BPC, Articles and Glossary

Data Recovery: What is Data Recovery?

Definition: Data recovery is the salvaging of data originally stored on media such as magnetic disks and tapes and which has become corrupt or inaccessible.

Data is stored on media like hard disks, RAID configurations of hard disks, magnetic disks, tapes, CDs, DVDs, floppy disks and other storage media. Data gets damaged or missing in a variety of ways from virus attacks to improper storage of the media to accidents like floods. It could also have simply just been erased. Very often a large percentage of this data can be recovered using a variety of techniques. 

Recovering or salvaging the data from such media can sometimes be performed using simple hardware or software but may occasionally require the assistance of data recovery specialists.

Some examples of data recovery:

- With optical drives there are options to repair the small nicks and scratches on the underside of your CD/DVD. Some consumer level repair products are available from your local PC shop. They often involve a two stage process of filling the nicks and then sealing the surface. Done correctly this will sometimes allow reading of data that was previously inaccessible.

- With hard disks the fault could be either mechanical/physical or logical. If the motor or PCB (Printer Circuit Board) of the hard disk is damaged but the platters themselves (where the data is stored) are intact then the motor/PCB could be replaced with another one. If the mechanics are undamaged but the data has been deleted/written over or the "index" of the files has been damaged a Hex Editor will facilitate the viewing of the drive in absolute sector mode i.e. one sector of 512 bytes at a time. The first sector of your hard drive is used as a partition block providing information on disk size/partitions/file system etc. And, from there, markers to the previous "location" of your data can be found.

Note: Both of these are jobs best left to people who specialise in data recovery.

- With errors in RAID configurations e.g., RAID 0 where data is striped (split) over two different physical drives it is possible to recreate the RAID array and or recover the data from each drive separately and "merge" them back to their original state. (See RAID data recovery)

Can erased data be recovered?

Yes, usually. When you delete a file the file is not actually deleted. It's just the entry in the index pointing to the file's actual location that is deleted. The file itself is left untouched but subsequent work you do on the PC could overwrite the location where the file was so it's important to minimise any amateur attempts at data recovery.

How can I completely erase a hard disk? 

You can't. Any data you've deleted can probably be recovered later. Formatting doesn't remove the data beyond recovery. Neither does low-level formatting or "shredding". Even when every single byte of information on your drive has been written over a lot can still be recovered by extra sensitive recovery systems in use by the local plod (well, maybe not him but his peers in their hi-tech departments). But, always seek assistance at the earliest signs of trouble rather than relying on the assumption that everything can be recovered.

Prevention

Prevention is, of course, better than finding a cure. Have a disaster recovery plan, do frequent backups. Keep your backups in a different location. Test that your backups work and can restore your systems to a fully working condition.

What you can do wrong:

1. When you think you have experienced some data loss STOP. Make a note of the last things you did including what software was last installed on the PC, the last application you ran, the last upgrade you did etc. It would be useful to the data recovery team. DO NOT attempt to make changes to your data/your drive.

2. DON'T open the drive to see if you can "repair" it. These drives are usually worked on in environments stricter than a hospital operation theatre. The smallest spec of dust getting into the drive could render it useless.

3. Spend some time to research a good data recovery firm. Just as with any other industry there are some cowboys around.

4. If you have a desperate need to work on whatever other data you still have on the drive you could make a mirror (depending on the circumstances). But DON'T work on the original drive.

5. Treat the drive with kids gloves. Pack it and double pack it even more than you would a new born baby (if you ever pack new born babies). Hard disks are sensitive to shock. A faulty one is several times more sensitive to the smallest knock.

Free Data Recovery Software

Some data recovery software is freeware i.e., you do not need to pay for it. Much of the rest of the industry offers free trials but with limited program functionality (other functions are unlocked on payment of a fee). Whatever the software, though, a potent point to remember is that when you download the program it is best saved on a disk other than the one you hope to recover data from or you could be permanently erasing otherwise recoverable data.