What is data recovery?
Unfortunately, despite the constantly growing reliability of storage devices, the loss of digital information remains quite commonplace. General causes of data loss include human errors, software malfunctions (such as computer viruses), power outages as well as hardware failures.
Any information stored on a digital medium is luckily almost always recoverable. However, this doesn’t involve the cases when the information has never actually been written to a storage, for example, a created, but not saved document that was lost due to a power failure can in no way be recovered.
The following article describes most common data loss situations and the ways of handling them.
Data loss cases
The most common causes of data loss include:
Accidental deletion of files or folders
Each file system acts differently when deleting a file. For instance, in Windows the FAT file system marks file directory entries as “unused” and destroys file allocation information (except for the beginning of the file), in NTFS only the file entry is marked as “unused”, the record is deleted from the directory and the disk space is also marked as “unused”; most Linux/Unix file systems destroy the file descriptor (information about the file location, file type, file size, etc.) and marks the disk space as “free”.
The main purpose of file deletion is to release storage space used by the file for storing a new file. For performance reasons storage space is not wiped immediately which makes the actual file contents remain on the disk until this storage space is reused for saving a new file.
File system formatting
File system formatting can be started by mistake, for example, as a result of specifying a wrong disk partition or on account of mishandling a storage (e.g. NAS devices usually format the internal storage after an attempt to reconfigure a RAID array).
The formatting procedure creates empty file system structures on the storage and overwrites any information after that. If the types of the new and the former file systems coincide, it destroys the existing file system structures by overwriting them with new ones; if the types of the file systems differ, the structures are written to different locations and may wipe user’s data.
Logical damage of a file system
This issue may occur due to blackouts or hardware failures. Sometimes, logical damages are also caused by software crashes. Modern file systems have a high level of protection against file system logical damages, yet, they remain helpless against hardware or software malfunctions.
Even a small piece of wrong data written to a wrong location on the storage can cause the destruction of file system structures, breaking file system object links and making the file system non-readable.
Loss of information about a partition
This failure may occur because of a failed “fdisk“ operation or user’s errors, which usually result in the loss of information about the location and size of a partition.
If you suspect any physical issues with the storage (e.g. the device doesn’t boot, makes unusual noises, overheats, faces problems with reading data, etc.), it is not recommended to perform any data recovery attempts on your own. You should take the storage to a specialized data recovery laboratory.
If a failure has occurred to a RAID system (failure of one drive in RAID5, failure of maximum two drives in RAID6, etc.), data recovery is possible without the missing drive, as the redundancy of RAID allows restoring data without a single storage.
How does recovery work?
The information remaining on the storage can be recovered to a safe location. The chances for a successful result depend greatly on the specific data loss situation, but you should keep in mind that no information is recoverable after being overwritten. For this reason, nothing should be written to the storage until the last file is rescued.
Data recovery software helps to get the lost data back with the maximum efficiency. Commonly, data recovery process is based on storage scan, which serves to find specific information (deleted files, lost file systems) and assemble structures of the damaged file system.
How does recovery work?
Data recovery chances strongly depend on the actual cause of data loss and further user's actions. To get the best possible data recovery result, it is strongly recommended to prevent any possibility of anything being written to the storage and immediately run data recovery software.
For more information concerning data recovery chances depending on the data loss case and operating system of the hardware, please, go to the “Chances for recovery” section.