Data Recovery — the process of rescue or restore access to data stored on any media device storing where they can be accessed normally.
Description
In professional laboratories, experts are often able to recover data lost in the most severe cases, such as fire or flood. Data retrieval requires knowledge of electronics, robotics and automation, physics, programming, and various data storage methods: database systems , file systems and cryptology .
Data recovery includes:
- Recover corrupted or deleted files and directories.
- Recover damaged file systems after corruption or formatting .
- Recover information for signatures .
The term «data recovery» is also used in the context of forensic programs or intelligence when data that is not damaged but encrypted or hidden is restored.
Ways of recovery
There are currently two main ways to recover data. The method is selected depending on the fault of the drive. The software-hardware method is used in cases where the software method does not produce results.
Software method
The software method is to restore data without physical interference to the drive device, as well as to the operation of the firmware and the structure of the service information modules. This method is used in cases where the storage capacity of the drive itself is preserved, but for one reason or another, access to the data stored on it is lost.
The reason for this may be formatting logical drives, failure to change the logical geometry of the drive, deleting information, partial, or complete destruction of the file system, as information about the structure of the location of data on the drive. Often in the listed cases, it is possible to restore most of the data using disk savers, but there are cases where recovery of lost data is impossible (in a particular case, it can be considered a data rewrite). To automate the process of recovery written a lot of programs, including free ones.
Restore the file system structure
In the case of formatting a logical disk or partition, the structure and attributes of the data are not violated, but the information about the location of the data on this storage is changed or is inventoried (shown in the initial state). When fast formatting is updated a small part of the file table, part of the records are left, you just need to interpret it and read the data in the right order.
Full formatting can update the entire file table, so it is not always possible to restore the file structure and folders. To recover data without structure information, you can use file recovery on signatures.
If the file system is damaged as a result of a software failure or a media malfunction, data restoration programs may recover some information that depends on the amount of damage.
Restore deleted file system data
When deleting data, in fact, the data physically remains on the drive, but the file system no longer displays, and the location on the media, where they are located, is indicated as a free and ready to write new information. In this case, the attributes of the files are changed. In case of writing to this partition or logical disk, partial or complete replacement of data marked as remote may occur.
Similar files can be easily read and restored with all attributes and location information by reading file system records. There are both programs for the recovery of deleted data and complex solutions, where the recovery of deleted data is just one of the functions.
There are also special programs — «shredders» designed to destroy data. After the correct use of such recovery programs is impossible.
Recovery for signatures
In cases where reconstruction of the file system is impossible for any reason, some files can still be restored using signature recovery. With this type of recovery, there is a sector-wide scan of the drive for the presence of known file signatures.
The basic principle of algorithms for signature search is the same as in the very first antivirus. As an antivirus crawls a file in search of data sites that coincide with known fragments of the virus code, and signature search algorithms used in data recovery programs, read information from the disk surface in the hope of encountering familiar parts of the data. The headers of many file types contain character sets of characters. For example, JPEG files contain a sequence of «JFIF» characters, ZIP archives begin with «PK» characters, and PDFs begin with the characters «% PDF-«.
Some files (for example, text and HTML files) do not have characteristic signatures, but can be defined by indirect signs, because they contain only characters from the ASCII table .
By the results of a scan, most often, a list of files sorted by type appears. File location information is not restored.
This type of recovery is well applied to recover photos from memory cards, as the data on the card is the same type and recorded, in general, strictly consistently, without fragmentation.
Mixed Restoration
Most applications allow you to apply multiple recovery methods at a time for one scan at a time. The result is the maximum possible result when using this program.
The most reliable, easy and cheap way to recover information is to restore information from previously made backups. To create backups, specialized software is used, which can also perform data recovery.
Software-hardware mode
Software-hardware mode is required in case of physical damage to the drive. Here you need to focus on the type of drive: a flexible magnetic disk (NMD), a hard magnetic disk (HDD), a flash drive (NAND-Flash drive) or CD / DVD / BD. Consider the main types of carriers and their failure.
Flexible Magnetic Drive Disk Drive
Occurs most often when passing magnetic detectors in stores, underground, airports. Data can only be restored from non-demagnetized areas of the drive. Similarly, there are malfunctions associated with physical damage to the media, such as scratches, severe pollution. Each case should be considered individually and only after that, predict the result of the restoration of information.
Restore deleted data
When deleting data, they physically remain on the drive, but they are no longer displayed on the file system, and the location on the media, where they are located, is indicated as free and ready for recording of new information. In the case of a record in this section or logical disk, partial or complete replacement of the data marked as deleted may occur.
You can read and restore similar files with all attributes and location information by reading file system records. There are both programs for the recovery of deleted data and complex solutions, where the recovery of deleted data is just one of the functions.
