Data recovery

This resource is intended to be sort of a guideline what to do in order to rescue the data in case of operating system failure, accidental deletion, or file system corruption. The main focus will be on the Microsoft Windows, but applicable to the other operating systems as well.

Before anything happens

There are quite a few things you can do to ensure the relative safety of your data before anything even happens.

Backup

Main resource: Backup

This is the number one rule! You are writing a thesis? A computer program? Creating resources offline for Wikiversity? In all of these cases you are dealing with small and portable files, but you put a lot of your time into them.

Data loss can have a multitude of causes, such as hardware failure of a data storage device, power outage during write access, software bugs, poor software design, malware, or even human error such as deleting the wrong directory, or formatting or writing a disk image to the wrong drive or partition.

At the end of each day you should backup these to a USB flash drive, memory card, or to your email inbox or Cloud storage in case you have access to the Internet. For larger files use external hard disk or a bigger USB flash drive. If the available space for backup is limited, consider data compression (i.e. to zip, rar, or 7z). Compression algorithms are particularly efficient on files with human-readable content.

If you use a flash drive on the go with data and tools you need regularly, mirror it to a hard drive at home regularly. You may also occasionally (e.g. monthly) check flash storages' data integrity by benchmarking its sequential read transfer rate from into a line graph, where downspikes may indicate error correction attempts by its memory controller, while a stable and constant speed signifies good storage health. Make sure your software benchmarks the whole space from beginning to end, not only few samples ("quick benchmark"), as results of whole benchmarks are more telling.

Support for some file formats for both user data and backups, such as Acronis backup .tib, may be limited on different systems, or only readable through paid software. Such proprietary file formats restrict data portability through vendor lock-in and thus should only be used with caution.

Those currently lacking space storage may wish to create an image of the beginning (around 100 MB) of a data storage and/or partition, which contains crucial file system information. In case of file system corruption, an earlier state of the file system can be reinstated by applying back the image. The simplest way to create such a minimal image using existing software is to cancel the creation of a full disk image after few seconds.

Verify the backup

If you are about to delete files you think are already copied somewhere else, verify the copy.

Misconfigured file permissions might have prevented the files from being transfered in first place.

Create a file list

If you currently lack the storage to back up large amounts of data, a recursive file list should be created. Such a list has a marginial file size compared to a disk, making it very portable.

A list of files and the directory structure among file size information and date/time attributes can facilitate the guesswork that would be necessary to recover data after a file system corruption, as well as prevent loss of date/time information when not stored in files' internal metadata such as EXIF

Such a file list can be created using these example commands:

• Windows: dir /s %userprofile% >>filelist.txt – Creates a recursive file list of your user directory with sizes and last modified time stamps of minutely accuracy by default. The /T:C, /T:A, and /T:W options allow specifically showing the creation, last access, and last modification times respectively. >> redirects the output to a specified file. Only one > should only be used with caution, as it clobbers (overwrites) any existing file with the given name rather than appending to it.
• Linux:
  • ls -alR ~ >>filelist.txt produces a similar output. ~ is the user's home directory variable. Any other path may be used.
  • find ~ >>filelist.txt produces a plain recursive list with full paths and file names, and can be used to back up the directory structure. find with no arguments outputs paths relative to the current working directory, and the -type d makes it only output folder names, no file names.
  • stat * produces a detailed list of entries in the current working directory, with all time attribute types in full accuracy. However, the command lacks support for recursion, which means it can not scan through subfolders automatically.
• The cross-platform tree command produces an eye-candy text-based tree-style representation of the directory naming structure, optionally with file names.
  • On Windows, the /F option includes files, rather than only folders, and /A outputs only basic ASCII characters to represent the lines of the tree.

Check for damage

Tools such as badblocks for Linux and HDD Scan for Windows allow scanning an entire disk for unreadable sectors.

For hard disk drives, an analysis using so-called S.M.A.R.T. (self-monitoring analysis and reporting tool) approximates the health by diagnosing disk parameters such as the number of spin-ups and hours in operation.

As this is just a rough approximation, a drive that appears healthy should still be backed up.

Optical media is not tied to a specific storage controller and is more predictable, as software such as QPx Tool and Nero DiscSpeed are able to scan the media and count the correctable errors, represented in a graph.

Minor errors are correctable to some extent, but a too high density of minor errors might render sectors of data uncorrectable.

Divide your HDD?

Dividing your hard drive into 2 partitions, one for backup and one for the operating system was a cheap way to help protect your data if your operating system becomes corrupt. The problem is though, if your hard drive crashes you can still lose everything. But now that prices have dropped on hard drives, backing up all important data on an external hard drive is the obvious, easy solution. Furthermore, even if your operating system becomes corrupt, there are ways to recover your data.

Use the Recycle bin

Enable the "Recycle bin" in Windows to save files before final deletion. This may take a little more time, but you can easily bring them back if you change your mind, or in case of accidental deletions.

Trustable data storage

Data storages from questionable and unreputable brands should be avoided, as they might be of low quality, not retain data well, and even overreport their capacity to the computer, leading to data loss upon writing to sectors that physically do no exist.

Storage with fraudulent capacity can be detected using tools such as f3probe for Linux and h2testW for Windows.

