Skip to content

Data recovery

Data recovery is the process of restoring data that has become inaccessible because it was deleted, the file system or partition table was damaged, or the storage media itself is failing. It spans the whole spectrum from undeleting a file on a healthy hard drive to extracting readable data from physically damaged platters, including lost partitions, broken RAID arrays, virtual disk files, and (attempts at) overwritten sectors.

The term "data recovery" is frequently used to mean forensic recovery, but it really should be reserved for recovering data from damaged media, while the recovery of deleted or logically corrupted data from healthy media is a forensic activity.

More fundamentally, data recovery is a process of inference rather than a direct reading of the media: the investigator reconstructs what once existed from incomplete evidence - partially overwritten directory entries, remnants of file headers, sectors that still hold older data. Every recovered artifact is therefore a hypothesis, whose reliability grows the more independent observed evidence corroborates it.

Deleted file recovery

Recovering files whose pointers were removed at deletion - the directory entry, the FAT chain, or the NTFS MFT record - but whose data sectors remain, a process known as undelete. It is most reliable on FAT, and far less so on NTFS, where fragmented files are generally beyond undelete.

See also Recovering deleted data.

Partition recovery

Recovering a disk whose partition table, Master Boot Record, or boot code has been damaged by faulty software, certain viruses, or human error. Recovery may be as simple as restoring the partition table from an intact copy, or may require guessing the table from remnants of the file systems.

See also Partition Recovery tools.

Recovery from damaged media

Recovering data from drives that are malfunctioning - bad sectors, damaged firmware, failed read heads, or physically damaged platters - using software approaches that bypass the drive's own limitations, or hardware approaches (controller tools, spare parts, cleanroom work).

See also Recovering bad data and Linux File Recovery.

Recovery of overwritten data

Whether data can be recovered after it has been overwritten - multiple passes of random data, or a single pass of zeros - has been debated for decades, and published results remain thin.

See also Recovering overwritten data, Remnant data and Residual data.

File carving

Recovering files based on their content rather than on file system metadata; the file carving article covers the definition, the taxonomy of carving techniques, and recovery of fragmented files (such as SmartCarving and GuidedCarving) as well as zero storage carving.

See also the File Carving Bibliography and File Carving Tools.

RAID and virtual disk recovery

Recovering data from RAID arrays that have failed (reconstructing the layout from the member disks) and from virtual disk file formats - VDI, VHD, VMDK, QCOW - of virtual machines, which themselves may be damaged or contain deleted files.

Recovery of structured data

Recovering records from structured stores - databases, mail stores, office documents - which are often damaged or only partially recoverable even when the whole file is intact.

Media-specific recovery

Recovery tailored to particular media types: damaged or dirty SIM cards, memory cards (photo recovery from CF/SD/Smart Media/XD cards), and optical media (CD/DVD/Blu-ray).

See also Damaged SIM Card Data Recovery.

See also

Stories of data recovery