Data recovery
Recovering data after physical damage
A wide variety of failures can cause physical damage to storage media. CD-ROMs can have their metallic substrate or dye layer scratched off; hard disks can suffer any of several mechanical failures, such as head crashes and failed motors; tapes can simply break. Physical damage always causes at least some data loss, and in many cases the logical structures of the file system are damaged as well. This causes logical damage that must be dealt with before any files can be salvaged from the failed media.
Most physical damage cannot be repaired by end users. For example, opening a hard disk in a normal environment can allow airborne dust to settle on the platter and become caught between the platter and the read/write head, causing new head crashes that further damage the platter and thus compromise the recovery process. Furthermore, end users generally do not have the hardware or technical expertise required to make these repairs. Consequently, costly data recovery companies are often employed to salvage important data.
Recovery techniques
Recovering data from physically-damaged hardware can involve multiple techniques. Some damage can be repaired by replacing parts in the hard disk. This alone may make the disk usable, but there may still be logical damage. A specialized disk-imaging procedure is used to recover every readable bit from the surface. Once this image is acquired and saved on a reliable medium, the image can be safely analysed for logical damage and will possibly allow for much of the original file system to be reconstructed.
Hardware repair
Media that has suffered a catastrophic electronic failure will require data recovery in order to salvage its contents.
Examples of physical recovery procedures are: removing a damaged PCB (printed circuit board) and replacing it with a matching PCB from a healthy drive, performing a live PCB swap (in which the System Area of the HDD is damaged on the target drive which is then instead read from the donor drive, the PCB then disconnected while still under power and transferred to the target drive), read/write head assembly with matching parts from a healthy drive, removing the hard disk platters from the original damaged drive and installing them into a healthy drive, and often a combination of all of these procedures. Some data recovery companies have procedures that are highly technical in nature and are not recommended for an untrained individual. See companies such as Ontrack and DriveSavers. Neither of them will void the manufacturer’s warranty.
Disk imaging
Result of a failed data recovery from a hard disk drive.
The extracted raw image can be used to reconstruct usable data after any logical damage has been repaired. Once that is complete, the files may be in usable form although recovery is often incomplete.
Open source tools such as DCFLdd or DOS tools such as HDClone can usually recover data from all but the physically-damaged sectors. Studies have shown that DCFLdd v1.3.4-1 installed on a Linux 2.4 kernel system produces extra “bad sectors” when executed with certain parameters, resulting in the loss of information that is actually available. These studies state that when installed on a FreeBSD kernel system, only the bad sectors are lost. DC3dd, a tool that has superseded DCFLdd, and ddrescue resolve this issue by accessing the hardware directly. Another tool that can correctly image damaged media is ILook IXImager.
Typically, hard disk drive data recovery imaging has the following abilities: (1) communicating with the hard drive by bypassing the BIOS and operating system which are very limited in their abilities to deal with drives that have “bad sectors” or take a long time to read. (2) reading data from ad sectors rather than skipping them (by using various read commands and ECC to recreate damaged data). (3) handling issues caused by unstable drives, such as resetting/repowering the drive when it stops responding or skipping sectors that take too long to read (read instability can be caused by minute mechanical wear and other issues). and (4) preconfiguring drives by disabling certain features, such as SMART and G-List remapping, to minimize imaging time and the possibility of further drive degradation.
Recovering data after logical damage
Logical damage is primarily caused by power outages that prevent file system structures from being completely written to the storage medium, but problems with hardware (especially RAID controllers) and drivers, as well as system crashes, can have the same effect. The result is that the file system is left in an inconsistent state. This can cause a variety of problems, such as strange behavior (e.g., infinitely recursing directories, drives reporting negative amounts of free space), system crashes, or an actual loss of data. Various programs exist to correct these inconsistencies, and most operating systems come with at least a rudimentary repair tool for their native file systems. Linux, for instance, comes with the fsck utility, Mac OS X has Disk Utility and Microsoft Windows provides chkdsk. Third-party utilities such as The Coroners Toolkit and The Sleuth Kit are also available. Even deleted data is also considered to be logically damaged drive for example due to virus attack, if you format the drive or accidental deletion.
Some kinds of logical damage can be mistakenly attributed to physical damage. For instance, when a hard drive’s read/write head begins to click, most end-users will associate this with internal physical damage. This is not always the case, however. Sometimes, hard drives can click simply when the drive is not getting enough power – which often occurs on USB-powered drives. Another possibility is that the firmware of the drive or its controller needs to be rebuilt in order to make the data accessible again.[citation needed]
Preventing logical damage
The increased use of journaling file systems, such as NTFS 5.0, ext3, and XFS, is likely to reduce the incidence of logical damage. These file systems can always be “rolled back” to a consistent state, which means that the only data likely to be lost is what was in the drive’s cache at the time of the system failure. However, regular system maintenance should still include the use of a consistency checker. This can protect both against bugs in the file system software and latent incompatibilities in the design of the storage hardware. One such incompatibility is the result of the disk controller reporting that file system structures have been saved to the disk when it has not actually occurred. This can often occur if the drive stores data in its write cache, then claims it has been written to the disk. If power is lost, and this data contains file system structures, the file system may be left in an inconsistent state such that the journal itself is damaged or incomplete. One solution to this problem is to use hardware that does not report data as written until it actually is written. Another is using disk controllers equipped with a battery backup so that the waiting data can be written when power is restored. Finally, the entire system can be equipped with a battery backup that may make it possible to keep the system on in such situations, or at least to give enough time to shut down properly.
