What you need to know about data recovery
Data carrier volumes are growing every year while the relative cost of a gigabyte storage is decreasing more and more. Meanwhile, the data stored in computers never loses its value, but on the contrary, becomes even more precious. More and more information is stored in a digital format, and it becomes even more frightening to risk losing it all in one day – definitely not the best one in your life.
Software and hardware issues
Any hard disk problems you may encounter can be divided into two large groups – hardware and software issues. The first group includes physical breakdown of any hard disk elements such as deformation of the magnetic-head assembly after falling. Naturally, such damages require physical (mechanic) repairs.
Software issues suggest loss of data resulting from user’s activities (deletion, formatting), virus attacks, and errors in the operating system or software. Unlike the case of physical damages, such disk can be formatted and used again – if your HDD did not contain valuable data, of course. But what if it did?
How data is stored
In a simplified approach, a disk can be seen as a book with a table of contents. Data is certain information that is represented in this book, for example, short stories. In order to quickly find the story you need you should use the table of contents. In this case, this table is represented by elements of the file system. The file system stores links to the areas of the hard disk where a certain file is kept.
When the operating system addresses the hard disk, at first it “looks into” the table of contents and only then finds the necessary information. Accordingly, when a new file is created, the information on its location will be represented in the file system. If you want to write a story on clean pages of the book, you will have to update the table of contents otherwise you will not be able to find it later.
The peculiarity is that one file can be stored in a “split” form in several different parts of the disk. Imagine that a story in your book is broken into paragraphs that are scattered randomly over several different pages. Therefore the table of contents should specify the pages where all paragraphs of the story are located and the sequence in which these paragraphs should be read. The task of the file system is to specify not only the beginning of the file but also all of its parts that can be scattered all over the hard disk in any way.
Yet it is not all to be said. The matter is that operations with a file, e.g. its creation, take up quite a lot of time. So in all cases when it is possible, such operations involve the table of contents instead of the corresponding file.
Most probably you have noticed not for once that copying files takes up more time than just dragging them from one folder to another in the same disk. It is because when you copy things, data has actually to be written to the hard disk. Yet when you drag them, the data remains where it was before, but the file system entry now says this information is located in “Important Docs” folder instead of “Miscellany” folder.
The most interesting things happen when it comes to deleting files and formatting disks. There is no physical deletion, in fact, but corresponding areas on your disks are marked as free. That is, the story is still in the book, but the information on this story is gone from the table of contents. Later, when new data is written to the disk, the process of writing will physically erase the deleted files. When you run out of free space in your book, you will erase the stories which are not shown in the table of contents.
This is the peculiarity that allows recovering data after deletion and formatting, but it also bring ins certain limitations.
Recovery after formatting
Formatting your hard disk means deleting all data. At the same time, as we have already said, the data does not go away. In fact, the file system table is cleared, as if the table of contents was torn out of the book and clean pages were placed there instead. For such cases, we use programs for data recovery that scan the disk (read the book without the table of contents) and draw this table again from the start.
Unfortunately, it is not always possible, as the chances of success depend on the file system. For example, with FAT32 file system clearing the table of contents means loss of data. Yes, physically the data is on the disk and it can be located, but as the data is stored in parts, and the location of various parts and their proper order were stored in the special table which has been erased, the scanning software can only find first file segments.
A more modern and advanced file system, NTFS, is more resistant to formatting. Coming back to our simplified example, such file system has got several tables of contents instead of one: the main table set to zero when formatted, and a number of smaller tables, which are preserved and are related to particular files. The small tables store links to all the fragments and the sequence in which these elements should be put together.
Recovery of deleted data
Deletion is similar to formatting, yet with a difference, that it does not clear the entire table of contents but only the part which contained links to deleted files. Physically, the data is still on the hard disk. The algorithm of recovery is the same as with formatting – to scan the disk. It should be remembered that if you continue working with the disk, install software, save documents etc the chances are high that new data will be overwritten onto the old information – now leaving no chances to restore that.
Destruction of file table
This problem can be compared to partial loss of the table of contents in a book. One part of links file locations will remain true while the other part will disappear or send you to completely different data. Usually such problems appear due to viral attacks, operating system errors or software errors. The difficulty of recovery and chances to restore data will depend on how serious the problem is which can be estimated by specialized personnel only. The process itself does not take much time as it involves not the data but the file table, but restoring 100% of the damaged data is not always guaranteed.
Safety precautions when data is lost
By no means should you continue using the disk where data was lost. After old data is overwritten with new data (and it will certainly happen sooner or later as the operating system sees this space as free), recovery will be impossible.
Application for data recovery
There are a lot of paid and free programs for data recovery. Yet it is recommended to use them only if you have sufficient knowledge on how HDDs work. A friendly interface and a large “Recover” button should not mislead you to believe that your precious and now lost photos and financial reports will be back in a second.
Firstly, you should know what happened to data – was it a deletion of a single folder, formatting of the hard disk, or a file system fault. Secondly, you should determine the file system type. Based on these two starting points, you can choose the necessary algorithm of recovery and corresponding software to work with.
Recovery is a slow and finicky job. When the program finishes scanning and gives you a list of files and folders found it only means the fact of their existence is confirmed. The recovery itself is the next step that may require additional adjustment and refinement. Otherwise, you are running a risk of receiving a set of unconnected data carefully arranged into folders with seemingly well-known names. However, the files with names of the same files that you deleted before will not open for some reason.
Finally, data recovery programs can help only if you encounter software issues. If your problem comes from physical damage to your data carrier, even simply switching on the disk may result in losing your data – and even your HDD – for good.
You should always remember that even a high-class expert may have very little chance of “saving” your data after your failed attempt to recover data without asking for help.