Block, SkipCaptcha, Upload, Automoderated users, Check users, delete, edit, Moderators, move, oversight, protect, ratelimit-exempt, rollback
20,023
edits
Changes
Jump to navigation
Jump to search
saving progress still working
{{inuse}}<br /><br />
'''Data recovery''' for computers is the process of recovering information which has been deleted, corrupted, or "lost." This can be attempted on any digital storage media, but the methods vary somewhat depending on the device.
==Logical damage==
Logical damage is probably the most common problem which requires recovery. There can be several causes for this kind of problem.
===Accidental deletion===
It is not uncommon for someone to have a problem where they accidentally delete one or more files. Many operating systems offer a "trash can" or "recycle bin" which holds deleted files in case someone changes their mind or deleted something by accident. However, even if a file is fully deleted, it is not immediately lost. Rather, the pointer to it in the file system is removed, and the space is marked as available. With nothing but a shareware program, much data lost in this manner can be recovered by the user. Some programs such as [http://www.piriform.com/recuva Recuva] look for complete files marked for overwrite only, but others like [http://diskdigger.org DiskDigger] scan the disk surface to find recognizable patterns. This results in the discovery of many partial and corrupted files, but also is more likely to locate at least a portion of the desired file(s).
<br />
If accidental deletion occurs, a user should try to avoid saving any new information to the drive until the lost file can be recovered. Ideally, the recovery program would be run from another partition or drive, and if it was lost on the system drive, the operating system would not be running. If read/write operations continue as usual, the accidentally deleted information may be overwritten.
===Overwritten data===
Wanted information sometimes gets overwritten after it is marked as deleted. Since the operating system sees it as free space, data will simply be written to that specific sector or group of sectors almost completely destroying the old information. This prevents simple disk surface searching from finding what is wanted, but some trace of it can still exist. This trace usually exists in the form of stronger or weaker than average magnetism on a [[Hard disk|hard disk drive]]. Such minute differences cannot be read by a conventional computer system, but specialized software can be used to detect and interpret them. For this reason, shredding is sometimes used prevent the discovery of such traces.
===Shredding===
The process of "shredding" (also know as secure deletion) is designed to prevent recovery, and does so quite effectively. Although information which is overwritten once or even twice can sometimes be recovered, a good shredding algorithm overwrites the file's disk space three to sixteen times, each time with a different randomly generated block of gibberish. Some programs offer to run this process sixty-four times or more, but this is usually unnecessary. Even two or three passes will usually destroy the data altogether, although some say that certain government agencies can see back up to seven overwrites.{{citation needed}} After a sufficient number of passes of this process have been completed, there is no known way to recover it. For this reason, shredding should only be performed when the user is absolutely sure they wish to obliterate certain information. Also, shredding causes a little extra wear on the drive, which is more harmful to Flash memory than disk drives. If shredding in not needed, it probably should not be used lest it eventually cause a malfunction.
===Malfunction===
Especially when a storage device is getting worn out, it may eventually start having problems which prevent some data from being read or written. Although difficult, some information can often be recovered after this type of damage has occurred.
*In the information was lost on Flash memory, there are often very few options. While it may be possible for experts to remove flash memory chips one at a time and read the data, then reconstruct it into the originally lost information, most people cannot. However, Flash memory does not usually fail all at once with no warning. Errors start to occur, which usually result in some or all files seeming to disappear. Some people find that when this happens, they can simply disconnect the device and reconnect it to access the files which seemed to disappear. They will then quickly backup all of their files before the device fails completely. If files truly have been lost, it becomes necessary to create an image of the device's partition(s) and attempt to recover the contents as with any other time the file system has been corrupted. In many cases, the files are still unharmed and can be recovered this way.
*If the information was lost on a disk drive, the only option may be to remove the disk and attempt to read it in another device. This is a very messy way of attempting recovery, which is only made more difficult if the drive's contents were fragmented. Sometimes, however, it is possible to repair the drive or replace a failed part. For example, if the read/write head has failed, it may be replaceable. However, if the problem is with the disk itself as is usually the case, files themselves or the pointers to them in the file system may be corrupt. In this case, basic recovery software is often used on a complete disk image (clone). This enables the rediscovery of lost information without causing further harm to the damaged drive.
===File system or partition table corruption===
sometimes a large amount of information is lost because to a very small error. Such an error will not harm the information itself, but only the data required by the system to find it. A file system enables the operating system to locate desired files, and a partition table has a similar function, except it is responsible for telling the system where entire partitions are. If this information is corrupted or lost, an entire partition can become unreadable, resulting in the apparent loss of the operating system, programs, and files therein.<ref>http://www.easeus.com/resource/partition-table.htm</ref>
====Partition table====
Fortunately, software is available which can repair the partition table, such as [http://www.cgsecurity.org/wiki/TestDisk_Download TestDisk]<ref>http://www.geekyprojects.com/storage/how-to-repair-a-damaged-partition-table-or-mbr</ref> The drive can be scanned for orphaned partitions, and create a proper entry in the partition table. However, if the initial corruption was a result of a malfunction, this repair may not last long, and could even make the problem worse as it requires a certain amount of drive activity.
====File system====
This kind of problem has an effect similar to accidental deletion. Information is orphaned by the file system, but still exists until it is overwritten. Usually, recover programs are used to search for such files, but the effected drive is often cloned first, so that the intensive process of search and recovery is not inflicted on the drive which is probably already failing.
