A hard drive contains a number of disks, called platters, which are coated with a magnetic substance. These platters spin at high speeds under a mechanical arm (the actuator arm) that moves backwards and forwards over the surface of each platter.
Hard disks are very complex. They have a circuit board and a number of moving parts. In terms of data recovery, the first thing that you must evaluate is whether it is a hardware problem that is stopping you from accessing your data. Common hardware problems include a faulty circuit board or problems with the actuator arm.
Hardware Problems
A faulty circuit board is characterize by a drive that does not "spin up", meaning that the platters are not turning underneath the copper wire. A faulty actuator arm or more serious mechanical error is characterized by an abnormal clicking noise or a grinding noise. The best advice in determining whether you have a hardware problem is to listen to the sound of your hard drive. If you cannot hear the platters spinning (i.e. the drive is quiet when it is turned on) or if you hear more serious noises, then you should stop using the drive immediately. To recover data from a damaged drive, you will need to send your drive to a hardware data recovery service.
Hardware data recovery can be expensive because technicians may need to disassemble your hard drive to fix the problem. This usually needs to be done in a clean room as hard drives are sealed to avoid errors caused by dust or other particles. Because hard drives are both complex and finely tuned, it takes specialized equipment to read the platters from a physically damaged drive. When sending your hard drive to a data recovery specialist, you should attempt to obtain an upfront estimate of fees (although you will rarely get one). Ask that if you send in your hard drive for quotation purposes, you will receive it back in the same condition if you choose not to use the service. Make sure you send it to a reputable company as you may only get one chance at data recovery.
Software Data Recovery
Data loss typically does not occur because of physical problems with your drive. Usually data loss occurs because the hard drive has problems accessing the data it contains at a "software" or "logical" level. Let's take a look at how a hard drive stores data and why it is possible to perform data recovery with Recover My Files.
Sectors, Clusters & File Storage
When you purchase a new hard drive it is has usually already undergone a "low level format". The purpose of a low level format is to divide all the magnetic space on the hard drive into small storage areas. These storage areas are known as sectors, however for efficiency purposes the Operating System (e.g. Windows XP) groups sectors together into clusters. A cluster is the smallest unit of storage space with which the Operating System will deal. If you save a very small file to your computer it will all fit within 1 storage cluster on the hard drive. If you save a very large file it may fill up many clusters, that is, as many clusters as it takes to hold all the content of the file.
Things get a bit more complicated by the fact that a single file does not have to reside within contiguous clusters. In fact, the Operating System may store a single file in clusters on different parts of the hard disk. This is called a fragmented file.
File Fragmentation
The problem with fragmented files is that they can slow your computer down as your hard drive needs to spend time and resources sending the actuator arm to different parts of the hard disk to read the complete file. This is why many people regularly use a defragmentation program. The amount of fragmentation in a file can also reduce your ability to recover deleted data as we will explain later in this article.
So we can now think of a hard drive as being broken down into many clusters which hold the contents of all files. A cluster that is being used to store a file is called an allocated cluster, while a cluster that is not being used to store a file is called an unallocated cluster. But how does the computer know where to look when it wants to find a specific file? Well, if you wanted to find a specific chapter in a book the best thing to do would be to go to the Table of Contents. A computer does much the same thing.
File Allocation Tables (FAT) and Master File Tables (MFT)
On older Operating Systems such as Windows 98 there is a storage area known as the Root Directory. This is the place that stores the name of a file, the location of its' starting cluster, and its' size. In order to find a file, the Operating System uses this information to get to the first cluster. It then uses a special table at the start of the disk know as the File Allocation Table or FAT to identify the remaining clusters that are used to store the file. It is important to realize that this information is stored completely separate from your file data and is part of the reason why data recovery is possible.
In newer Operating Systems the FAT and Directory Entry method have been merged and replaced by a single table known as the Master File Table or MFT. While the MFT is more complex, the principle of locating the start of a file and it's subsequent storage clusters is essentially the same.
What Happens When I Delete a File?
