| Resolution |
Computers are replaceable. In many cases, data is not. First and foremost, the best thing that can be done
to prevent data loss is to back it up on a regular basis. An ounce of prevention is worth a ton of time,
money, and aggravation after the fact. There are many viable alternatives when it comes to data backup.
Choose one appropriate for you, invest in the hardware/software infrastructure, generate a backup schedule,
and stick to it. Once the loss occurs, we migrate from the realm of prevention to that of recovery.
In general, there are four ways in which data is lost. Each way entails its own recovery methodology:
| Data Recovery Type I |
|
Loss Type
|
Unsaved Data
|
|
Causes
|
This can happen when a data-generating application (such as a word processor) is exited prematurely
without saving new data when either the user closes the application, due to a power outage, system
or application crash, etc.
|
|
Recovery Techniques
|
There are several possibilities for recovering unsaved data. Primarily, many word processors
and other such data-generating applications will periodically and automatically save new data to a
temporary file while in progress. This is intentionally done to help users recover unsaved data. In
case of an inadvertent loss of unsaved data, the data can usually be recovered from the temporary
file (it may be necessary to undelete the temporary file before retrieving data if the temp file
itself has been erased). In cases where a temporary file is either absent or inaccessible, there
are typically tools available to dump the contents of an application's memory to a file. The unsaved
data can then possibly be retrived from the memory dump file. One such tool for Windows systems is
Microsoft's ADPlus application. There may be other tools available that can dump the entire contents
of memory to a file. In some cases, this memory dump file will contain the lost unsaved data. For
example, in the event of a system crash, Windows operating systems will dump the entire contents of
memory to a file located in the main OS directory (typically C:\Windows) called memory.dmp.
Since memory management is the purview of the operating system, any such memory dump tool will most
likely be one supplied by the OS manufacturer (ie, Microsoft for Windows systems).
|
| Data Recovery Type II |
|
Loss Type
|
Deleted Files
|
|
Causes
|
This happens when a user deletes a file from the file system. There are a number of ways to accomplish
this. Usually, the file is selected in Windows Explorer and the Delete key is pressed or the file is
right-clicked and the Delete option is selected from the drop down menu. Another, more problematic,
approach is to delete the file using the Del or Erase commands from a DOS prompt.
|
|
Recovery Techniques
|
First, a little background. Storage space on a hard disk (or hard drive - HD) is divided into sectors.
The number of sectors on a HD depends on the capacity of the HD and the size in bytes in each sector.
Files are stored on a HD using one or more of these sectors. The bigger the file, the more disk sectors
are required to store it. Directories themselves are files in the HD whose data is information about
files and subdirectories included within it. For each file/subdirectory within a parent directory,
there is an entry which lists information about the file/subdirectory including its name, size,
attributes, etc. In addition, the entry contains the location of the first sector used to store the
file's or subdirectory's data. The actual file data itself is not "inside" the directory file. The
directory entry simply includes a link (or pointer) to the file (or subdirectory). That is the reason why a file
Move within a single HD is very fast relative to a Copy. The Copy requires copying the entire file
and writing it elsewhere on the HD. The Move only requires that the file's info & link be moved from
one directory (which again, is a file) to another directory. With this in mind, there are two levels
of severity when it comes to deleted files. In the simplest case, a file or directory is deleted using
Windows Explorer. If the OS is conservatively configured, the file is not actually deleted at all.
Instead, its info & pointer are moved from the original parent directory to the Recycle Bin directory.
In order to undelete such a file (or directory), simply navigate to the Recycle Bin using Windows
Explorer, right-click the file (or directory), and select the Restore option from the drop down menu.
In the more severe case, the file/directory is either deleted using the DOS Delete or Erase commands
(which do not move the pointer info to the Recycle Bin) or the file/directory is actually deleted from
the Recycle Bin itself. In such a case, the file's or directory's info & pointer are no longer stored
anywhere in the file system. However, this does not mean that the file itself has been deleted. Quite
the opposite, the file (or directory) is still occupying its HD sectors same as always. The sectors
are marked as available by the file system, but they are not actually overwritten with new data until
new information is written to the HD. As long as no other operations (Move, Copy, Delete, etc.) are
performed on that particular HD after the file/directory deletion, the data is still intact and can
be recovered using data recovery utility programs.