==Physical damage==
'''Data recovery''' for computers is the process of recovering information which has been deleted, corrupted, or "lost." This can be attempted on any digital storage media, but the methods vary somewhat depending on the device.
==Logical damage==
Logical damage is probably the most common problem which requires recovery. There can be several causes for this kind of problem.
===Accidental deletion===
It is not uncommon for someone to have a problem where they accidentally delete one or more files. Many operating systems offer a "trash can" or "recycle bin" which holds deleted files in case someone changes their mind or deleted something by accident. However, even if a file is fully deleted, it is not immediately lost. Rather, the pointer to it in the file system is removed, and the space is marked as available. With nothing but a shareware program, much data lost in this manner can be recovered by the user. Some programs such as [http://www.piriform.com/recuva Recuva] look for complete files marked for overwrite only, but others like [http://diskdigger.org DiskDigger] scan the disk surface to find recognizable patterns. This results in the discovery of many partial and corrupted files, but also is more likely to locate at least a portion of the desired file(s).
<br />
If accidental deletion occurs, a user should try to avoid saving any new information to the drive until the lost file can be recovered. Ideally, the recovery program would be run from another partition or drive, and if it was lost on the system drive, the operating system would not be running. If read/write operations continue as usual, the accidentally deleted information may be overwritten.
===Overwritten data===
Wanted information sometimes gets overwritten after it is marked as deleted. Since the operating system sees it as free space, data will simply be written to that specific sector or group of sectors almost completely destroying the old information. This prevents simple disk surface searching from finding what is wanted, but some trace of it can still exist. This trace usually exists in the form of stronger or weaker than average magnetism on a [[Hard disk|hard disk drive]]. Such minute differences cannot be read by a conventional computer system, but specialized software can be used to detect and interpret them. For this reason, shredding is sometimes used prevent the discovery of such traces.
===Shredding===
The process of "shredding" (also know as secure deletion) is designed to prevent recovery, and does so quite effectively. Although information which is overwritten once or even twice can sometimes be recovered, a good shredding algorithm overwrites the file's disk space three to sixteen times, each time with a different randomly generated block of gibberish. Some programs offer to run this process sixty-four times or more, but this is usually unnecessary. Even two or three passes will usually destroy the data altogether, although some say that certain government agencies can see back up to seven overwrites.{{citation needed}} After a sufficient number of passes of this process have been completed, there is no known way to recover it. For this reason, shredding should only be performed when the user is absolutely sure they wish to obliterate certain information. Also, shredding causes a little extra wear on the drive, which is more harmful to Flash memory than disk drives. If shredding in not needed, it probably should not be used lest it eventually cause a malfunction.
===Malfunction===
Especially when a storage device is getting worn out, it may eventually start having problems which prevent some data from being read or written. Although difficult, some information can often be recovered after this type of damage has occurred.
*In the information was lost on Flash memory, there are often very few options. While it may be possible for experts to remove flash memory chips one at a time and read the data, then reconstruct it into the originally lost information, most people cannot. However, Flash memory does not usually fail all at once with no warning. Errors start to occur, which usually result in some or all files seeming to disappear. Some people find that when this happens, they can simply disconnect the device and reconnect it to access the files which seemed to disappear. They will then quickly backup all of their files before the device fails completely. If files truly have been lost, it becomes necessary to create an image of the device's partition(s) and attempt to recover the contents as with any other time the file system has been corrupted. In many cases, the files are still unharmed and can be recovered this way.
*If the information was lost on a disk drive, the only option may be to remove the disk and attempt to read it in another device. This is a very messy way of attempting recovery, which is only made more difficult if the drive's contents were fragmented. Sometimes, however, it is possible to repair the drive or replace a failed part. For example, if the read/write head has failed, it may be replaceable. However, if the problem is with the disk itself as is usually the case, files themselves or the pointers to them in the file system may be corrupt. In this case, basic recovery software is often used on a complete disk image (clone). This enables the rediscovery of lost information without causing further harm to the damaged drive.
===File system or partition table corruption===
sometimes a large amount of information is lost because to a very small error. Such an error will not harm the information itself, but only the data required by the system to find it. A file system enables the operating system to locate desired files, and a partition table has a similar function, except it is responsible for telling the system where entire partitions are. If this information is corrupted or lost, an entire partition can become unreadable, resulting in the apparent loss of the operating system, programs, and files therein.<ref>http://www.easeus.com/resource/partition-table.htm</ref>
====Partition table====
Fortunately, software is available which can repair the partition table, such as [http://www.cgsecurity.org/wiki/TestDisk_Download TestDisk]<ref>http://www.geekyprojects.com/storage/how-to-repair-a-damaged-partition-table-or-mbr</ref> The drive can be scanned for orphaned partitions, and create a proper entry in the partition table. However, if the initial corruption was a result of a malfunction, this repair may not last long, and could even make the problem worse as it requires a certain amount of drive activity.
====File system====
This kind of problem has an effect similar to accidental deletion. Information is orphaned by the file system, but still exists until it is overwritten. Usually, recover programs are used to search for such files, but the effected drive is often cloned first, so that the intensive process of search and recovery is not inflicted on the drive which is probably already failing.
==Physical damage==