Data Recovery Glossary [part 1]

31 January 2014 by Sam Wiltshire

Often when our consultants answer the phone there can be some technical terms that, if you’re not a data recovery engineer or IT professional, chances are they will probably be unfamiliar. In this blog post we show you some of the most common terms for hard drive failure types and reason in layman’s terms.

Physical failure: is a failure to the internal components or electronics of a hard drive. The causes can include: knocks/drops, water, power failure etc. For this type of failure we could establish three sub categories:

  • Physical media damage: Physical damage to the platters where the data is stored. This can be in the form of scratches or dents on the platter. This failure is caused when the reading head comes into contact with the surface of the platters either when it is stopped or when it is in operation.
  • Electronic failure: This occurs when there is an anomaly in the power supply or an overload of the electrical circuit causing a power surge that burns the electronics attached to the circuit board.
  • Mechanical failure: These are failures to the internal parts of the hard drive. There are many causes for a mechanical failure, but the most common is overheating of the hard drive which causes the platter to dilate, consequently the read/write head can be wrongly positioned.

In the event of a physical failure it is expressly advised that you leave the hard drive to professionals to recover your data as, unfortunately in these situations, data recovery software cannot help.

Logical failure: In these situations the physical state of our hard drive is in working condition, however, something has gone wrong with the logical storage system on the drive itself. Logical failures can be due to many reasons, here are some of the most common:

  • Virus: We often see data loss caused by a malicious virus. To avoid these failures it is very important to have a good antivirus and be careful with the files that we download from the Internet.
  • Formatted drive or disk partition: By formatting a drive or creating a new disk partition we reset the hard drive back into a factory-like setting with a brand new file system, ready for a new operating system to be installed. However, often clients don’t realise the importance of the files that they had stored on the drive prior to the format process, and as such are deleted.
  • File deletion: This is caused when we delete some files by mistake or voluntarily. However, when files are deleted they are not erased – the area of the drive that stores those specific files is marked available to be overwritten with new data, whereas erasing files actually resets the area of the drive where the files were stored back to a factory reset-like state.

In these situations data recovery software can be used to recover your files, however, it is always best not to install the software directly to the drive that suffered the data loss as the installation of the software itself could overwrite the very files you are trying to recover. Instead it is advised to install the software to another hard drive attached to the same computer.

Image: an exact copy of a storage device’s contents at a point in time. Often, when working on a storage device there are many reasons why working on the damaged media itself is not recommended, such as in a forensics case or when the physical state of the device is very fragile. This is why we take an image of every drive that comes through and subsequently will work in piecing back together the digital jigsaw puzzle of the data on the image and not on the storage device itself. Once the data has been put back together, and therefore recovered, we keep your data protected for 30 days in the event that the device on which your data is returned is faulty. After this time period (or beforehand if requested) we permanently erase your data from our system.