What is Data Recovery and how does it work?

Let me tell you a personal story about how I learned to use data recovery tools. 

A few months ago, my laptop just stopped working. It was booting, but it was never showing the Window screen. After a short diagnostic, I found out the problem was a damaged storage device (in my case a hard disk device (HDD)). I change it with a solid-state drive (SSD) and managed to get back all the information that I needed thanks to the backup solution that we have in the office, but it made me think. Is it 100% safe to just throw away this old HDD into the trash? Can somebody recover the data and expose the company’s information? 

From there, my data recovery quest started! 

What is data recovery?

Data recovery is a computer process of restoring lost, damaged, corrupted, or formatted data. It is used to get back information from storage devices like HDD, SSD, CDs, DVDs, USB flash memories, memory cards, and more, that are not available or executable in any other way. The damage could be due to many reasons like accidental deletion, failure of the storage device, some bug in the software, hacking attack, data corruption, file transfer failure or power failure, and even physical damage. When we talk about physical damage (impact, water, or another factor), then there are data recovery experts that can still recover part of the information.

So, we can define two types of data recovery here; one is software-only, and the second involves the physical reconstruction and donor hardware to recover the data.

Let’s go deeper into the type of problems, why they occur and how can we recover the data.

The most typical cases of data loss

Accidentally deleted files or folders

There is a great difference in how this process works on the different OSes (Windows, Linux, macOS, etc.). In most cases, when a file is deleted, it is not really thrown away from the memory. Just the memory is marked so the system can see it as free and put another information on top of it. For this reason, there is a very big chance to recover a huge chunk of the data if the storage space is big enough and it’s not being over-written with new information frequently. So, if you are using the FAT format system (exFAT, or FAT32) on Windows, the system will mark the deleted item as “unused” and remove the information about its location.

If you are using NTFS file format, the file entry on the system will be marked with “unused”, and the record is deleted from the directory and the disk space gets marked as “unused”.

On Linux and Unix-based OSes like macOS, the system will destroy the file descriptor (all the description about the file’s location, what type it was, file size, and more) and mark the space as “free”.

In a case of accidental deletion, you could have a good chance to recover the data with data recovery software.

File system formatting

Here you might have a big problem. Changing the file format will change the structure of the data inside the storage device. It will create an empty file system structure and the system will start to write information on top of it.

Here the data recovery software can help too, but you might need professional software with more options to be able to recover your files.

If you formatted your flash memory or SSD by mistake, and you have not put anything new on it yet, you can still recover files from it with a high success rate.

Logical damage of the file system

Due to a power outage, software problems, hardware issues, or another reason, this error will stop you from accessing some specific files. No system is 100% free of that risk.

Software recovery tools might have enough information to recover the files.

Hardware storage failure

Storage device failure is extremely common. When you are buying an HDD or an SSD, you can see on the box how much time or total information writing (data) it can handle. So having such a problem is something normal that you should be prepared for. You can detect how much your drive has been used already and when it’s time to replace it with a new one. There is paid software like Hard Disk Sentinel, or a free ones like CrystalDiskInfo. The diagnostic software works based on the SMART system; Self-Monitoring, Analysis, and Reporting Technology. It is a technology that will provide you with all the critical information that you will need in order to determine the state of an HDD or an SSD.

If you are having problems with one of the drives on your server at the office, you most probably use a RAID configuration for redundancy.

If that is the case, you might be lucky with the information being available on the rest of the storage devices. Removing the broken one and adding a new one might be enough to recover all the information.

If that is not the case, you can try data recovery software, however, you may require a professional data recovery service.

Loss of information about a partition

Due to user error, a failed formatting, or a bad disk operation, the information about a particular partition size, location and letter could be lost.

It also can be recovered with software.

How does data recovery work?

As we mentioned before, if the storage hasn’t been used after the problem that led to data loss, there is still a good chance to recover the data. If new data was written on top of previously deleted data, it may prove very difficult or impossible to recover.

