In computing, data recovery is the process of saving (retrieving) data that is inaccessible, lost, corrupted, damaged or formatted from secondary storage, media or transferable files, when data stored in it can not be accessed in the normal way. This data is most often saved from storage media such as internal or external hard drives (HDDs), solid state solid disks (SSDs), USB flash drives, magnetic tapes, CDs, DVDs, RAID subsystems and other electronic devices. Recovery may be required due to physical damage to storage devices or logical damage to the file system that prevents it from being installed by the host operating system (OS).
The most common data recovery scenarios involve operating system failures, storage device malfunctions, logical failures of storage devices, accidental damage or deletion, etc. (Usually, on a single-drive, single-partition, single-OS system), in this case the primary purpose is to copy all the important files from the corrupted media to another new drive. This can be done easily using a Live CD, many of which provide the means to install system drives and backup drives or removable media, and to move files from the system drive to the backup media with the file manager or optical disk writer software. Such cases can often be reduced to disk partitions and consistently store valuable data files (or copies) on different partitions of OS files that can be replaced.
Other scenarios involve a drive-level failure, such as an uninterrupted file system or drive partition, or a hard disk drive failure. In all these cases, data is not readily readable from media devices. Depending on the situation, the solution involves fixing the logical file system, partition table or master boot record, or updating the firmware or drive recovery techniques ranging from software-based recovery from corrupted data, hardware and service-based service area recovery (also known as hard disk drive "firmware"), for hardware replacement on physically damaged drives that involves changing parts of a damaged drive to make the data in readable form and copyable to a new drive. If drive recovery is required, the drive itself usually fails permanently, and focuses more on a one-time recovery, saving any data that can be read.
In the third scenario, the file is accidentally "deleted" from the storage media by the user. Usually, the contents of deleted files are not immediately deleted from the physical drive; otherwise, references to them in the directory structure are deleted, and after that the occupied data space occupied is available to overwrite the data later. In the mind of the end user, the deleted file can not be found through the standard file manager, but the deleted data still exists technically on the physical drive. Meanwhile, the original file contents remain, often in a number of fragments disconnected, and can be recovered if not overwritten by other data files.
The term "data recovery" is also used in the context of forensic or espionage applications, where data that has been encrypted or hidden, rather than corrupted, is restored. Sometimes the data on the computer will be encrypted or hidden for reasons like virus attacks that can only be recovered by some forensic computer experts.
Video Data recovery
Physical damage
Various kinds of failures can cause physical damage to storage media, which may be caused by human error and natural disasters. The CD-ROM may have a metallic substrate or a scratched dye layer; hard disk may experience some mechanical failure, such as head crash and failed motor; tapes can be solved.
Physical damage to the hard drive, even in cases where head crashes have occurred, does not mean there will be permanent lost data. Techniques used by many professional data recovery companies can usually save most, if not all, of the data lost when a failure occurs.
Of course there are exceptions to this, such as cases where severe damage to the hard drive disk may have occurred. However, if the hard drive can be repaired and a full picture or clone is created, then the logical file structure can be rebuilt in many ways.
Most physical damage can not be fixed by the end user. For example, opening a hard disk drive in a normal environment can allow dust in the air to settle on a plate and get stuck between the plate and the read/write head. During normal operation, the read/write head floats 3 to 6 nanometers above the surface of the platter, and the average dust particles found in normal environments are typically around 30,000 nanometers in diameter. When these dust particles get trapped between the read/write head and platter, they can cause new head damage that further damages the plate and thus endangers the recovery process. In addition, end users generally do not have the hardware or technical skills necessary to perform these fixes. As a result, data recovery companies are often used to salvage important data with more reputable uses of dust-free and static-free class cleaners.
Recovery techniques
Recovering data from physically damaged hardware can involve many techniques. Some damage can be fixed by replacing the inside of the hard disk. This alone can make the disk usable, but there may still be logical damage. Special disk imaging procedures are used to recover any readable bits from the surface. Once these images are obtained and stored on reliable media, images can be safely analyzed for logical damage and will likely allow many of the original file systems to be reconstructed.
Hardware repair
A common misconception is that broken printed circuit boards (PCBs) can be easily replaced during the recovery procedure by the same PCB of a healthy drive. While this may work in rare circumstances on hard disk drives made before 2003, this will not work on newer drives. Modern drive electronic boards usually contain drive-specific adaptation data (generally bad sector maps and tuning parameters) and other information required to access data on the drive properly. The replacement board often needs this information to effectively recover all the data. The replacement board may need to be reprogrammed. Some manufacturers (Seagate, for example) store this information on a serial EEPROM chip, which can be removed and moved to a replacement board.
Each hard disk drive has what is called a system area or service area ; this drive section, which is not directly accessible by the end user, usually contains the drive firmware and adaptive data that help the drive operate within normal parameters. One function of the system area is to record the damaged sectors within the drive; basically notify the drive where it can and can not write data.
