What is data recovery?
Unfortunately, despite the constantly growing reliability of storage devices, the loss of digital information remains quite commonplace. General causes of data loss include hardware and software failures, power outages, software malfunctions (including computer viruses), as well as human errors.
Any information saved to a storage device is luckily almost always recoverable. However, you should distinguish the cases when the information has never been written to a storage (for example, a created, but not saved document that was lost due to a power failure) and thus is in no way recoverable.
The following article describes most common data loss situations and ways of handling them.
Data loss cases
Most common data loss causes include:
How does recovery work?
- Accidental deletion of files or folders
Depending on the file system, each OS acts differently while deleting a file. For instance, in Windows FAT file system the OS marks file directory entries as “unused” and destroys file allocation information (except for the beginning of the file), in NTFS only the file entry is marked as “unused”, the record is deleted from the directory and the disk space is also marked as “unused”; in most Linux/Unix file systems the OS destroys the file descriptor (information about the file location, file type, file size etc.) and marks the disk space as “free”.
The main purpose of file deletion is to release storage space used by the file for storing a new file. For performance reasons storage space is not wiped immediately, which makes the actual from the file remain on the disk until this storage space is reused for saving a new file.
- File system formatting
File system formatting can be started by mistake, for example, by specifying a wrong disk partition or by mishandling a storage (e.g. NAS devices usually format the internal storage after an attempt to reconfigure RAID).
The formatting procedure creates empty file system structures on the storage and overwrites any information after that. If the types of the file systems coincide, it destroys the existing file system structures by overwriting them with new ones; if the types of the file systems differ, the structures are written to different locations and may delete user’s data.
- Logical damage of a file system
This kind of failure may occur due to blackouts or hardware failures. Sometimes, logical damages are also caused by software failures. Modern file systems have a high level of protection against file system logical damages, yet, they remain helpless against hardware or software malfunctions.
Even a small piece of wrong data written to a wrong location on the storage can cause the destruction of file system structures, breaking file system object links and making the file system non-readable.
- Loss of information about partition
This failure may occur because of a failed “fdisk“ operation or user’s errors, which usually results in the loss of information about the partition location and size.
- Storage failure
If you detect any physical problems on the storage (e.g. the storage is not running, making unusual noises, overheating or facing problems to read data etc.), it is not recommended to take any actions by yourself. You should take the storage to a specialized data recovery laboratory.
If a failure has occurred to a RAID system (only one drive failure for RAID5, maximum two drives failure for RAID6 etc.), recovering data without the missing drive is possible, as the redundancy of RAID allows recovering data without a single storage.
The information remaining on the storage can be recovered to a safe location. Recovery chances depend greatly on the specific data loss situation, but you should keep in mind that no information is recoverable after being overwritten. For this reason, nothing should be written into the storage until the last file is recovered.
Data recovery chances
Data recovery software serves to get data back after its loss with the maximum result possible. Commonly, data recovery process is based on storage scan to find specific information (deleted files, lost file systems) and assemble structures of the damaged file system.
Data recovery chances strongly depend on the actual cause of data loss and further user's actions. To get the best possible data recovery result, it is strongly recommended to prevent any possibility of anything being written to the storage and run data recovery software immediately.
For more information concerning data recovery chances depending on the data loss case and operating system of the hardware, please, go to the “Chances for recovery” section.