Phases of recovery after data loss

[Allison]

Many users have talked about the recovering of data after it gets lost from hard disk. But I think that no-one is interested to know the basic concepts of recovering. When I tried to search it on Google, I didn't get any appropriate information regarding it. So, I thought to ask you members about it. Please tell me what are the phases or steps that are involved while doing the recovery. I am not sure where to post this thread, was having doubt about the sections, so I posted here. Hope that you members won't mind . . Please help me soon.

[LasitMalinga]

First, I would like to appreciate you for this question. And yesss, you were right, according to me, no-one has discussed about it till now. That's why you will not find any results in Google. I am providing some basic things, if a defective hard drive or disk into the labs, it is the first analysis. It is determined with special equipment type and extent of the damage and created a forecast of the salvageable data. Following this analysis, the customer will receive the following status report:

• Nature and extent of the damage.
• Indication of the reconstructed data.
• Proposed solution.
• Time and cost of data recovery.

[Unnat]

At the beginning of the analysis is a visual examination. In the case of removable media or tapes, so can many times be an estimate of the damage. It is more difficult for hard drives : If a drive with suspected head crash into the lab, so a new start would be far too dangerous. The specialists in this business, first at a trick without having to open the same plate. Through a hermetically sealed diagnostic hole the engineers look with special microscopes in the interior of the disk. For example, mechanical damage to the heads are discovered. Or it is distributed by dust due to abrasion of the magnetic disk surface due to a head crash. After the optical test the controller logic to a functional test is carried out. About special measurement equipment and test patterns can be determined specifically the correct operation of the board. Usually has the software on a hard drive also has a special diagnostic mode that can be queried via the progressive individual functions.

[Broot]

You can divide the phases of recovery in four divisions, and they are :

• Phase I: Analysis
• Phase II: physical rescue
• Phase III: Pattern Analyser
• Phase IV: logical rescue

Let me remind you that talking about the phases is not important, till you don't want to understand the concept. Normally users want some applications that can be useful for recovering their data loss. When they get it, they just recover it and everything is over. Only some user (like you), want to know about the concept. So, even I would appreciate this thing.

[shilong]

I would discuss about the physical rescue. If the customer after the analysis with a data recovery agreement, the first actual rescue process. First, try the labs a complete image of data left to create. Because the companies never work on the original media. Any errors in the reconstruction work to do so easily reversed. When the image creation, each sector is read individually - with hard drives with 500 GB of capacity that is up to a billion. A hard disk can be made by replacing defective parts back in working order, the process of reading the intact traces directly on the hard disk interface. It becomes more difficult if they can no longer operate the drive. The lab engineer then takes apart the magnetic disk stacks of the hard disk.

[Zeverto]

Pattern Analyser can accommodate single magnetic discs and read traces each sector still intact. Here, the magnetic orientation of each bit is determined. The recorded analog signals of the individual bits of the analyzer transforms into a bit stream of ones and zeros. Depending on the track and bit density and characteristics of magnetic disks, the pattern analyzer include any magnetic heads for reading. However, the time and thus financial cost of this method is very high. Some machine uses the pattern in their own words in only two percent of all data recovery cases.

[spuff]

Some machine uses the pattern in their own words in only two percent of all data recovery cases.

Other laboratories have similar technical equipment, can be here but is reluctant to look into the cards. The specific procedures for data recovery companies such as the guard state secrets. With the image of the disk is trying to specialized software to extract from the zeros and ones back data structures. Here is the complicated and difficult part of data recovery : Reconstruction of file systems and how were the data from the hard disk of the disk stored on and managed.

[Lord of the RIG]

A further difficulty is that to keep the hard drive manufacturers also to the data recovery laboratories with information on the organization of the data is very cloudy. Finally, different hard drives from different manufacturers in the performance by these algorithms, and no one wants to reveal these secrets. The same applies to RAIDs. The manufacturer of RAID controllers guard their algorithms for the arrangement and distribution of the data as a trade secret. The more difficult and time consuming for data recovery is the analysis of the structures. With most tools specially programmed the software professionals looking for specific structures and bit strings, with which conclusions are drawn on files. If the customer wants, for example, only certain Excel files are saved, the engineers are looking specifically for the structure of this file type. The work of data recovery is facilitated considerably if the customer can provide accurate information about the contents of its hard drive / media. The data obtained from the reconstruction specialists to copy, possibly in the same directory structure as on the original disk. This is only possible if information is available on the original partition and file system. The restoration of the directory structure is otherwise very expensive. Upon successful completion of the recovery, the customer receives its data at a desired medium back from it. The laboratories save with the consent of the customer data to be several weeks and preserve this in a safe.