Computer Data Recovery

Loss of data due to corrupted, damaged, failed, or inaccessible from secondary storage media is a major concern while working on any system. Usually such data is recovered from the storage formats such as storage tapes, hard disk drives, CDs, DVDs, RAID and other such electronic units. In general, there can be two types of damage to the file system, which stops the file from being mounted by the Operating System – logical damage to the file system and physical damage to the storage device. However, there are feasible techniques for data recovery that may help in protecting and salvaging data from storage media. In terms of forensic or espionage, data recovery is specifically meant to recover deleted information from the storage media.

Recovering data after logical damage

Sometimes due to power failure, the file system structures are not completely written to the storage system. Further, this can also occur due to snags in the drivers and hardware (such as the RAID controllers) or in case, the system crashes. Such problems with the file system lead to state of inconsistency, which is the primary cause of logical damage. Discrepancy in the system may lead to a number of other difficulties such as abnormal behavior of the drives showing negative amounts of free space, directories recurring indefinitely. This causes actual loss of data or the system might also crash.                

Such inconsistencies in data can be checked through a number of programs. However, most of the operating systems come with at least a rudimentary repair tool designed for the native file system. Operating systems like Microsoft Windows has a chkdsk, Mac OS X provides disk utility and Linux comes with fsck utility. Further, third party utilities can also be used to recover data such as The Sleuth Kit and The Coroners Toolkit. Further, utilities such as TestDisk can be used for reconstruction of corrupted partition tables.              

In some cases, certain logical damage might be incorrectly associated with physical damage. Sometimes the read/write head begins to click the end users; however, this is often confused as internal physical damage. The truth is that if the firmware of the drive or its controller should be rebuilt to make the data accessible.      

Techniques for recovering logical damage

There are two common techniques used to recover data from logical damage – data carving and consistency checking. There are several data recovery software, however these cannot guarantee lost data recovery. The two techniques can repair or work on the logical damage to the data.    

Consistency checking

In consistency checking, the logical structure is scanned of the disk and then it is checked to make sure that it is consistent with its specification. This can be explained as, if in most systems, a directory has at least two entries – a dot-dot (..) entry pointing the parent and dot (.) entry representing itself. A file system repair program reads each directory, which also ensures that the entries exist and it point the specific directories. However, if this goes wrong an error message is displayed and then the problem is repaired. This is the way in which fsck and chkdsk works. However, the technique of consistency checking fails if the file system is completely damaged.          

Data carving

This technique of lost data recovery is applicable for data with no file system allocation information, which is extracted by identifying sectors and clusters in the file. In the data craving technique, the raw sectors look for detailed file signatures. In this technique, the seeker of data must specify a block size of data to dig out the matching file signature. If the beginning of the file is still present, there lies the risk (depending on the uniqueness of the file signature) as there can be many false hits. Further, for data carving it is also important that the files to be recovered should be located in sequential sectors, especially as there is no allocation information. However, this process is not only time taking but also resource intensive.       

Recovering data after physical damage

Physical damage to the storage media can be caused through different types of failures. There may be some mechanical failure in the hard disks such as failed motors and head crashes. Moreover, the dye layer or metallic substrate may be scratched or the tapes can simply break. There is certain portion of data lost if not all due to physical damage. In some cases, there may be damage to the logical structures of the file system. For the hard drive data recovery, it is essential to deal with the logical damage.  

In most cases, the physical damage are repairable by the end users. In case the hard disk is exposed to the natural environment, dust particles settle over the read/write head and platter. Further, this causes new head crashes causing more damage to the platter. To repair this, it requires hardware or technical expertise. There are several data recovery companies, which can be hired to salvage important data. The hard drive manufacturers accept data recovery firm with pass certificate of IS0-5.         
 
In order to release a jammed platter some whacky tricks are often used. Making the drive cold (in freezer) or manually spinning it on the ground. The data recovery professionals denounce the use of tricks as this can cause additional physical damage. 

More data recovery techniques

There are various techniques of recovering data from the physically damaged hardware. The physical damage can be checked by replacing certain sections of the hard disk. However, if there is a logical damage, data recovery can be accomplished through a disk-imaging procedure. This process can help to recover every readable bit from the surface.  In this system, the image of the data is acquired and saved on a different medium. Further, the image can be saved and analyzed for the logical damage and allows the reconstruction of the original file system. 

Repairing the hardware

There are different techniques of physical recovery. For instance if the PCB (printed circuit board) has been damaged, it can be replaced with a compatible PCB from the healthy drive. In case, the hard disk platters from a damaged original drive can be installed into a healthy drive. Similarly, if the original read/write head gets damaged it can be replaced with compatible parts. However, these techniques are technical in nature and should not be performed by an untrained individual.