 |
|
||||
|
Data Recovery: Engineers vs. Software, Part 1April 11, 2006
Automated Data Recovery SoftwareWhat about the do-it-yourself data recovery tools? Are these of any value? These types of software tools are designed by individuals or companies who have a working knowledge of file systems. The design goal of this software is to be smarter than the volume repair utilities and also to find data that the file system no longer points to. Do-it-yourself data recovery tools analyze the file system and the data and provide a way to view or copy out the found files. In general, most do-it-yourself data recovery tools look for:
Hard drives that have suffered a physical or electronic failure can not use data recovery software. Do-it-yourself data recovery tools work great for simple data loss situations, such as deleted partitions, deleted volumes, and minor data deletion. Do-it-yourself recovery software will attempt to analyze the existing file system and determine if any of the structures are useable. This analysis can take from a few minutes to a few hours depending on the size of the drive and amount of data. When the analysis is complete, the recovery software will show a listing of all of the folders/directories and files. At this point the files can be opened or copied elsewhere. Quality do-it-yourself recovery software will not allow changes to the original storage device and will only allow the data to be copied to another destination. This is a protection so that the original data is not lost. In cases where there are little or no existing file system structures, a more complete or advanced scan of storage media is required. The do-it-yourself software will search only for folder/directory/file names or specific file types. This in-depth analysis can take hours to complete because the recovery software is searching through every sector of the drive looking for usable data or information about data. When this analysis is complete the recovery software will show a listing of folders and files. However, the original names of the folders may be replaced with odd alpha-numeric names (example: “001E4A.DIR” or “2B0002”), these are hexadecimal (base 16 numbering system that computers use) numbers where folders/directories are physically located. Depending on the level of corruption the file system has sustained, these names might only be the top level of the listing and by going into any sub-folders/directories you might start to see folder/directory names that are more familiar. At this point, files can be opened or copied elsewhere. This advanced search may find names of files you used to have, yet the data may be unusable or unreadable. Why would the results be less than ideal with an advanced scan; shouldn’t this produce better results? The reason for limited results with do-it-yourself data recovery software is because of the pre-programmed path that the software uses to find the missing files. These pre-programmed recovery algorithms follow a defined course and automated recovery software must begin searching with assumptions of the volume definitions. If these assumptions are incorrect or the level of corruption is severe, the results will be poor. For instance, one assumption is where the partition and volume begins—if the front-end of the drive has been erased, then no reliable references can be found for where the volume starts. During the advanced scan the software may find names of files, yet the ‘pointers’ to the data do not ‘line up’ with where the data is physically located—thereby making the files found unusable. Another example of automated data recovery software making recovery assumptions is the cluster or block size. File systems allocate space to files in units called clusters (a cluster is the smallest unit of disk space that can be allocated for use by files). Each cluster contains from 1 to 64 sectors, depending on the type and size of the disk. If there is not a reliable reference for what the cluster size is, the software has to make a best guess. If that detail is wrong, the recovery software may find names of files, but, again, the data will not be located in the correct location and will be unusable. So how would you know if do-it-yourself recovery software works for you? Start with the basic scan, not an advanced mode, and see for yourself what the results are. You can judge the quality of the recovery by going through the list of foldersdirectories and opening up the recovered files. If some of the files work and others do not, you can choose an advanced mode to see if there are better results. If a number of files are not working then the next alternative option should be looked into to recover the original data. Not all data loss situations can be solved by automated software. When do-it-yourself recovery software does not present usable files, the next recommended step is to engage the expertise of an experienced data recovery engineer from an established data recovery company. Examples of data loss where an experienced engineer is the best course of action are:
Come back tomorrow for Part 2. About the Author: Sean Barry is the remote data recovery manager for North America at Ontrack Data Recovery. He joined Ontrack Data Recovery, a subsidiary of Kroll, in 1997.
|
|
|
|
Email
Print
Digg This
Add to del.icio.us