Online forms

For online forms, using a form recovery browser extension (or add-on) such as Textarea Cache should be considered, which automatically backs up online forms against potential losses and browser crashes.

If a form submission failed and the content is lost, it might still be recoverable by performing a text string search through a RAM dump generated using the task manager (in Windows) or GCore in Linux. In Linux, the precluded grep tool is able to perform regular expression searches.

Develop the habit of copying larger text posts into your clipboard before hitting Send (or similar), or even save it locally to a text file into a dump folder. As a rule of thumb, do it for any text addition of more than 1000 characters, and/or anything that took over five minutes to write.

I have a problem...

Sooner or later you might face a situation, that your computer goes down and you are not able to access your data. Depends on the circumstances there are several possibilities to make things right, or at least rescue what could be rescued. Some of the scenarios are listed below.

Recovering data after physical damage

If your hard disk drive (HDD) was physically damaged or exposed to a magnetic field, then often your only choice is to send it to a recovery lab if need be. Such labs have clean rooms where they can open the case, remove the platter(s) and then try to recover what they can. Expect such services to cost far beyond the price of any new computer system, with no guarantee of success.

Data Recovery on Wikipedia

Accidental deletion or format

For this section we start with some background information:
If you delete something in Windows or format a hard disk with the "quick" format (the one which takes a few seconds) your data are not completely gone. The operating system just lets some other data to be written on the same place. In fact this replacement causes the final data loss.

Quick formatting overwrites the previous file system, but file contents themselves still exist as orphaned file fragments on the disk. Those need to be puzzled together.

So if you deleted something, but it is not rewritten yet, you can get these "lost" data back with help of special data recovery programs. You will have to search the web for these. In general you have better chance to retrieve smaller files compared to big ones. This is because if only a part of a big file is rewritten with something else it may cause the loss of the whole file.

If you are trying to rescue data from a formatted operating system partition (C:\ drive in Windows), it is not the best sollution to install the operating system and then try to rescue (undelete) files with a program. This is because during the installation procedure you can rewrite the data you want to rescue. If you have the possibility, better connect the HDD to another computer and do the recovery process from there. If you wish to do continue using the source hard drive, first create a full disk image on a different hard drive. The disk image file is as large as the source disk itself, and contains all data that would have been recoverable. Data recovery software usually allows scanning disk image files.

Sidenote: Although this resource is about data rescue rather than data destruction, please note that there are programs for secure data erease. These rewrite (usually some sensitive or confidental) data with random bits of information, so they can't be recovered afterwards.

These methods do not work with smartphones' internal memory, as files on it are only accessed through the abstraction layer of the media transfer protocol (MTP).

Note that on solid state drives, an accidental deletion or formatting might have triggered a TRIM command, which would make existing data inaccessible to the computer, as the flash memory controller makes them appear empty to facilitate the internal so-called garbage collection process.

System failure (best case)

Your Windows system went down. First thing you should check if you can restore it with a few moves. When restarting your PC press F8 (at least for Windows XP). There you can try to start "Last good configuration". If this doesn't work, try to boot up the "Safe mode" and correct the potential error there whatever it is. You can use the safe mode to rescue your data as well.

If you have successfully entered safe mode, copy or move any data you do not wish to lose onto an intact external storage device immediately.

System failure (still good)

Your Windows system went down. You can't restore it via "Last good configuration" nor "Safe mode". Next thing what you can try is reinstall the corrupt or missing system files via a Windows installation CD.

For this insert the CD and restart your computer. Bring up the boot menu (usually F11 or F12) and boot it up. Select the "Repair" option and follow the steps there. Please note, that for this procedure you will most probably need the "administrator password" that you set, when you installed Windows last time.

System failure (bad, but not hopeless)

Your Windows system went down. You can't restore it via "Last good configuration" nor "Safe mode". The "Repair" procedure failed. You know, that you will have to reinstall the operating system, but you still have important data on the C drive. Remember: All files on the Windows desktop are on the C drive!

Before reinstalling the whole system and the eventual danger of rewriting important files (as mentioned earlier) you can use some Linux distributions to access your data. These are called "Live" versions, which means that you don't have to install them to your machine, but you can run them from a CD/DVD/USB directly. These are available for free, so you can just download and burn them. You can pick any Live distribution you want.
The original author of this resource suggests SLAX, because it is small and very user friendly even for the non-experienced Linux users. (In fact the initial version of this resource was written on a crashed Windows machine with SLAX's KWrite. Thank you guys for this, whoever you are!)

Re-installation procedure

If you still have some data on the C drive you want, you can try to reinstall Windows without formatting the hard disk. In this case the Windows installation overwrites or renames the previous version, so the rest of the HDD could be saved.

However, for the duration of the installation, it is still recommended to have a backup of the partition. On some setups, the operating system partition is smaller than the secondary partition, which saves time on the backup.

To the end

On this page you can find some, but surely not every possibility for data rescue or good practice in order to keep your files as safe as possible. If you know about some other way, tell us!

See also

Search for Data recovery on Wikipedia.

• System administration#Data recovery
• Wikipedia:Data recovery#Further reading

External links

• Wikipedia: List of data recovery software