In computing, data recovery is a process of salvaging (retrieving) inaccessible, lost, corrupted, damaged or formatted data from secondary storage, removable media or files, when the data stored in them cannot be accessed in a normal way. Files are most often salvaged from storage media such as internal or external hard disk drives (HDDs), solid-state drives (SSDs), USB flash drives, magnetic tapes, CDs, DVDs, RAID subsystems, and other electronic devices. Recovery may be required due to physical damage to the storage devices or logical damage to the file system that prevents it from being mounted by the host operating system (OS).
The most common recovery scenario involves an operating system failure, malfunction of a storage device, logical failure of storage devices, accidental damage or deletion, etc. (typically, on a single-drive, single-partition, single-OS system). In these cases, the ultimate goal is simply to copy all important files from the damaged media to another new drive. This can be easily accomplished using a Live CD, many of which provide a means to mount the system drive and backup drives or removable media, and to move the files from the system drive to the backup media with a file manager or optical disc authoring software. Such cases can often be prevented by disk partitioning and consistently storing valuable personal files (or copies of them) on a different partition from the replaceable OS system files.
Hard Drive Failure
Another scenario involves a drive-level failure, such as a compromised file system or drive partition, or a hard disk drive failure. In any of these cases, the data is not easily read from the media devices. Depending on the situation, solutions involve repairing the logical file system, partition table or master boot record,or updating the firmware or drive recovery techniques ranging from software-based recovery of corrupted data, hardware and software-based recovery of damaged service areas (also known as the hard disk drive’s “firmware”), to hardware replacement on a physically damaged drive which involves changing parts of the damaged drive to make the files in a readable form which can be copied to a new drive. If a drive recovery is necessary, the drive itself has typically failed permanently, and the focus is rather on a one-time recovery, salvaging whatever files can be read.
Accidental deletion of data
In a third scenario, files have been accidentally “deleted” from a storage medium by the users. Typically, the contents of deleted files are not removed immediately from the physical drive; instead, references to them in the directory structure are removed, and thereafter space the deleted data occupy is made available for later overwriting. In the mind of end users, deleted files may not be visible via a standard file manager, but the deleted data still technically exists on the physical drive. Still, the original file contents remain, often in a number of disconnected fragments, and may be recoverable if not overwritten by other data files.
The term “data recovery” is also used in the context of forensic applications or espionage, where data which has been encrypted or hidden, rather than damaged, is recovered. Sometimes data present in the computer gets encrypted or hidden due to reasons like a virus attack which can only be recovered by computer forensic experts.