Wednesday, February 25, 2009

Data Recovery Tips

When it comes to hard drive data recovery there are a lot of myths out there. People are recommending Scandisk or some 10 year old DOS utility as the most sophisticated data recovery tools. When turning to a discussion group for help after a system crash, you often get to hear: "Just recover from your back-up - you have one, don't you?" Now - that's helpful! Whatever happened to your data - whether files were accidentally deleted, the drive was formatted or fdisk'ed, a virus has wiped out the boot record or even if it is no longer recognized by the OS, as long as it wasn't physically overwritten, the data which was on the drive is still there and can be recovered. The files just aren't accessible anymore the way they should be. For example, if you delete a file, the file's data is not deleted from the drive, but instead a signature byte is set at the start of the file's file name. This signature byte tells the OS that this area can be overwritten by other data next.

And that's exactly what happens: the next time you write something to the drive, the new data will be written to the so marked area. But this also means, that as long as nothing new is written to the drive, the data is still there, intact and can therefore be easy recovered.
This behavior is also the reason why trying to undelete single deleted files often isn't successful. When you delete a file and you empty the recycle bin as well - as soon as you notice that you still need the file, chances are that you have done something in the meantime, that has overwritten the data area of the file. Even in cases which seem the most radical - when you for example have formatted your drive from FAT32 to NTFS- and five minutes later realize that you didn't mean to format THIS drive, all of your files are still there.

When you format a FAT32 drive, everything is destroyed (the boot record, the FAT, the root directory) except for the partition table and the data. And that's all you need! As long as the data's still there your files can be reconstructed - very often nearly perfectly.

"Installing this one program will not hurt..." Yes it will!

NEVER install or copy anything to the hard drive you want to recover data from.

If you can avoid it, don't even run the drive anymore. Run it only one more time, after you have attached it to a healthy Windows computer as a second drive, installed the data recovery software on the other, "good" drive, and are running the software to scan the "bad" drive.
Writing anything to the drive you have the data loss on, can doom the whole recovery. Installing a seemingly tiny 1MB program on the drive can mean that you are not only overwriting 1MB of space on the drive, but are corrupting 500MB or more worth of files (especially when the hdd is fragmented) beyond recovery. Even surfing the Internet (looking for data recovery tools) without downloading anything can overwrite data on the drive. While on the Internet temporary file are constantly created on your hard drive, often without you knowing it and even if you have disabled the use of cookies etc...

"In the end only a professional data recovery service can help..." If you lost data due to a physical problem with the drive, for example the drive is making strange noises, doesn't spin at all, or is no longer recognized by the BIOS, this might be the case. When a hdd is physically damaged most times no software solution is going to bring your data back. It is recommended not even to try to recover your hdd yourself in these cases, because each time you run a damaged drive could be last time it is running at all. When you still feel tempted to try to recover a physically challenged drive yourself, at least - before you do anything else- make an image of the drive and run all data recovery attempts on the image. But for all data loss scenarios due to logical failures like accidental file deletion, format, fdisk, software or power failure, user error, virus attack etc. the following is true:

* You don't have to be a computer pro to conduct your own data recovery safely and inexpensively!
* Don't try to use any repair tools, like "boot record repair" or "bad sector repair" tools, whatever is out there. Don't run ScanDisk. These tools are writing to your drive, and in the process are likely to overwrite the very files you intend to recover.

* Instead use data recovery tools, which don't write to the drive. Make sure to use the data recovery software as recommended. Never install or copy anything to the drive you are about to recover. Instead attach the drive to a working Windows computer as a second or slave drive and run the software from the "good" computer.

No comments:

Post a Comment