Computer Data Recovery

Occurrence of data corruption, damage, or failure is certainly a great loss. There are other instances where it is difficult to access the secondary storage media. However, the optimistic side to it is that there are various tools that can be used to recover data. These tools provide a convenient way to recover data. Essentially tools for data recovery are required to salvage physical damage or logical damage. These data can be retrieved from the storage media formats such as storage tapes, hard disk drives, RAID, DVDs, CDs and other such devices.

Data Recovery Tools

Boot media

In most cases, it is not possible to perform forensics operation and data recovery on a running system. It requires a specialized boot disk, Live USB or Live CD for this. Apart from it, any such Live Distro - operating system that is executed upon boot, without installing the hard disk drive and a repair tools can also be used. Most of operating system developers now include recovery tools on the same media where the OS installer is provided.

Several multi purpose Live Distros have been developed that incorporate data recovery and forensics tools. Here are some of them:         

• SystemRescueCD – It is a Linux-based CD, which comes with tools for Linux and Windows based repair.   
• Inquisitor[1] – This tool from Linux provides hardware diagnostics, benchmarking Live CD and stress testing  
• RIP: (R)ecovery (I)s (P)ossible – It is a Linux-based CD that comes with network tools (Samba) and partition tool.   
• Hiren's Boot CD - It is a CD based on DOS for rescuing filesystem, which also encloses partition and Windows tools. 

Some specialized data recovery software tools

CHKDSK

Essentially this is a command that displays the file system integrity status of hard disks and floppy disk. This command operates on computers running DOS, Microsoft Windows operating systems and OS/2 and can check the logical file system errors. It performs the function as the fsck command in UNIX. Earlier the SCANDISK was used to check the surface for bad sectors or physical errors. However, the new version of CHKDSK is capable of performing the function of SCANDISK and can assist in recovering data that is readable.   

Fsck

In UNIX, the Fsck (“file system check” or “file system consistency check”) is tool used for checking the consistency of a file system. This is also applicable to operating systems similar to Unix such as AIX and Linux. If the system finds that a file system is in an inconsistent state due to improper shutdown because of power loss or crash, the fsck runs automatically at boot time. Normally the fsck utilities offers options for automatically deciding the ways to fix specific problem, review the trouble that has to be resolved on the file system or repairing damaged file systems, (the user must decide how to fix specific problems). The system administrator might also run the Fsck manually in case the file system has some problem. However, running fsck on a mounted file system can potentially cause severe data corruption/loss.

Disk First Aid

It is a software utility developed by Apple Computer. It is operates on Mac OS and enables verification and repair of directory structure of any volume or HFS or HFS Plus hard disk. First the Disk First Aid conducts an analysis of the disk directory structures that discloses the specific types of damage that may occur and provides a report about them. Next, the Disk First Aid decides whether it would be able repair the detected damages. It can only repair those damages, which it is intended to repair.      

Disk Utility

It is a utility that can execute disk-related tasks in Mac OS X. Developed by Apple, disk utility has been designed to perform the task of creation, encryption, conversion and compression of disk images from extensive formats read by Disk Utility to .cdr or .dmg. Further, this utility also carry out verification of disk's integrity, and repairing it if the disk is damaged; secures deletion of free space or disk using a 35-pass Gutmann algorithm adding or changing partition table between GUID Partition Table and Apple Partition Table; enables or disables journaling; creates, destroys, and repairs RAID sets;  restores volumes from scanned for ASR images and many more.       

Various File recovery tools

Here are some of the tools designed for file recovery:

Some forensic data recovery tools

The Sleuth Kit

Essentially this kit is used for forensic analysis of computer systems. It incorporates a collection and a library of Windows and Unix based utilities and tools. Using the TSK images from the Windows, Linux and Unix computers can be extracted for investigations. To provide an easy and simple interface, The Sleuth Kit can be used along with custom front-end application – Autopsy.   

PTK is its new front-end extended interface. TSK is also used with other tools for File extraction. Moreover, the advantage of The Sleuth Kit is that it is a free, open source suite and offers several specialized command-line based utilities.   

The Coroner's Toolkit (TCT)

It is a collection of computer security programs. In case of a break-in in the UNIX system, this suite can be effective and efficient in forensic analysis. Further, it has a port to HP-UX and runs on BSD/OS, SunOS/Solaris, OpenBSD, FreeBSD and Linux.  TCT incorporates certain parts that can be used for salvaging and analysis of data damaged due to computer failure.     

EnCase

This is exclusive forensic software products produced. It enables forensic quality recording of data stored in PCs. The insecurely deleted data can also be recovered through Encase. However, this software cannot be operated without special training.        

Imaging tools

The entire structure and contents representing the data storage medium or device like CD, DVD or hard drive, is contained in a single file that is disk image.  From the source media each section is copied creating a disk image file by overlooking the file system. This perfectly replicates the structure and contents of the storage device. In some cases, the disk is compressed to minimize the storage requirements. Such files are referred as archive file and does not provide literal disk image. There are certain disk imaging utilities which may also remove unused file space from the source media.      

Foremost

It is console program based on the procedure of data carving. Foremost has been designed to recover files based on their internal data structures, footers and headers. A configuration file can be used to specify the header and footer. Built-in file types can also be specified using the command line switches. Further, it can also work directly on the drive.   

dd (Unix)

This is a program intended conversion and low-level copying of data. In this, dd stands for “data definition.” dd enables the user to copy portions of raw device files. For example, it can provide back up of the boot sector of a hard disk. It also helps to read fixed amounts of data from special files such as /dev/zero or /dev/random. Further, dd can be used to copy a particular number of blocks or bytes accomplishing EBCDIC to ASCII conversions or on-the-fly byte order conversions.