Digging for data

The untimely destruction of your data doesn't necessarily mean that all is lost. Ashton Mills shows you how to bring it back from the dead.

Data recovery is a mystical and varied art that shares much with archaeology. Depending on where you dig for data you may or may not find what you are looking for, and the longer you leave going after your lost data the greater the chance it will be worn away by age and reduced to fragments of its former self.

Unlike archaeology, however, sifting through the desiccated bits of your hard drive's past can be easily done from the comfort of your study and with just a few simple tools.
But first it helps to understand the nature of data loss and the different levels of data recovery so you can choose the right tool for the job.

Your computer has been lying to you

When you delete a file on your hard drive the file itself isn't erased, only its record is.
If you read last month's piece on file systems (issue 67, page 127) you'll remember that all file systems use an index of some sort to store information about files and directories, including size and location on disk. This allows searching for the location of a file to be very quick, not to mention making the maintenance of even vast file systems a simple affair.

In the interests of performance it makes sense, then, that when a file is to be deleted all you really need to do is delete its entry from the index. To the end user, the file is no more. In reality, the magnetic bits and bytes that represent the file are still present on the disk, and can still be accessed and read.

The simplest form of data recovery, undeletion, involves scanning the filesystem's index, and sometimes the disk itself, for files and directories that still exist on the drive. Recovery is just a matter of re-creating an entry to refer to the space used by the file, although to be safe and keep the integrity of your file system most undelete programs will force you to copy the file to a separate device or partition.

The effectiveness of this technique depends greatly on how much time has passed since a file was deleted and a recovery operation was initiated. With a file's entry in the index gone, it's free to be replaced by another. Additionally, and more importantly, the disk space the file occupies is now free to be written over with new files. Some programs are able to resurrect information about a file, but the data actually recovered from the disk may be partly incomplete and mixed with information from other files. The longer you leave it, the greater is the chance of this happening.

This is why the Windows Recycle Bin lets you allocate a set amount of disk space for file undeletion – it quite literally it backs the file up into the Recycle Bin, a complete copy, because this is the only guaranteed way to recover a deleted file regardless of how much the drive is in use. In reality, it never gets deleted, just moved to the Recycle Bin. And, in case you're wondering, when this happens the file itself is not moved from one location on disk to another, its entry in the index is merely changed to reflect a new location in the file system hierarchy.
Sometimes basic undeletion can't recover lost information, and more advanced forms of recovery are required. These can involve scanning drives for recognisable file headers (for example all Word docs identify themselves as such) irrespective of what the index says, undoing formatted partitions (again the success depends on if the drive has since been reused), reconstructing boot table entries, recovering data from bad sectors, and repairing incorrect partition information. Frankly, there's an awful lot that can go wrong in the fragile realm of magnetic storage, but thankfully the most any of us have to deal with is the loss of an accidentally deleted file. For this there are a range of tools available that support all the popular filesystems including, of course, FAT16/32, NTFS and even ext2/3 under Linux.

Software solutions

If you think you don't have a need for data recovery software keep in mind there are other causes of data loss aside from user error. Viruses can delete key files to disable a system, power outages could see your data only partly written to disk, and badly behaved programs could overwrite essential files. Additionally, data loss could come in the form of partition and boot sector damage. All of these losses, however, can be recovered with the right software.

Popular names include Zero Assumption Recovery, OnTrack Easy Data Recovery, and R-Tools R-Studio (see boxout Recovery resources for links). All of them can scan your partitions and present a list of deleted files you can select to recover with a simple click.

Additionally these also support the more advanced forms of recovery, such as scanning a drive for recognisable data types, and even the ability to search the disk surface bit by bit for a string of data you know to exist in somewhere in your file. Looking at the raw data of your hard disk, instead of through the filter of a file system and operating system, can be an excellent learning experience.

Keep in mind however that no software tool can recover the unrecoverable. If the sectors of your disk that contain the information you are after have been overwritten with new information, then the information is lost, kaput, sentenced to the void.

This is why it's vital to start recovery as soon as you realise you need it. Drive size, file system type, and how active the drive has been will all play a part on how effective recovery procedures are, but all of these are second to how quickly you get onto starting a recovery. It goes without saying that if you realise you've lost information and you go to install some recovery software, to not install it to the partition where the files you want to recover exist – you may well end up overwriting the sectors where the deleted files reside with your data recovery tool, and wouldn't that be ironic?

All in all, data recovery software is simple and effective to use, but doesn't cover the gamut of all data loss problems.

Hardware solutions

Sometimes the problem lies much deeper and software options become ineffective – such as a hardware failure or physical drive crash. A crashed drive generally refers to a drive whose heads have skimmed into the platters of the disk, causing irreparable damage. Old, overheated, and badly treated drives (and sometimes just bad luck) are the main causes for drive crashes.

But as with software recovery, the parts of the platters still intact will hold the magnetic variances that represent your data. Thus, with the help of some special (and expensive) equipment, these platters can still be read and your data possibly recovered from them.

Data recovery services of this kind don't come cheap. At a minimum you'll be looking at a few hundred dollars (possibly exceeding the cost of the hard drive itself!) and this can easily scale much higher.
Obviously this is a last resort for those desperate situations where the value of your lost data is higher than the money it will cost to retrieve it.

There are plenty of data recovery services in Australia (see boxout Recovery resources) who can recover data from all forms of magnetic and optical media (so information on CDs, DVDs etc can be recovered also).
Even RAID arrays can be partially reconstructed long enough to make images of their data.

Prevention

Ultimately, especially in the case of your personal data, prevention really is better than cure. Effective data recovery depends heavily on what, if any, preventative measures y