What is data recovery?
Unfortunately, despite of constantly growing reliability of storage devices, loss of digital information remains a common phenomenon. General causes of data loss include hardware or software failures, power cuts, software malfunctions (including computer viruses) or simple human errors.
Any information saved to a storage device is luckily almost always recoverable. However, you should distinguish the cases when the information has never been written to a storage (for example, created, but not saved document lost due to power failure) and thus is in no way recoverable.
The following article describes most common data loss situations and gives information as to data recovery perspectives.
Data loss causes
Most common data loss causes are:
How does recovery work?
- Accidental deletion of a file or folder
Depending on the file system, each OS acts differently to delete a file. For Windows FAT file system the OS marks file directory entries as unused and destroys file allocation information (except beginning of file), for NTFS – just marks file entry as unused, deletes record from directory and marks disk space as unused; for most Linux/Unix file systems it destroys the file descriptor (information about file location, file type, file size etc.) and sets disk as free.
The main purpose of each file deletion is to release storage space used by the file for a new file. Storage space is not wiped immediately (for performance reasons) making actual file data remain on a disk until this storage space is reused to store a new file.
- File system formatting
File system formatting can be started by mistake, for example, by specifying a wrong disk partition or unclear actions of storage handling (e.g. NAS devices usually format internal storage after attempt to re-configure RAID).
Formatting procedure creates empty file system structures on the storage and overwrites any information after that. If file system types coincide, it destroys existing file system structures by overwriting them with the new ones; if file system types differ – the structures are written to different locations and may erase user’s data.
- Logical damage of a file system
This kind of failure may occur due to blackouts or hardware failures. Sometimes logical damages are also caused by software failures. Modern file systems have a high level of protection against file system logical damages, yet helpless against hardware or software malfunctions.
Even a small piece of wrong data written to a wrong location on the storage may destroy file system structures, break file system object links and make file system non-readable.
- Loss of information regarding partition
This kind of failure may occur as a result of failed 'fdisk' operation or user's errors which usually results in loss of information about partition location and size.
- Storage failure
If you detect any physical problems on the storage (e.g. storage does not start, makes unusual noises, overheats, has problems to read data etc.), it's not recommended to take any actions by yourself. You should take the storage to a specialized data recovery laboratory.
If a failure has occurred to a RAID system the redundancy of which allows recovering data without single storage (only one drive failure for RAID5, maximum two drives failure for RAID6 etc.), recovering data without the missing drive is possible.
The information remained on the storage can be recovered to a safe location. Recovery chances maily depend much on the data loss situation, but you should take into account that no information is recoverable after overwriting. For this reason nothing should be written to the storage until the last file is recovered.
Data recovery chances
Data recovery software serves to get data back after information loss with maximum possible result. Commonly, data recovery operation is based on storage scan to find specific information (deleted files, lost file systems) and assemble structures of a damaged file system.
Data recovery chances depend much on the actual cause of data loss and further user's actions. To get the best possible data recovery result it is strongly recommended to stop any write access to the storage and run data recovery software immediately.
- Data loss caused by file deletion
Any deleted file remains on the storage until the storage space is re-used by other data. After file deletion OS may re-use disk space anytime to store a new file. Thus, even minor write to the storage may cause permanent data loss. Using Internet browser may result in overwriting of deleted files through the procedure saving cache or cookies to the storage. If you install the software to the same drive, your data are also under the risk of overwriting.
Another factor affecting data recovery chances after file deletion is file deletion algorithm dependent on the file system. For Windows NTFS file system recovery chances are quite high, because if file descriptor remains on the disk, the software can easily take all required information about the file. Unlike NTFS, BSD UFS file system destroys information about file start, location and size permanently and together with high degree of file fragmentation typical for this file system leaves very few chances for successful data recover.
Other file systems (like FAT) gives average chances for data recovery. Here only part of information is destroyed (like information about file fragments), but information about file name, start and size still remains on disk. Heuristic algorithms allow 'predicting' file fragments and recover good files. Please keep in mind, that due to the lack of real information about allocation of file fragments any data recovery software may fail to detect real file position, especially if several fragmented files were deleted close to the same location on the storage.
The scope of these factors make any file recovery software use a set of deterministic and heuristic algorithms for predicting deleted file location. Please consider that these algorithms differ from producer to producer making recovery results different as well.
- Recovery after file system formatting
After file system formatting a part of information on the storage is destroyed due to overwriting the space with new information of a new file system. Again, data recovery chances after formatting depend much on the difference between the original and new file systems.
For instance, if a file system was formatted with FAT, it overwrites huge amount of storage space at disk starting with zeros (empty block allocation tables) and therefore destroys all previous data. Even if previous file system was FAT as well, the information about allocation of previous files is lost completely. Other file systems usually allocate more or fewer structures to different storage locations.
Sometimes, but not always recovery chances are higher if the file system is formatted with the same file system type (e.g. NTFS), sometimes - not (e.g. FAT over FAT has worse recovery chances than XFS over FAT).
Efficient data recovery software usually produce quite good recovery result after file system formatting. Most file systems (except those like FAT) may still keep file allocation information, directory records, file names etc. allowing users to reconstruct the file system successfully. However, since new structures are written to the disk, some user information can be damaged and some files or folders can be lost.
- Recovery after file system damage
To this type of data loss, data recovery software usually applies the same methods as for a formatted file system. Data recovery chances depend on the actual file system damage (a damage of user files, file folders, file location, file name or all at once). Anyway, efficient data recovery software helps you to achieve the highest possible data recovery results.
- Loss of information about partition
This type of data loss cause is probably the most unlikely. Working with this type of damage data recovery software identifies file system starting with known file system structures scanning the storage. If the loss didn't effect the file system itself, the data can be fully retrieved in its original form.
- Hardware failure
Note: Never try to recover data from a failed or failing storage by yourself.This may result in permanent data loss. The only exception is RAID systems where storage redundancy allows recovering data completely without a failed unit.
RAID failure may also effect file system. But if the file system remains intact, your has quite good data recovery chances. For further information concerning the specifics of data recovery from RAID please refer to RAID systems recovery.
- Recovery of wiped/overwritten data
It is simply impossible. The myth about the possibility to recover lost files after overwriting is a result of successful attempts to recover data from old floppy dicks and hard drives. These devices having storage capacity from kilobytes to megabytes used very wide magnetic trace and simple digital encoding to store the information. That is why it was possible to read 'traces of data' after wiping or overwriting by calibrating read 'head' sensitivity and position.
Modern systems use very thin tracks, high precision of head calibration and extremely high signal frequency near to the top of technology limit. Performance of modern chips only allows picking good discrete signal from disk platter and never identifies any 'signal traces'. This scheme is impossible for any digital device (discreet signal frequency to handle such data lays much beyond the theoretical limit of electronic circuits).
Thus the companies which claim to be able to recover data in this way are not trustworthy.