Types of data loss

Among the most common data loss reasons are:

• File or folder was deleted by user.
  
  Depending on file system, OS makes different actions to complete file deletion. For Windows FAT file system it marks file directory entries as 'unused' and destroys file allocation information (except file start), for NTFS - just marks file entry as unused, deletes record from directory and marks disk space as unused; for most Linux/Unix file systems it destroys file descriptor (the information about file location, file type, file size etc.) and sets disk as free.
  
  The common action of each deletion procedure is to release storage space used by file. This storage space is not wiped immediately (for performance reasons) thus actual file data remains on a disk until this storage space is reused to store a new file.
  
  
• File system format.
  
  User may initialize file system format by mistake (e.g. by specifying wrong disk partition) or as unclear part of maintenance (e.g. NAS devices usually format internal storage after attempt to re-configure RAID etc.).
  
  'Format' procedure just creates empty file system structures on the storage and overwrite any information below. If file system type is the same - it just detroys existing file system structures by overwritting them with new; if file system type is different - structures are written to different locations and may destroy user data.
  
  
• File system logical damage.
  
  This kind of failure may occur due to power loss or harware problems. Sometimes the reason could be also software failure. Modern file systems have a high level of protection against file system logical damage, but it could be useless against incorrect hardware or software actions.
  
  Even small amount of wrong data written to storage to wrong location may destroy file system structures, break file system object links and make file system non-readable.
  
  
• Partition information loss.
  
  This kind of failure may occur due to different reasons, including failed "fdisk" operation or incorrect user actions. The result usually is just partition location and size information loss.
  
  
• Storage failure.
  
  If you are using single storage and it has physical problems (e.g. storage does not start, there are unusual noices, storage overheats much, there are problems to read the storage data etc.) it's not recommended to take any actions yourself. You have to bring the storage to specialized data recovery laboratory.
  
  In case a problem has happened to RAID system and its redundancy allow to recover data without single storage (one drive failure for RAID5, no more then two drives failure for RAID6 etc.) - it's possible to recover data without missing drive.
  
  

How does recovery work

Data recovery software is intended to get data back after many types of information loss. The common action of each data recovery product is to scan storage to find specific information: deleted files, lost file systems, find and assamble together file system structures of damaged file system and so on.

Any information that still remains on storage could be restored in some form and could be recovered to safe location. There are different recovery chances for different kind of data loss, but the common thing is that no information could be recovered in case it was overwritten with another data. That's why you should never write anything to the storage until last file is recovered.


Data recovery chances

Data recovery chances depend much on data loss reason and the following user actions. It's highly recommended to stop any write access to the storage and run data recovery software.

• Data loss because of file deletion
  
  Any deleted file remains on storage before the storage space will be re-used by other data. After file deletion OS may re-use disk space any time to store new file. It means that even minor write to the storage may cause permanent data loss. Even the Internet browser may cause deleted files overwriting by saving cache or cookies to storage. Software installation to the same drive will cause deleted files overwrite as well.
  
  The other factor is the file deletion algorithm, that is specific to file system. For Windows NTFS file system these chances are quite high because if file descriptor remains on disk - software may easily take all required information about file. Unlike NTFS, on the BSD UFS file system file start and location information as well as even file size information is destroyed permanently so there are very slim chances for data recovery, taking into account high degree of file fragmentation for this file system.
  
  Other file systems (like FAT) have avearage chaces for data recovery. It means only part of information is destroyed (like information about file fragments), but infromation about file name, start and size still remains on disk. Heuristic algorithms still allow to 'guess' file fragments and recover good files. Please keep in mind that due to lack of real information about file fragments allocation, any data recovery software may fail to detect real file position, especially if several fragmented files were deleted near to the same on-storage location.
  
  Becuse of these factors, any file recovery software use a set of deterministic and heuristic algorithms to guess deleted file location and produce good results. Please bear in mind that these algorithms differ from vendor to vendor and that's why different products may produce different results.
  
  
• Recovery after file system format
  
  After file system format the part of information on the storage is destroyed because it is overwritten with new infromation of new file system. Again, data recovery chances after format depend much on original and new file systems.
  
  If some file system was formatted with FAT, it overwrites huge amount of storage space at disk start with zeros (the empty block allocation tables) and therefore destroys any previous data. Even if previous file system was also FAT - previous files allocation information will be lost completely.
  
  Other file systems usually allocate more or less structures on different storage locations. The recovery chances are much dependant on original and new file systems. Sometimes recovery chances are much better if file system formatted with the same file system type (e.g. NTFS), sometimes - not (e.g. FAT over FAT has worse recovery chances then XFS over FAT).
  
  Data recovery software usually can provide user with a quite good recovery result after file system format. Most file systems (except those like FAT) may still keep file allocation information, directory records, file names etc. to produce well reconstructed file system. However since new structures are written to disk, some user information could be damaged and some files or folders could be lost.
  
  
• Recovery after file system damage
  
  For this kind of data loss data recovery software usually use the same methods like for formatted file system. The data recovery chances depend much on actual file system damage. The damage may include damage of user files, file folders, file location, file name or all together.
  
  Yet, the data recovery software tries to produce best possible result, however everything depends on initial data damage.
  
  
• Partition information loss.
  
  It is likely the simplest data recovery task and data recovery software just identifies file system start by known file system structures with storage scan. If file system itself is not damaged, data could be retrieved in its original form without any assumptions.
  
  
• Storage failure.
  
  Never try to recover data from failed or failing storage yourself. You may cause permanent data loss. The only single exception is RAID systems where storage redundancy allow to recover good data without failed unit.
  
  The RAID failure may occur alone or with file system damage. If file system itself is good, there are pretty nice data recovery chances. Please refer to RAID systems recovery: the specifics article with more information about RAID recovery.
  
  
• Wiped/overwritten data recovery.
  
  It is simply impossible. The myth about possibility of such kind of data recovery born after successful data recovery attempts from old diskette and hard disks. These device (with storage capacity from kilobytes to megabytes) used very wide megnetic trace and simple electric encoding to store the information. That's why even if data is overwritten, one was able to read 'traces of data' by calibrating read 'head' sensitivity and position.
  
  The modern systems use very thin tracks, high precision of head calibration and very-very high frequency of signal that is near to top of technology limit. The performance of modern chips allow only to pick good discrete signal from disk platter and never identify any 'signal traces' because it's impossible for any electronic device (the discreet signal frequency to handle such data is much above theoretical limit of electronic circuits).
  
  Please never trust those companies that claim to be able to recover data in this way.
  
  Back to top