So, if you formatted your SD card with pictures by mistake, don’t use it until you can recover the data. 

You need the intact storage and data recovery software.

The software will try to find metadata by doing a metadata analysis and it could also try to perform raw recovery, based on the known content and files. The metadata is additional information that files have and  by performing the metadata analysis, the software can find all kinds of different properties of the lost files, their dependencies, data of creation, and more.

After this, the raw recovery starts. It uses known patterns, file signatures and it can recognize files. The files that this process recovers will get new names and folders, and sometimes you are able to recover all the files. 

Professional data recovery

There are many professional data recovery services that will take your storage device and try all avenues to recover and get the information back. You should always use such a service when it is about mission-critical information that otherwise would be lost (ie. you don’t have another copy). You will need to send the damaged drive to the data recovery company. The professionals will examine your device and see what has been damaged, and search for solutions. Usually, they will need a donor drive which is  the same as the damaged one, and they will perform hardware repair by disordering parts from the donor and replacing the damaged components from the donor one. The whole process is done in an extremely clean and sterile environment because even a small speck of dust could destroy data on the drive.

Forensic detectives could use such a professional service when they are working on an important case when there is a good chance that a storage device has important pieces of evidence. After the physical process, the data will be copied to a new drive and with the help of software, the data will be checked. After that, the software will try to rescue as much as possible from the files.

A typical recovery procedure costs around $300-$500 dollars per drive, so it is an expensive procedure that should be used only as a last chance to recover the data.

Data recovery software

Of course, here you can find both free and paid-for data recovery software.

Free software could be the best solution when we are talking about a personal computer that you don’t use for work. Professional software might cost too much for such a casual task, and with a free one, you can still recover your data.

What I used in my case was the free version of a software called Recuva. It is a software from the company that created the popular CCleaner.

It had a relatively easy-to-use interface and intuitive navigation. When using it, you will be asked what files you want to repair, and where were the deleted files. You will see a big list of files and it will show you if they can be saved or not.

In my case, I was doing it as an experiment, and I managed to get a few word files from my Download folder and open them correctly. But here it is a good time to mention that probably half of all files that were showing in Recuva, were impossible to save.

When it comes to paid-for data recovery software, you can go with the paid version of Recuva, or try Disk Drill Data Recovery Software which you can use on macOS too.

And for the Linux users, I recommend PhotoRec. A friend of mine, a photographer, showed it to me. It has a less-intuitive interface and it does not save the previous names of the files, but it works with many formats and can easily save your content from your badly formatted SD memory card.

How to destroy data permanently?

Disk wipe software

You can use special software that uses different algorithms of writing data to the drive to permanently delete data. You can use free software for this like DiskWipe. It will write random rubbish binary data on the drive multiple times over until the disk is in such a state that data recovery software can’t detect any file. It is a good solution if your drive is still working, and you want to make sure all your data is deleted permanently. You can use it when you are selling an old computer or storage device. That way, the next owner won’t be able to restore any data from it. 

Physically destroy it

Sounds very radical, but it is the safest choice. You can destroy a storage drive in various ways:

• Disassemble it. Remove the main parts and nobody will be able to repair the drive.
• Hit it. Electric devices are very fragile so this could work. 
• Put it in water when it is disconnected from the power. This will create a short circuit if there is still some charge and oxidize the connections.
• Heat it. No device likes excessive heat, so it will destroy it. Just be careful while doing it.

Conclusion

Data recovery is a possible solution to accidentally deleted files and hardware failures. Yet it is far from a 100% guarantee and should be used only if there is no other way to get back the missing files. And let’s not think about the professional data recovery services that could cost you thousands or even tens of thousands of dollars. A better choice is to have a backup that is easily accessible – this way, you can get your information back quickly and painlessly. A backup solution that could really save you from mistakes is our BaaS service. It is easy to use, and works perfectly, keeping your data safe in the cloud!

Another related topic could be this one:

10 Common Causes of Data Loss