Recovery techniques
Two common techniques used to recover data from logical damage are consistency checking and data carving. While most logical damage can be either repaired or worked around using these two techniques, data recovery software can never guarantee that no data loss will occur. For instance, in the FAT file system, when two files claim to share the same allocation unit (“cross-linked”), data loss for one of the files is essentially guaranteed.
Consistency checking
The first, consistency checking, involves scanning the logical structure of the disk and checking to make sure that it is consistent with its specification. For instance, in most file systems, a directory must have at least two entries: a dot (.) entry that points to itself, and a dot-dot (..) entry that points to its parent. A file system repair program can read each directory and make sure that these entries exist and point to the correct directories. If they do not, an error message can be printed and the problem corrected. Both chkdsk and fsck work in this fashion. This strategy suffers from two major problems. First, if the file system is sufficiently damaged, the consistency check can fail completely. In this case, the repair program may crash trying to deal with the mangled input, or it may not recognize the drive as having a valid file system at all. The second issue that arises is the disregard for data files. If chkdsk finds a data file to be out of place or unexplainable, it may delete the file without asking. This is done so that the operating system may run smoother, but the files deleted are often important user files which cannot be replaced. Similar issues arise when using system restore disks (often provided with proprietary systems like Dell and Compaq), which restore the operating system by removing the previous installation. This problem can often be avoided by installing the operating system on a separate partition from your user data.
Data carving
Data Carving is a data recovery technique that allows for data with no file system allocation information to be extracted by identifying sectors and clusters belonging to the file. Data Carving usually searches through raw sectors looking for specific desired file signatures. The fact that there is no allocation information means that the investigator must specify a block size of data to carve out upon finding a matching file signature, or the carving software must infer it from other information on the media. There is a requirement that the beginning of the file still be present and that there is (depending on how common the file signature is) a risk of many false hits. Data carving, also known as file carving, has traditionally required that the files recovered be located in sequential sectors (rather than fragmented) as there is no allocation information to point to fragmented file portions. Recent developments in file carving algorithms have led to tools that can recover files that are fragmented into multiple pieces. Carving tends to be a time and resource intensive operation.
Recovering overwritten data
See also: Data erasure
When data have been physically overwritten on a hard disk it is generally assumed that the previous data are no longer possible to recover. In 1996, Peter Gutmann, a respected computer scientist, presented a paper that suggested overwritten data could be recovered through the use of Scanning transmission electron microscopy. In 2001, he presented another paper on a similar topic. Substantial criticism has followed, primarily dealing with the lack of any concrete examples of significant amounts of overwritten data being recovered. To guard against this type of data recovery, he and Colin Plumb designed the Gutmann method, which is used by several disk scrubbing software packages.
Although Gutmann’s theory may be correct, there’s no practical evidence that overwritten data can be recovered. Moreover, there are good reasons to think that it cannot.
See also
Wikiversity has learning materials about Data recovery
Backup
Continuous Data Protection
Computer forensics
Data loss
DriveSavers
Error detection and correction
File carving
Hidden file and hidden directory
I365
Recovery software
SystemRescueCD
Undeletion
References
^ IXImager Bad Sector Drive Imaging Study. Defense Cyber Crime Institute Cyber Files Reports and studies are available upon request.
^ “Issues with imaging drives containing faulty sectors” (PDF). National Institute of Standards and Technology. Elsevier Science Direct. http://dfrws.org/2007/proceedings/p13-lyle.pdf.
^ a b “dcfldd on non-FreeBSD systems produces extra “bad sectors”?”. http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=2557.
^ ‘Disk Imaging: A Vital Step in Data Recovery’ – This white paper describes disk-level issues that must be handled during a hard disk data recovery imaging.
^ The Evolution of File Carving A. Pal and N. Memon, IEEE SPM March 2009
^ Detecting File Fragmentation Point Using Sequential Hypothesis A. Pal, T. Sencar and N. Memon, DFRWS2008
^ Advanced Data Carving. Special Agent Daniel Dickerman, IRS criminal Investigation, Electronic Crimes Program
^ Secure Deletion of Data from Magnetic and Solid-State Memory, Peter Gutmann, Department of Computer Science, University of Auckland
^ Data Remanence in Semiconductor Devices, Peter Gutmann, IBM T.J. Watson Research Center
^ Feenberg, Daniel (14 May 2004). “Can Intelligence Agencies Read Overwritten Data? A response to Gutmann.”. National Bureau of Economic Research. http://www.nber.org/sys-admin/overwritten-data-guttman.html. Retrieved 2008-05-21.
^ Data Removal and Erasure from Hard Disk Drives
^ Erasing hard disk drive data: How many passes are needed?
Further reading
Tanenbaum, A. & Woodhull, A. S. (1997). Operating Systems: Design And Implementation, 2nd ed. New York: Prentice Hall.
What To Do When Windows Vista Crashes: Little-Known Recovery Strategies, from Information Week
External links
Data recovery at the Open Directory Project
Categories: Data recovery | Computer data | Data management | Transaction processing | Hard disk softwareHidden categories: All articles with unsourced statements | Articles with unsourced statements from February 2007
I am China Products writer, reports some information about 16ft usb cable , 50ft cat6 cable.
Processing your request, Please wait....
