So your hard drive or RAID array has gone belly up, you don’t have a backup and you want your data back…NOW! But all it takes is one wrong move and your chances of data recovery will be gone. Here are some hard-learned things you should not do when trying to get your data back.
1. Haste and poor planning
When you deal with damaged data, actions that seem insignificant may lead to really bad consequences. For example, launching CHKDSK to fix filesystem structures either corrects the errors or smashes the filesystem completely instead.
If you are going to recover data yourself, you should think through all the steps from the beginning to the end before proceeding with the recovery. You should also consider every step for possible negative effects and what you will do if a planned action fails.
So power off your PC or NAS or pull the memory card out of your digital camera and think! Data from a device that is powered off can’t disappear while you are thinking.
2. Opening a hard drive
Some people think that if they remove the cover from a disk, it will be clear what’s wrong and how to fix it. Actually, a modern hard drive consists of very small and precision-fitted components. Home dust can destroy a hard disk just by getting inside. To repair it yourself, you would need an area with very clean air (so called "clean rooms" or "hoods").
However in most cases, repairing a hard disk at home doesn’t make sense. Taking a peek at a drive’s internals adds nothing new to the diagnosis. It is skill and often special equipment that is needed for the correct diagnosis.
The idea that hard drive repair starts with removing the cover is wrong. A misconception about data recovery engineers it that they live in a "clean room", doing nothing but opening hard drives, looking at them through a microscope and fiddling with miniscule nuts and bolts. In most cases, removing the cover of the hard drive is not required at all.
3. Re-creating partition in the same place in hope it will bring data back
As most people know, if you delete a drive partition, data is not actually erased. It takes much less than a second to delete the partition, so it is not possible to erase a significant amount of data in that time.
Taking this thought further, however, some people conclude that a new partition created on the same place with the same parameters will contain the same data. In fact, it will not. If you just create a new partition at the same place on the drive, nothing bad will happen. But the data will not become accessible. However, if the operating system offers to format this newly created partition and if you agree, there will be major damage to the data (see below).
4. "You need to format the disk in drive before you can use it"
It may happen that a storage device becomes unreadable and an operating system says that the device has turned to a RAW filesystem and offers to format it. This often happens with external drives, USB sticks and other removable media. Never format format the device if you need the data off it! Both "quick" and "complete" format types will result in data loss.
During formatting, a blank copy of filesystem records is written to the disk. These records are always located on the same place of the disk. Therefore, the possibly useful remains of a previous filesystem’s records are overwritten with new ones.
If you format a storage device, your chances to recover data decrease. The damage caused by the format is not too significant for NTFS, but is really bad for FAT. Linux’ EXT filesystem is designed in such a way that re-formatting may completely overwrite all the superblocks and inode tables, leading to irreversible data loss.
5. Operator errors during a RAID rebuild in RAID 5, RAID 6, or RAID 10
RAID rebuild is a routine procedure for RAID 5 and other fault-tolerant arrays, executed when you first assemble the array and then every time you replace a disk. Rebuild is a process of computing and writing redundant data, which provides the array’s fault tolerance.
During rebuild, it is required to write one disk’s worth of data onto a RAID 5 array, two disks’ worth of data for a RAID 6 array and half the array capacity for RAID 10. This is a lot of data! If something goes wrong during the write, all the array content will be destroyed irreversibly.
Once an array fails, people often try to rebuild it with a set of parameters that “look familiar” to try and read the data. If only one of the parameters like disk order or block size is wrong, all the data will be damaged during the rebuild.
6. Saving the recovered data onto the same disk from which it is being recovered
When data recovery software finds files and folders on a damaged disk and displays them for you, the content of these files still occupy blocks on the damaged disk. A filesystem driver, however, often considers these blocks as free because of the filesystem damage, or because the file is deleted and the disk space is marked free for reuse. Therefore, if you copy the recovered data onto the same disk, you risk losing the original data before it is copied out. Always copy recovered data to a new device.
7. Failing to provide information that could be crucial to the recovery
Frequently, people asking for help in data recovery do not provide crucial information relating to the case. There are even cases where a customer opened a hard drive, but later does not mention it to a data recovery specialist. The truth eventually comes out—fingerprints on drive platters speak for themselves.
Along with every piece of information you provide to a data recovery service or to tech support of data recovery software, you should also specify how accurate you think this the information is. Data recovery customers confuse all sorts of things (except, perhaps, their own names): array types (RAID 1 instead of RAID 0), controller models (4805 instead of 5805), number of disks in the array (three or four?), whether CHKDSK was launched or not, what files should the disk be searched for, etc. The more accurate the information you provide, the better your chances of a successful recovery.
Elena Pakhomova does both marketing and development for data recovery software company ReclaiMe.com.
Series links: Part 1