Let's look at what happens when you intentionally delete a file and why it may be possible to bring that file back. When you select a file and press the delete key on a Windows computer, the file is sent to the Recycle Bin. You may think of the Windows Recycle Bin as just another fancy storage folder on your hard drive. The real deletion is what happens when the Recycle Bin is emptied or the deletion bypasses the Windows Recycle Bin altogether.
 | When a file is deleted, the Operating System marks the file name in the MFT with a special character that signifies to the computer that the file has been deleted. The computer now looks at the clusters occupied by that file as being empty and therefore as available space to store a new file. What the Windows Operating System does NOT do is go out to the clusters on the hard disk where the files data is actually stored and wipe the contents of these clusters. The deleted file data is still there, but the Computer Operating System no longer knows that it exists. Permanently removing this data requires the use of a special disk wiping tool like SecureClean or WipeDrive to completely overwrite the file clusters. |
The underlying principle of data recovery is simply finding data that still exists on the hard drive but which currently can't be located by the Operating System.
The only way that your deleted MFT record or your file data itself will permanently be destroyed is if it is overwritten by other data. This means that any computer activity after the deletion has the potential to permanently erase otherwise recoverable files.
Using Data Recovery Software
We recommend that you do not install Recover My Files data recovery software on the same drive containing your lost files
If you are attempting to recover data from your hard drive, if possible connect this drive to another computer as a slave drive to reduce the risk of overwriting your deleted files when you attempt to recover them.
If you do send your hard drive to a professional data recovery service, they should not actually be working on the original hard drive. Instead, a sector copy (an exact copy including all deleted information) should be used. You may consider doing this yourself. There are a number of programs that will do this, the most common being Norton Ghost. But remember, you must make a complete sector copy of your hard drive to make sure the image includes all the deleted areas of the drive.
Note: If the clusters containing the data are corrupted or physically damaged, then recovering the data they once contained is impossible.
Data Recovery by Searching for Deleted MFT Records
Data recovery programs, like Recover My Files, also search for deleted MFT entries to undelete files. These programs usually give a give a probability of recovery rating of good, medium or poor. What they are actually doing is locating the MFT record for a deleted file and then checking the rest of the MFT records to determine if the clusters that the deleted file occupied are being used by any other file stored on the drive.
As only one file can occupy any one cluster on a hard drive, if other files are using your deleted files' storage space then it is likely that the original data has been overwritten and permanently destroyed. This recovery technique is usually relatively fast, as the recovery program simply needs to find the deleted file entries in the MFT and then go directly to that location of the hard disk to recover a file. You will see an MFT search when you execute a "Fast Search" using Recover My Files data recovery software.
However, if your MFT is corrupt, defective, or has been overwritten, this method isn't going to help you even though there are still recoverable files on your disk. Instead, a complete search of unallocated clusters must be performed.
Searching Unallocated Clusters for Deleted Files
Advanced data recovery software like Recover My Files recovery has the option to ignore the MFT (or lack thereof) and to search all unallocated clusters for recoverable files. This means that the data recovery software needs to know what different types of deleted files look like.
Luckily, most file types have a unique file header and footer. This means that if you look inside a Microsoft Word document for example, the first characters and the last characters of the file are always the same. Therefore, a data recover program can search an entire hard drive and identify files by their unique headers and footers. You will see this technique used by Recover My Files when you execute a Complete Search. Recover My Files recognizes more than 100 different file types using this technique.
Why when I Recover Files do the turn out Partially Corrupt?
Remember that a computer may use multiple clusters to store a complete file. This means that your original data may have been partially overwritten. You may still be able to retrieve some of the clusters containing the file, however this won't be helpful in most cases as programs typically need a file to be complete before it can be run. Rebuilding partially damaged files is another area of data recovery which requires specialized knowledge about the particular file types one is dealing with.
Data Recovery from a Formatted Hard Drive
When you run the format command you are simply erasing the Root Directory Entries, FAT, and MFT. There are a number of tricks that data recovery programs use to recover data after a drive format. This includes searching for deleted Directory Entries, which stored as files on the computer. If a directory entry is located, we now know the name, starting cluster location, and size of the files in that directory. You can also search the data area of a formatted drive for file headers and footers to locate individual file types.
What is the problem with File Fragmentation?
The problem with file fragmentation is that most of the data recovery techniques available must work on the assumption that all files are contiguous, that is, that they are stored in consecutive sectors (one after the other) from the beginning to the end of the file. The information to track fragmentation of a file is overwritten when the FAT or the MFT records are destroyed.
http://www.whitecanyon.com/esupport/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=158
