

The notes are in DiskSalvor data, next to Run DiskSalvor.bat (you can choose another folder on the first run). Each run also writes DiskSalvor log.txt; older logs move to DiskSalvor logs.

Is it safe? What DiskSalvor never does

1. It never writes to the drive it rescues. Every command it sends to a drive passes an allow-list first: reading sectors, and reading the health log. Anything else is refused before it leaves DiskSalvor.
2. It never copies onto the same drive. A destination on the drive being rescued is refused, and so is one Windows can't confirm is elsewhere.
3. It never replaces your other files. A file of yours with the same name gets the copy saved next to it, as name (recovered).ext. A safe copy won't replace a file that isn't one of its own copies of this drive. The careful retry (round 4) leaves alone any copy you have opened and saved since.
4. Nothing leaves your computer, and only the browser tab DiskSalvor opened can use it: other websites, and other programs on your computer, are refused.
5. It doesn't fight a failing drive. Its own time limit on every read (seconds, not Windows' minutes), weak areas skipped and tried last, and it stops when the drive gets worse.

One detail for experts: to ask a drive how long it retries a bad sector (Drive tests › Identify), DiskSalvor uses the drive's SCT command mailbox. Technically that's a "write log" command, but it goes to the drive's command mailbox, writes no sector of your data and changes no setting.

For staff: rescuing other people's drives

A routine for help desks and anyone who rescues drives for others. It keeps the drive safe before DiskSalvor even starts, and leaves nothing of the owner's behind afterwards.

1. Before you plug the drive in, stop Windows from opening it. When Windows mounts a damaged NTFS drive it replays the drive's journal, which writes to it, and Explorer, search indexing and antivirus all start reading it. Connect your destination drive first, then in a Command Prompt run as administrator type mountvol /N (new drives don't get mounted). DiskSalvor reads the drive directly and doesn't need it mounted. Afterwards, mountvol /E turns it back on. Never click Format, or Scan and fix.
2. Connect it straight to the computer: no hub, a good cable, and its own power supply if it has one.
3. Start DiskSalvor, pick the drive and read the first-look verdict.
4. Healthy, or a few weak spots: Rescue it for me, into a new, empty folder on a different physical drive.
5. Degrading, clicking, or getting worse: stop, and decide between a safe copy and a recovery lab.
6. Check the result: open a sample of the recovered files, above all the ones listed as damaged.
7. Hand the files over, then delete what DiskSalvor kept about the drive: Reports & exports › Delete for good.

Questions and problems