Data recovery (computers)

!

This article has an inadequate number of citations. You are encouraged to add sources for verifiability, but please abide by The Conservapedia Commandments & Style Guide.

Data recovery for computers is the process of recovering information which has been deleted, corrupted, or "lost." This can be attempted on any digital storage media, but the methods vary somewhat depending on the device.

Logical damage is probably the most common problem which requires recovery. There can be several causes for this kind of problem.

Accidental deletion

It is not uncommon for someone to have a problem where they accidentally delete one or more files. Many operating systems offer a "trash can" or "recycle bin" which holds deleted files in case someone changes their mind or deleted something by accident. However, even if a file is fully deleted, it is not immediately lost. Rather, the pointer to it in the file system is removed, and the space is marked as available. With nothing but a shareware program, much data lost in this manner can be recovered by the user. Some programs such as Recuva and Wise Data Recovery for Windows look for complete files marked for overwrite only, but others like DiskDigger (for Windows) scan the disk surface to find recognizable patterns. This results in the discovery of many partial and corrupted files, but also is more likely to locate at least a portion of the desired file(s).^[1] While such options are more limited for Mac operating systems, some software (usually requiring a paid license) is also available.^[2]
If accidental deletion occurs, a user should try to avoid saving any new information to the drive until the lost file can be recovered. Ideally, the recovery program would be run from another partition or drive, and if it was lost on the system drive, the operating system would not be running. If read/write operations continue as usual, the accidentally deleted information may be overwritten.

Overwritten data

Wanted information sometimes gets overwritten after it is marked as deleted. Since the operating system sees it as free space, data will simply be written to that specific sector or group of sectors almost completely destroying the old information. This prevents simple disk surface searching from finding what is wanted, but some trace of it can still exist. This trace usually exists in the form of stronger or weaker than average magnetism on a hard disk drive. Such nominal differences cannot be read by a conventional computer system, but specialized software can be used to detect and interpret them. For this reason, shredding is sometimes used prevent the discovery of such traces.

Shredding

The process of "shredding" (also known as secure deletion) is designed to prevent recovery, and does so quite effectively. Although information which is overwritten once can sometimes be recovered, a good shredding algorithm overwrites the file's disk space three to thirty-two times, each time with a different randomly generated block of gibberish. Some programs offer to run this process sixty-four times or more, but this is usually unnecessary. Even two or three passes will usually destroy the data altogether. It has been shown that using Magnetic Force Scanning Tunneling Microscopy (Which is generally used to test and improved read/write heads) can detect "shadows" of the previously stored bits can be detected, even though this process would take years to complete.^[3][4] However, after a sufficient number of passes have been completed, there is no known way to recover it. For this reason, shredding should only be performed when the user is absolutely sure they wish to obliterate certain information. Also, shredding causes a little extra wear on the drive, which can be more harmful to Flash memory than disk drives. Additionally, due to wear-leveling algorithms employed by flash memory storage, shredding is nearly impossible with any certainty.^[5] If shredding is not needed, it probably should not be used lest it eventually cause a malfunction.

Malfunction

Especially when a storage device is getting worn out, it may eventually start having problems which prevent some data from being read or written. Although difficult, some information can often be recovered after this type of damage has occurred.

Flash memory

If the information was lost on Flash memory, there are often very few options. While it may be possible for experts to remove flash memory chips one at a time and read the data, then reconstruct it into the originally lost information, most people cannot. However, Flash memory does not usually fail all at once with no warning. Errors start to occur, which usually result in some or all files seeming to disappear. Some people find that when this happens, they can simply disconnect the device and reconnect it to access the files which seemed to disappear. They will then quickly backup all of their files before the device fails completely. If files truly have been lost, it becomes necessary to create an image of the device's partition(s) and attempt to recover the contents as with any other time the file system has been corrupted. In many cases, the files are still unharmed and can be recovered this way.

Hard disk drives

If the information was lost on a disk drive, the only option may be to remove the disk and attempt to read it in another device. This is a very messy way of attempting recovery, which is only made more difficult if the drive's contents were fragmented. Sometimes, however, it is possible to repair the drive or replace a failed part. For example, if the read/write head has failed, it may be replaceable. However, if the problem is with the disk itself as is usually the case, files themselves or the pointers to them in the file system may be corrupt. In this case, basic recovery software is often used on a complete disk image (clone). This enables the rediscovery of lost information without causing further harm to the damaged drive.

File system or partition table corruption

sometimes a large amount of information is lost because to a very small error. Such an error will not harm the information itself, but only the data required by the system to find it. A file system enables the operating system to locate desired files, and a partition table has a similar function, except it is responsible for telling the system where entire partitions are. If this information is corrupted or lost, an entire partition can become unreadable, resulting in the apparent loss of the operating system, programs, and files therein.^[6]

Partition table

Fortunately, software is available which can repair the partition table, such as TestDisk.^[7] The drive can be scanned for orphaned partitions, and such software will create a proper entry in the partition table. However, if the initial corruption was a result of a malfunction, this repair may not last long, and could even make the problem worse as it requires a certain amount of drive activity.

File system

This kind of problem has an effect similar to accidental deletion. Information is orphaned by the file system, but still exists until it is overwritten. Usually, recover programs are used to search for such files, but the effected drive is often cloned first, so that the intensive process of search and recovery is not inflicted on the drive which is probably already failing.

Physical damage is also sometimes a concern, if the drive have been dropped, crushed, gotten wet while powered, or in other ways harmed on a physical level. In such situations, the portion of the device which stored the information is of course most vital.

Flash memory

Flash chips can potentially be removed and read independently. However, this is a difficult and sometimes fruitless procedure. Only if a simple connection is broken can this be resolved easily (by soldering the connection).

Hard disk drives

For hard disk drives, the disk itself is most vital part. If the shell and all other components are destroyed, there is a chance some information can be recovered by reading it from the disk using a different head. However, some of the circuitry on each hard disk is specialized for that specific device. While it may be possible to recover information without it, this will be more difficult. Also, this makes it nearly impossible to simply place on disk into another enclosure and use it as-is.

Optical disks

For optical disks, the foil is most important. The most common damage to optical disks is the scuffing and scratching of the plastic covering, which prevents the read laser from being refracted properly, making the information difficult to access. This problem can be easily resolved by resurfacing the disk, polishing it, or applying a sort of transparent wax. Since these methods are so effective, other methods are hardly needed. however, due to the simplicity of optical disks, the foil could theoretically be transferred to another shell. This may be necessary if the disk becomes warped and cannot be flattened. Alternatively, there is the option for scratched disks of using software to use a "best guess" approach of recovery.^[2] While not an ideal option, it can be cheaper and easier than actually repairing the disk.

However, if the disk is broken, little can be done, since the so many bytes are lost at the point of separation. Not only are the contents themselves corrupted, but also the file system is damaged.

• If one or more files have been lost but have backups exist, those should be checked first! Not only is it easier to retrieve it/them this way, but there is also less risk of file corruption. Even if a recovered file seems intact, it can still be slightly damaged.
• If information is lost, the partition on which it was lost should not be used until recovery may be attempted.
• Excluding physical damage, disk drives usually fail based on how long they have been running, while flash memory tends to fail based on how much data is written to it in its "lifetime." The potential need for data recovery can be reduced if users try to reduce the most impactful kind of wear to their devices.