02 May 2010
Posted in D
Please help us keep this glossary of Technical Terms up to date by sending us your criticism, comments or suggestions.
Data Recovery - Is the process of recovering or restoring data or information that has for one reason or another been erased, deleted, formatted or somehow removed from a computer storage medium such as an internal or external hard drive, flash drive, or CD/DVD.
Many factors will affect how successful a data recovery will be; these include but are not limited to:
- How the Data Loss Occurred.
- The Amount of Time that has Lapsed between the Data Loss and the Attempt to Recover.
- The Amount of Additional Storage Activity that has Occurred between the Time of the Data Loss and the Time the Attempt to Recover the Data is Made.
- The Physical State of the Storage Medium.
In every case of data loss the sooner the attempt to recovery the lost data is made the more likely the chances are to make a full recovery.
Knowing precisely how the data was lost will help focus the recovery efforts on the techniques that are best suited to the specific way in which the data was deleted or removed.
Typical examples of ways in which data loss can occur:
- Accidental Deletion, Erasure or Format.
- Malicious or Intentional Deletion, Removal or Format.
- Operating System Failure or Software Crash.
- Storage Medium Physically Damaged ie. Scratched CD/DVD.
- Physical Hard Drive Failure or Crash. Catastrophic Hard Drive Failure.
In the case of an Operating System crash or Software crash, many times the actual data itself is still intact but remains inaccessible. In this particular type of situation there are several relatively easy methods available to gain access to the data making it possible to transfer the data to an external drive or storage medium.
Perhaps the easiest method, and the one that I personally favor, is to use what is referred to as a Live CD. A 'Live CD' is a self mounting boot-able version of an operating system that is contained on a CD/DVD or in some cases a boot-able flash drive. By making use of a 'Live CD', even a system that has very severe damage and will not respond to the typical recovery processes such as using 'Safe Mode' or the 'Recovery Console' can be accessed using the 'Live CD'.
This is possible because the 'Live CD' completely bypasses the Operating System that is installed on the System hard drive and is actually a fully functional version of an Operating System in and of itself. The 'Live CD' does not require any physical storage space to execute other than system RAM. As the 'Live CD' initially boots, it takes a portion of available RAM and creates a 'virtual drive' or 'RAM Disk' in that storage space. The virtual drive is then assigned a drive letter and is mounted in exactly the same way an actual physical hard drive would be.
The Operating System that is most widely used on 'Live CD's' is Linux in one form or another, although there are versions of 'Live CD's' using Windows, Mac, and other operating systems as well. There are many, many 'Live' versions of Linux available that have been designed specifically to facilitate file & data recovery and system restoration and several of them have excellent tools included for this very purpose. Additionally most of the newest versions of Linux are much more 'Windows' like, with GUI interfaces that will seem familiar to most users making them much easier for the neophyte to navigate and use.
It really comes down to personal preference when choosing one of these operating systems as they have many common features. Knoppix is one that I can personally vouch for as I use it fairly regularly myself.
After choosing a 'Live CD" and downloading one of the image files you will need to burn it onto a disk. Also be sure that the System you are working with is set to boot from the CD/DVD first in the Bios.
Another possible way to recover data after a System Crash is to remove the actual Hard Drive from the afflicted system and then connecting it to a functioning computer system thereby allowing the transfer of data and files to a safe destination.
When attempting to recover original data even when the directory entries and file pointers have been deleted requires a process referred to as File Carving.
IT Support Birmingham