Disk Data Recovery

What's the chance of a disk drive failure? Whether most people think about it or not, all disk drives fail eventually, so the failure rate is 100%! The big question is when will it fail, and how much damage will it do to your data? Barring a catastrophic disk failure (where the drive fails to operate), you can lose data many ways. A disk drive head can touch the media causing damage to the coating; you can accidentally delete files; the operating system can lose track of what is where, or any number of other situations that mean your valuable data is lost. The good news is that rarely is such a loss irretrievable. In most cases, the disk still contains your data, but it is not readily accessible by your operating system.

So what can you do? If your disk drive has suffered a major failure, either of the disk drive mechanism or the data heads, chances of you being able to repair the damage yourself and recovering the data on your disks is small: if your data is valuable, you'll have to resort to one of the specialist companies that typically remount your disk platters into other disk drives and recover your data that way. The process is time-consuming and expensive, so you'll have to judge the cost against the value of your data. (Of course, you should have made backups!)

For other types of data loss, such as accidentally deleting files, operating system problems, or applications that cause data corruption, you can perform many data recovery operations yourself. Recovery procedures depend on how the data was lost, and what kind of partitions (FAT or NFTS, for example) you have on your disk drive. To understand disk recovery processes, it is useful to understand how a disk drive is used by the operating system.

FAT (File Allocation Table) comes in two flavors: 16 bit (used for DOS) and 32 bit) which was introduced with Windows 95. NTFS (NT File System) was introduced with Windows NT and is used by default in all recent Windows versions (although FAT is supported). A really useful feature of NTFS (for the purposes of data recovery, at least) is that it provides backup copies automatically of some essentially disk information (such as the table that indicates where each file is stored) to help with disaster recovery).

Both file systems use a Master Boot Record (MBR) on the first sector of a hard drive to describe how the disk is laid out. If damage occurs to the MBR, recovery of data can be very difficult. The first sector of each NTFS partition is reserved for the partition boot sector, which tells the operating system how to read the partition. NTFS keeps a backup copy of the boot sector so a data recovery software can access it, allowing easier recovery of files on a disk drive that has had a bad sector where the partition boot information is stored. DOS does not keep backup copies of the partition boot sector, but there are utilities that can create copies for you.

After the boot sector on an NTFS partition is a file called the Master File Table (MFT). This lists the names and permissions, as well as other information, for every file in that partition. When you or an application accesses a file, the MFT is consulted to find its information. NTFS stores a backup copy of the MFT, again allowing software utilities to access the backup in case of problems with the main MFT.

FAT uses the first file after the partition information for the File Allocation Table (FAT), which is backed up by the operating system. However, the FAT file has to be in a special location on the partition for the operation system to access it, hence the need for software to recover backup copies and move them.

When you, and application, or the operating system deletes a file, it does not erase the data from the disk drive. Instead the MFT or FAT is updated to indicate the file is deleted (all the information is still there!). The problem is that the actual data on the hard drive can be overwritten by other files since those parts of the disk are marked as not being used. This is why data recovery operations are best used as soon as possible after the file was deleted. But, if you catch the mistake fast enough, you have an excellent chance of recovering the data! This leads to a basic rule: if you want to recover a file that has been deleted, don't write more data to the disk hard drive if you can avoid it! Even if part of the file has been overwritten, it is still possible to recover as much as possible.
Keep in mind the first and last rule of preventing data loss: use backups!