Data recovery - step by step process
So what is the process of data recovery?
A bit like recreating a loaf of bread from a kilogram of breadcrumbs. When we received the disk drive from the US space shuttle Columbia (the American space shuttle, which tragically disintegrated while returning to Earth's atmosphere 1 February 2003) it was nothing like the device that we know from our PCs.
The disk partially burned in the atmosphere, then fell from a great height into a lake, where it was rescued after half a year! It was an unimaginable success that we managed to recover 99% of the data stored on it before the crash. So, how does the data recovery process work?
Evaluation
When it comes to a data loss and recovery the important first step is a correct diagnosis - you cannot properly initiate the data recovery process without knowing the reason for the data loss. This helps in determining whether there was a physical damage to the disk or logical error during the reading.
- Physical damage (hardware level) can be a scratch, smash, fire damage or liquid damage. In such cases, the most common element of the disk that gets damaged are the read/write heads, internal and external drive electronics, motor bearing or platters themselves. The recovery process in those cases has to be undertaken by a specialist the using latest technology in laboratory conditions, namely a clean room.
- Logical damage (software level) is caused by the fault of the integrity of the logical structure of the data. It is not caused by damage to the actual media. Sometimes in those cases standard software programmes can be used, but often the problem is so complicated that specialist help from a data recovery lab is required.
Clean room
A clean room is the main department of every company providing professional data recovery services. It is a professional workshop, consisting of specialised hardware and software equipment. Other items of great importance are more ordinary, such as like tables, chairs, shelves, special containers, tools, and even the floor covered with a suitable material.
Fully equipped clean rooms have a stereoscopic microscope, soldering station and a clean room bench. Stereo microscopes help the engineers to work on smaller and smaller hard drive components as well as on other storage media. Every time data loss is caused by physical damage the data recovery engineer must work on the internal parts of the hard drive.
During such advanced recoveries, it is necessary to ensure that the highest level of air quality is maintained. The standard environment for working on opened hard drives is classified as a 'Class 100' in terms of the air quality.
ESD Protected Equipment
ESD protection is another key element that has to be taken under consideration in order to achieve the highest level of efficiency and safety. This is because an uncontrolled electrical discharge can cause damage to the electronic components within a computer system, including the electronic parts of a hard drive. In order to avoid this, ESD-protected equipment and dielectric materials are used, which include specialist workbenches, storage bins, hand tools and anti-static aprons.
Data Recovery
Different types of media failures (physical or logical) require different recovery approaches.
Logical damageWhen a logical damage occurs, specialised software is required. This software reads the content of the drive and repairs the structural errors which lead to the data loss. Reasons for logical data loss:
| Physical damageIn case of physical damage, the situation is much more complicated. Recovering data from failed drives must be performed in a sterile environment. Drives can then safely be disassembled, tested and fixed. Failed components must be replaced with matching and fully working spare elements from a donor drive. Donor drives sometimes need to be matched by type, model, and production date. Physical damage to the platters forces the engineer to focus the recovery efforts on the undamaged parts of the platter. Such recovery usually uses up more than one set of donor drives and might extend the recovery time. After the physical recovery process is complete it is usually necessary to fix the logical structures as well. This process can be seen as similar to that of putting together a jigsaw puzzle (actually a more difficult process, given that the pieces in no way resemble the whole data set that we want to recreate). Perhaps a more accurate comparison would be putting together a jigsaw puzzle that has been chewed up by a dog! |
Data Preparation
After all the data recovery processes are complete, the data needs to be prepared before being shipped back to the customer. The files are copied then to a new external hard drive and encrypted for extra security. The very last stage of the process is the client approval of the recovery results. The client can then decide if the recovery turned out to be a success or a failure.
Conclusion
We have reached the end of our tour into the world of data recovery. I wish you that your data is always safe. I hope that the knowledge that I was trying to share in this course will be useful and read-worthy.
