How to recover data from a corrupt hard drive
Although all seems lost, there is a chance that data on a corrupt hard drive can be recovered.
Barely a day goes by without someone accosting me and demanding (with menaces) that I divulge everything I know about the black arts of data recovery.
To save me the hassle of explaining that, as an Aikido instructor, I can probably run much faster than they can, I will instead use this forum to share what I know about the subject.
Joking aside, data recovery is a serious and fast-growing global industry; besides the obvious emotional attachment we have with our data, it raises the age-old riddle of what monetary value we put on it.
In the past, data recovery houses have charged pretty much what they liked because people knew so little about it.
Most of us assume that once a drive dies, our data dies with it, although this is only partly true; those in the know can, with equal amounts of skill, good fortune, theatrics and jiggery-pokery, pull the virtual rabbit out of the hat and recover the seemingly unrecoverable.
To know more about data recovery, we need to know how a computer stores information at a raw level and how binary file collaboration results in sector variations of the allocation tables and subsequent cone and cylinder manipulation and fghtyuijnfdmnnnnnnnnnnnnnnn. Oops! Sorry, I nodded off there; the fact is we don't need to know that stuff to grasp how data recovery works.
We can get by knowing a few simpler facts.
Data is stored on our drives using a seemingly old-fangled system involving magnetism and a machine language called binary.
Before you crack open a cup of hemlock, binary is simply a way so- called analogue information can be digitised by using groups of zeros (0) and ones (1). For example, how2 in binary is written 01101000011011110111011100110010.
Hard drives contain one or more highly polished metallic disks called platters, over which passes a "head".
Picture an old-style record player; instead of a plastic disk we use metal and instead of a needle, an electro- magnetic head that reads and writes magnetically polarised 1s and 0s.
When data is written to the disk, the head skips very closely over the spinning disk surface, altering the magnetic state under any given area (called sectors) of the drive.
This data remains there until overwritten by other data, wiped or the platter is physically damaged - as happens when a drive develops "bad sectors", which can be likened to a terminal cancer; once affected, the drive will become increasingly unstable and develop more bad sectors until it fails completely with the loss of any data written to the affected sectors.
As you can see, drives are sensitive and fragile devices; mishandling (dropping) them or bumping them while working is courting disaster.
Drives consist of several separate- but-interconnected systems.
One is the electronically controlled brushless motor that spins the platters.
Then we have some memory (RAM) and other electronic wizardry that controls both the position of the head and when and where data is written by it. On the platters is the file system, which is the specific way data is structured on the drive.
Most file systems utilise an index at the start of the drive denoting where any given file dwells on the platters.
Finally we have a boot sector, which contains information needed for the hardware to find and load our Operating System.
When one, (or more), of these systems gets corrupted or fails, our drive "dies".
If the motor stops, or the bearings seize, the platters won't turn. If the electronics fizzle, then the platters may still spin but the head won't move properly.
If the file system or boot sector gets scrambled, the electronics don't know where anything is.
Either way, the result is that our computer won't boot and we get nasty error messages.
However, unless the platter is physically damaged, by bad sectors, a fire or by having a pickaxe driven through it, the data is still tantalisingly present and, with the right kung-fu, recovery is often possible.
The issue is that many computer "repair" people aren't up with data recovery and file this sort of thing in the "too hard" basket.
They either arbitrarily replace the drive or wipe the contents and start again, claiming recovery is impossible.
My advice, if you are very attached to the "lost" data, is do nothing with the drive and seek a second opinion, preferably from someone who advertises "data recovery" services.
Ask about methods used and go for those who sound like they know what they are doing.
Avoid running the drive as this can make things worse, and resist the temptation to "have a go" yourself; data recovery is a specialist field and the best option is to let them work their mojo. You'll find many operate a no data/no charge policy and really, by that stage what have you got to lose?
Posts
No comments:
Post a Comment