DATA RECOVERY

 

Despite the constant growth in reliability of storage devices, loss of digital information remains quite a common occurrence. Generally, causes of data loss include human errors, power outage, hardware failures, and software malfunctions including computer viruses and worm infection.

 

Luckily, any data or information stored on a digital medium is always recoverable. Nonetheless, this does not apply in circumstances where information has not been actually written on a digital media. So, what is data recovery and how does it happen? In this guide, we discuss data recovery.

 

What is data recovery?

Data recovery refers to a process of securing or salvaging data from a failed or compromised hardware system. In addition, in data espionage or forensics, it refers to a technique of obtaining data from “hard to get” data, especially during hardware or system failure or when the system data when it gets erased.

 

The most common data recovery scenarios include when an operating system fails, hardware or storage malfunction, logical system failure or accidental deletion of data among others. Despite the data loss, the ultimate goal of data recovery is to simply copy all the important files from the damaged media to another new one.

 

Logical Data Recovery

Sometimes, data on a hard disk can be rendered unreadable due to the damage of partition tables or file systems. In most cases, a majority of the data can be recovered by repairing the damaged partition file or partition using specialized data recovery software. Some of the widely used software in recovery logical damaged data include Test disk, dd rescue, and image raw data.  Logical damage can be repaired by anyone even without expertise in hardware drive. The process requires no special access to platters or physical equipment. Additionally, sometimes data lost through logical damage can be recovered using relatively simple tools and methods. However, in more serious cases, an expert intervention is required, especially in parts where files are irrecoverable. One can use data carving method to recover the data. Data carving refers to the recovery process of damaged files where one uses prior knowledge of their structure.

 

Overwritten data

Once data is physically overwritten, it is assumed that the previous data cannot be recovered. According to Peter Gutmann, the scientist claims that even overwritten data can be recovered through the use of Magnetic force microscope. Although other scientists disagree with him over his claims since there is no concrete evidence to back his claims, although he may be correct.

 

On the other hand, Solid State Drives overwrite data differently from HDD that makes at least some of the data be recovered easily. Most of the SSDs use flash memory to store data in blocks and pages refined by logical block address that is managed by the flash translation layer. When the flash translation layer modifies a sector it writes the new data to another location and updates the map so the new data appear at the new target. Thus, leaving most pre-modification of data in place with the possibility of being recovered by data recovery software.

 

Physical damage

Different factors can result in physical damage to storage media. Some of the common factors include human error and natural disasters. For CD-ROMS, the dye could get scratched off, while hard disks can suffer from a multitude of mechanical failures like head crashes, failed motors, while tapes can simply break off. In cases of physical damage, it does not mean the data is permanently lost. Typically, most professionals in the data recovery industry can salvage most, if not all of the data that was lost when the failure occurred.

Human errors are the second most common causes of data loss after hardware failure. Hard disks are always compact and fragile. Thus, any little chock can result in a non-functioning hard drive and permanent data loss situation. Therefore, it is critical to handle your hard drive with the utmost care.

 

Recovery Techniques

Recovering data from physically damaged hardware can involve multiple techniques. Some damages can be recovered by replacing parts of the hard disk. By replacing parts of the disk may be usable again, however, there still be some logical damage. Additionally, a specialized disk imaging procedure is used to recover every readable bit from the surface. Once the image is acquired and saved on a reliable media, the image can then be safely analyzed for logical damage and will possibly allow much of the original file system file system to be reconstructed.

 

Hardware Repair

One of the common misconceptions is that when a printed circuit board is damaged, it can simply be replaced during the recovery procedure by an identical printed circuit board from a healthy driver. This may work in rare circumstances on the hard disk drives manufacture before 2003, it might work on newer drives. Electronic boards of modern drives usually contain drive-specific adaptation and other information required to properly access data on the drive. Replacement of boards often needs this information to effectively recover all other information required to properly access data on the drive.

 

Remote Data Recovery

Whenever there is a data loss, there is no need to have physical access to the damaged hardware, especially when the lost data can be recovered by software techniques. Recovery experts often can perform recovery using remote access software over the LAN, Internet and other connections to the physical location of the damaged media. Although the process is not different from what the end user could perform by themselves. Additionally, remote recovery requires a stable connection with sufficient bandwidth. Nonetheless, it is not applicable where access to the hardware is required, as in the case of physical damage.

 

Data recovery phases include

Generally, there are four phases when it comes to successful data recovery, though it depends on the type of data corruption and recovery required.

 

Phase 1: Repair hard disk drive

The first step requires you to repair the hard disk to some running form or in a state where the data can be read. For instance, if the heads are bad, they need to be changed, if it’s the PCB which is faulty, it needs to be replaced or fixed or if the platters or motor is bad, they should be moved to a new drive.

 

Phase 2: Imaging the Drive

The second step requires imaging of the disk or drive. One a hard disk or drive fails, the first priority is get the data off the bad disk. The longer the faulty disk is used, the more likely a data loss is to occur. Thus, creating an image of the drive will ensure that there is a secondary copy of the data on another device.

 

Phase 3: Logical, Partition and MBR file system structures

After cloning a faulty drive to a new one, it is safe to attempt to retrieve the lost data. If the disk failed logically, there are different reasons for that. Through the clone, you can repair the partition table or the master boot record in order to read the file systems and retrieve the stored data.

 

Phase 4: Repair Damaged Files

Data damage can occur when a file written to a sector on the drive is damaged. In fact, this is the most common cause of failing drive, meaning the data needs to be reconstructed to become readable once again. Corrupt files can be retrieved using different methods either manually or through the use of recovery software.

 

In conclusion

 

There are many angles to consider from a data recovery standpoint, and none of the recovery techniques are foolproof and without risk.  In order to protect yourself, we suggest a robust backup solution customized for your environment.   If the data you require would be ‘nice to have’ rather than absolutely critical, you can try a free utility called Recuva which can offer good results and a very simple learning curve as well.