Data recovery is a process of recovering inaccessible, damaged or formatted data. This may be from secondary storage, where the data stored cannot be accessed. Storage media often contains files that can still be accessed. This includes internal or external hard drives. As well as solid-state drives, or USB flash drives. Data recovery may be required as a result of damage to the file system that prevents it from being mounted by the operating system.
The most common recovery scenario involves an operating system failure. Other scenarios include malfunction of a storage device or failure of storage devices. As well as accidental damage or file deletion. In these cases, we copy all important files from the damaged media to another new hard drive. We do this using a Live CD. This provides us a means to mount the system drive and backup drives or removable media. We then move the files from the system drive to the backup media with file manager or disc authoring software.
Hard Drive Failure
Another scenario involves a drive-level failure, such as a corrupted file system or drive partition. This can also occur as a result of a physical hard disk drive failure. In any of these examples, the data can often not be read from the media devices. Solutions involve repairing the file system, partition table or master boot record. Another method is to update the hard drive firmware. We also employ drive recovery techniques such as software-based recovery of corrupted data. As well as hardware and software-based recovery of damaged service areas, to hardware replacement of a physically damaged drive. If data recovery is necessary, the drive itself may have failed. The focus then is on a one-time recovery, salvaging whatever files can be read.
Accidental deletion of data
In some cases, files may have been accidentally deleted from a storage medium. Often the contents of deleted files are still recoverable from a physical drive. It may be references to them in the directory structure have simply been removed. Thus space the deleted data occupied has been made available for later overwriting. In this case, deleted files may not be visible via a standard file manager. However the deleted files may still exist on the physical drive. Often the original file contents remain, albeit in disconnected fragments. They may be therefore recoverable provided they have not been overwritten with other files.
The term “data recovery” is also used in the context of forensic applications or espionage. This occurs in cases where data which has been encrypted or hidden, rather than damaged, is recovered. Sometimes files present on a computer may be encrypted or hidden due to things such as a virus attack which can only be recovered by computer forensic experts.