How can one recover data from a desktop or laptop PC?
These days depending on computers is clearly part and parcel of being a modern man, yet, tending to place too much reliance on these devices, sooner or later we come up against the loss of critical files which were stored as the only copy in the internal memory of a PC or laptop. Hardware malfunctions, software crashes, malware infections and casual human errors can induce a real data disaster, making the crucial information inaccessible, corrupted or deleted from the drive, but fortunately, in most situations, there are still ways to cope with its consequences or at least minimize them.
In the main, the possibility of data recovery from the computer's internal storage is influenced by a number of factors:
The more actively this storage device has been used thereafter, the higher likelihood is that they were replaced by some other data and thus got permanently destroyed. In view of this, it is strongly recommended to terminate any activities with the storage except the ones targeted directly at data recovery.
Files deleted from SSDs usually cannot be restored because of the TRIM command activated by default in most modern drives, which wipes their content for the purpose of improved performance and longevity of the device. Hard disk drives, on the other hand, are rather fragile and have a propensity to fail during the recovery procedure, especially when being mishandled. For this reason, special attention must be paid to their protection from hits and proper cooling.
File shredding or erasing utilities as well as low-level formatting carry out overwriting operations using zeros or certain data patterns which generally leave no chances for the retrieval of the previously stored files. In other cases, the information usually remains on the drive until overwritten by the system, users or applications.
Encryption enabled on the drive normally doesn't prevent data recovery provided that at least one of the decryption options is still available (encryption key, password, key file, etc.) and the area on the disk with critical decryption metadata hasn't been severely damaged. In the opposite case, the data remains encrypted, making it virtually impossible to retrieve any intact files.
If the storage medium cannot be recognized in BIOS, has any signs of physical failure, like extraordinary noises from an HDD, or SSD controller firmware damage, when a device gets detected in the OS with an incorrect size or name different from the one specified in the passport, do-it-yourself data recovery in this case usually makes no sense and may even lead to more serious damage to the data contained within the defective drive. Under such circumstances, it is advised to have the device handled by specialists in a professional data recovery center. However, if the drive has been affected by a logical failure, there are fair chances to restore the files using data recovery software, while the actual quality of the result will depend on the type of file system which manages the storage.
Normally, the primary storage of a PC or laptop is divided into several partitions which are intended to isolate the operating system and program files from user data. In some instances though, the OS, applications and user files get packed into a single partition without being separated. As a rule, a partition which serves the needs of the OS is subjected to constant writing even when the computer seems to stand idle, which carries a high risk of permanent destruction of the lost data. Considering this:
- to recover files from the system partition, one should remove the drive from the tower and attach it to another computer as a secondary storage device, or run this PC from a live CD;
- to recover data from a non-system partition, the same computer can be used for the procedure, provided that nothing will be saved/installed to the problem drive.
Last update: September 2, 2019