Forensico.com Sitemap...Forensico.com Contact Forensico.com
About Computer Forensics...Forensico.com Computer Encryption...Forensico.com Cryptanalysis...Forensico.com Steganography...Forensico.com Data Recovery...Forensico.com
 

Industry News

 

Data Recovery

 
   

Data recovery is the act of salvaging data stored on damaged media, such as magnetic disks and tapes. There are a number of companies and software products that can help recover data damaged by a disk crash or computer virus. Of course, not all data is recoverable, but data recovery specialists can often restore a surprisingly high percentage of the data on damaged media. The ability to recover "deleted" data is a problem when equipment used to store sensitive data is to be discarded.

Data recovery cases can be divided up into two main categories:
* Common Recoveries - Involves floppies and hard drives that are usually from single-user personal computers and file servers. * Complex Recoveries - Involves hard drives, RAID arrays, tape and optical media or corrupted databases and file systems usually from multi-user, business systems. Data storage at the high end has become a very complex field. In the case of these complex systems data recovery can be seen as "troubleshooting data storage." Whether common or complex, each data recovery case is unique and the process can be very resource extensive and exceedingly technical.

Increased Incidents of Data Loss

Despite technological advances in the reliability of magnetic storage, the incidence of data loss continues to rise. Data storage devices are susceptible to damage from natural and human sources.

Consider these facts:

1. More data is being stored in smaller spaces - Today's hard drives store in the hundreds of Gigabytes of data over 1000 times the data stored on the drives of a decade ago. Increasing storage capacities amplify the impact of data loss, making mechanical precision more critical. A slight nudge, a power surge, or a contaminant introduced into the drive may cause the head to touch the platter. This is commonly referred to as a head crash. 2. Data has become more mission-critical - Users today store more data on their desktops and networks that is mission-critical to their organizations and to their personal lives. Loss of mission-critical data, by definition, can cause major business processes to stop requiring data recovery. 3. Backup technology and practices have failed to adequately protect data - Many users back up their data only to find their backups useless at that crucial moment when they need to restore from them. Failure occurs because backup systems are designed with a set of requirements that rely on a combination of technology and human interaction for success. Tape drives and cartridges do not always work properly as well as other media designed for backup fail due to their dependence on mechanical perfection. Backup systems can become corrupted causing corruption of critical data. Users can accidentally back up incorrect information or miss critical information.

Causes of Data Loss

Data loss happens for a number of reasons. Anything that is considered important should exist in AT LEAST two distinct physical locations. Unfortunately most people don't commit the time/effort/resources to ensure that a good backup is in place otherwise data recovery would be unnecessary. It has become a major problem over the last few years as more and more digital information is being stored on media that fails. It's estimated that only 3% of the worlds information is backed up. If backups are not done or not done correctly simple failures can leave you without any data, or with the wrong data.

* Backup files not recognizable by the database engine
* Database locked as ‘suspect’ preventing access
* Deleted or dropped tables
* Accidentally deleted records
* Data deleted with criminal or malicious intent
* Corrupted database files
* Damaged individual data pages
* Accidentally overwritten database files and devices
* Flood, Fire or Earthquake (natural disasters)

Remember that at some point everyone who works on a computer will experience data loss. It's not a question of if data will be lost but when data will be lost. A data loss situation is usually characterized by the sudden inability to access data involving a previously functioning computer system or backup or the accidental erasure of data or overwriting of data structures.

What To Do

To prevent catastrophic data loss, a routine data backup that creates a second copy of important data for storage in a different physical location must be established. A data backup will not insure 100% recovery of data, however a data backup will offer the ability to recover some portion of the lost data with relative ease. The freshness of the recovered data will depend on the frequency of the data backup. The frequency of data backup is dictated in some instances by law, in some instances by corporate policy and in others, by good user practice. Data backup methodologies like real-time data replication can be quite costly but offer the greatest protection against data loss. This solution may not be suitable for some organizations who may opt to backup data with a scheduled data back up, normally nightly, to storage tapes that can be sent offsite. With a nightly backup, there is a risk of lost data in the interval between the nighttime data backup and a daytime incident that causes data loss. In such cases, normally the data must be recreated. Individual home users can simply copy data on a desired schedule to any number of different storage media types.
Data backup recovery tests should be performed for all backup processes prior to a data loss to verify the integrity of the data backup process.
IF YOU THINK YOU HAVE EXPERIENCED DATA LOSS OF IMPORTANT FILES BE CAREFUL WHAT YOU DO! Some data loss is casued by simple things such as loose wires. Note any efforts you take carefully. Carefully document what happened just before the data loss, software installation, sudden power loss, component installation, system upgrade etc. These datails can be very helpful for the data recovery team.
If you make changes to the media in an effort to recover data it could easily make the situation worse. If the information is important, it's a good idea to work from a bit-for-bit copy of the media rather from the origional media. Any reputable data recovery lab will know how to make such a working copy.
Don't be tempted to open a hard disk drive "to see what's wrong". The smallest spec of dust could render the drive useless. Hard disk drives should be opened for repair only in a dust free class 100 or better clean room environment.
If you have a disk that is making scraping, grinding or clicking noises turn off the computer immediatly and leave it off. Pack up the disk carefully (as though it was eggs) and send the drive to a reputable data recovery lab. Those sounds could be indicative of your disk platters being damaged. The longer the platters are exposed to abuse the less likely the data will be recovered, every second counts.