The sector list is also stored on various chips attached to the PCB, and they are unique to each hard disk drive. If the data on the PCB does not match what is stored on the plate, then the drive will not calibrate properly. In most cases, the drive head will click because they can not find data matching that stored on the PCB.
Maps Data recovery
Logical damage
The term "logical malfunction" refers to situations where errors are not a problem in hardware and require software-level solutions.
Corrupt partition and file system, media error
In some cases, data on the hard disk drive can not be read because of damage to the partition table or file system, or (intermittent) media error. In most of these cases, at least some of the original data can be recovered by fixing the damaged partition table or file system using special data recovery software such as Testdisk; software such as dd rescue can be media images although there are intermittent errors, and raw data images when there is a partition table or file system damage. This type of data recovery can be done by people without expertise in the hard drive because it does not require special physical equipment or access to the disk.
Sometimes data can be recovered using relatively simple methods and tools; More serious cases may require expert intervention, especially if the part of the file can not be recovered. Data carving is the recovery of damaged parts of the file using knowledge of its structure.
Data overwritten
After the data is physically overwritten on the hard disk drive, it is generally assumed that the previous data is no longer possible to be recovered. In 1996, Peter Gutmann, a computer scientist, presented a paper that suggested the overwriting data could be recovered through the use of magnetic force microscopy. In 2001, he presented other papers on similar topics. To guard against this type of data recovery, Gutmann and Colin Plumb devised an irreversible data scrubbing method, known as the Gutmann method and used by some disk removal software packages.
Substantial criticism has followed, especially dealing with the lack of concrete examples of the large amount of restored data being recovered. Although Gutmann's theory may be correct, there is no practical evidence that the overwriting data can be recovered, while research has shown to support that the overwritten data can not be recovered.
Solid-state drives (SSDs) overwrite data differently than hard disk drives (HDDs) that make at least some of their data more easily recoverable. Most SSDs use flash memory to store data on pages and blocks, referenced by logical block addresses (LBA) managed by the translation layer of flash (FTL). When the FTL modifies the sector, it writes the new data to another location and updates the map so that new data appears in the target LBA. This leaves the data pre-modified, with many possible generations, and can be recovered by data recovery software.
Data lost, deleted and formatted
Sometimes, existing data in physical drives (Internal/External Hard Drives, Pen Drive, etc.) are Missed, deleted and formatted due to circumstances such as virus attacks, accidental deletion or unintentional use of SHIFT DELETE. In this case, data recovery software is used to recover/recover data files.
Logical bad sector
In the list of logical failures of hard disks, logical bad sectors are the most common where data files can not be retrieved from certain sectors of the media drive. To counter this, the software is used to fix the logical sector of the media drive. If this is not enough, hardware that contains a logical bad sector should be replaced.
Remote data recovery
Recovery experts do not always have to have physical access to damaged hardware. When lost data can be recovered by software techniques, they can often perform recovery using remote access software over the Internet, LAN or other connections to the physical location of the damaged media. This process is basically no different from what end users themselves can do.
Remote recovery requires stable connection with sufficient bandwidth. However, that does not apply where access to the hardware is required, as in the case of physical damage.
Fourth phases of data recovery
Usually, there are four phases when it comes to successful data recovery, although it can vary depending on the type of data corruption and recovery required.
- Phase 1
- Fixed hard disk drive
- Fix the hard disk drive so it runs in some form, or at least in the appropriate state to read data from it. For example, if the head is bad, they need to be changed; if PCB is damaged then it needs to be repaired or replaced; if the spindle motor is bad, then the disk and head must be moved to the new drive.
- Phase 2
- Draw a drive to a new drive or disk image file
- When the hard disk drive fails, the importance of removing data from the drive is a top priority. The longer the damaged drive is used, the more likely it is that further data loss occurs. Creating a drive image ensures that there is a secondary data copy on another device, which is safe for testing and recovery procedures without damaging the source.
- Phase 3
- Logical recovery of files, partitions, MBRs, and filesystem structures
- After the drive is cloned to a new drive, it is perfect for trying to retrieve lost data. If the drive fails logically, there are a number of reasons for it. Using clones it is possible to repair partition table or master boot record (MBR) to read the file system data structure and retrieve stored data.
- Phase 4
- Fixed the damaged damaged file
- Data corruption can be caused when, for example, a file is written to a sector on a drive that has been corrupted. This is the most common cause of failed drives, which means that data needs to be reconstructed for readability. Damaged documents can be recovered by some software method or by reconstructing documents manually using hex editor.
Restore disk
The Windows operating system can be reinstalled on the computer that has been licensed for it. Reinstallation can be done by downloading the operating system or by using "restore disk" provided by the computer manufacturer. Eric Lundgren was fined and sentenced to a US federal prison in April 2018 for producing 28,000 recovering disks and intending to distribute them about 25 cents each as ease to a computer repair shop.
See also
References
Further reading
- Tanenbaum, A. & amp; Woodhull, A. S. (1997). Operating System: Design And Implementation, 2nd ed. New York: Prentice Hall.
- Data recovery in Curlie (based on DMOZ)
Source of the article : Wikipedia
0 Comments