|
| Data Recovery Type III |
|
Loss Type
|
Operating System (OS) Failure
|
|
Causes
|
The operating system's functionality is organized as a series of files stored on the computer's file
system. To say that an OS is hosed is to say that one or more of these files have been deleted or
corrupted. How does this happen? There are many ways to hose an operating system's files. One common
approach is to power down the computer before the OS determines that it is safe to do so. If the OS
is in the middle of updating crucial files, the files may become corrupted. Another easy way to do so
is to unintentionally (or not) delete system files. OS files can also become corrupted due to HD
failures.
|
|
Recovery Techniques
|
The problem here is that the OS is necessary in order to access the file system. If the OS won't boot
up, then it is not possible to load file system navigation applications (such as Windows Explorer) to
traverse the file system or manipulate data. Aside from the problem of repairing a corrupted OS, the
problem of recovering data from a HD stored in a computer without an operational OS is actually
relatively straightforward. The task becomes to either get a viable OS on said computer or to move the
target HD to a computer with a working OS. If the original computer has additional HDs with bootable
operating systems on them, then the computer can simply be booted using one of these alternatives.
The computer could also potentially be booted from the installation DVD. In any case, the goal is to
get an OS up and running on the original computer. Once an alternative OS has been loaded, the file
system and data from the target HD can be accessed normally. Similarly, the HD can be installed in
a second computer (with an operable OS) and then the data can be accessed normally from there. Keep
in mind that once the OS failure has been bypassed, it may be necessary to apply techniques detailed
in the Data Recovery Type sections I and II above.
|
| Data Recovery Type IV |
|
Loss Type
|
Hard Drive (HD) Failure
|
|
Causes
|
HDs are devices that rely on a high degree of precision. Modern manufacturing techniques make them
exceedingly robust and reliable. However, they do occasionally go bad from time to time. Luckily,
most HD failures fall into the category of media corruption. This is the case where the storage
surface of the actual HD platters starts to become inviable making certain sectors unreadable and/or
unwriteable. This type of failure comes with a silver lining in that it usually provides ample warning
before becoming intractable. A more serious problem is a HD with mechanical problems, typically
associated with the very sensitive read/write heads.
|
|
Recovery Techniques
|
A HD suffering from deteriorating media becomes increasingly erratic as sectors become unusable.
Depending on which files are affected by the sector losses, applications
and possibly the OS itself will begin to experience intermittent and unexplained crashes. If your
computer begins to manifest these symptoms, check the integrity of the HD using either Microsoft's
CHKDSK utility or the appropriate utility for your HD (based on manufacturer) as specified in the Hard
Drive Diagnostic Tools section in our Tech Tips. A HD with faulty media must have all of its data
immediately copied elsewhere and the HD itself promptly replaced. Techniques discussed in Data Recovery
Type I, II, and III sections above may need to be employed. The manifest symptom of a HD
experiencing mechanical failure is a clicking sound coming from the HD. Again, HD mechanical faults
typically deal with the read/write heads. If the HD is unable to position the heads correctly, no data
can be read from or written to the disk. Needless to say, the OS will not load if it can't be read from
disk. In fact, the computer will probably not even recognize the existence of the HD and the boot
sequence will certainly not get far. Data recovery from a mechanically faulty HD is a painstaking (read
expensive) prospect. It almost always requires the services of outfits dedicated exclusively to dealing
with mechanical HD failures. We're talking space-suited technicians working in ozone-filled clean rooms
here, folks. This will very often be significantly beyond the means of home users and even some fair-
sized business will want to weigh the costs of replacing the data versus attempting to recover it.
For the budget-conscious user, however, there may be a last ditch approach which apparently has
yielded some success for adventurous types. We can not endorse this technique as we have never tried
it ourselves and we highly recommend to anyone seriously considering this course of action to
thoroughly investigate the topic online in order to form your own educated opinion before proceeding.
However, if the HD is trashed anyway, you may have nothing to lose. In any event, the
idea is to freeze the HD with the hope that certain circuits will contract, form better contacts,
whatever. First, remove the HD from the computer and place it inside a plastic freezer bag removing as
much air as possible from the bag in order to reduce condensation. Then, place the HD in the freezer
and leave for 24 hours. Once you are ready to begin the data extraction portion of the maneuver, it is
important to work quickly because time is of the essence. Take the HD out of the freezer and recover
data using techniques discussed in Data Recovery Type I, II, and III sections above. If you are lucky,
the HD will operate normally for between a few minutes up to half an hour. Again, work quickly and keep
heat to a minimum during the operation.
|
|