Data recovery involves various methods of reading data using non-standard means and methods. Depending on the case, it may involve modifying hardware function to extract data from failed storage devices or reading and analysis of data outside of the normal file system. Some people use this expression to refer to retrieving data stored in a backup. However, that is better termed as “data retrieval” rather than “data recovery” since it was never actually lost.
What is Logical Data Recovery
When data loss is caused, not by hardware failure, but by simple corruption, deletion, sabotage, etc. it is referred to as logical data recovery. When a failure involves failed hardware it is usually considered a hardware level recovery case rather than a logical one. However, even in the case of hardware recovery, logical recovery may still be necessary after hardware recovery is complete.
What is a Filesystem or File System
A filesystem is a system of structures stored on a logical drive which is used to control how and where files are stored by an operating system. It includes a table or directory of what logical sectors (LBAs) individual files are stored in, as well as folder structures, indexing, and sector mapping. It’s basically how the operating system keeps track of all the data on the drive. An easy analogy is to think of it like a phonebook used to look up where files are really saved at.
What is File Carving or Raw Recovery
File carving involves scanning the raw data of a drive searching for opening signatures, code unique to the beginning of a specific file type, then using either a closing signature or opening signature of the next file to approximate the end of each file.
The preferred method of data recovery is to analyze the original filesystem and determine where lost files were stored. However, if too much of the filesystem is lost, then file carving / RAW recovery may be the only option. The disadvantage of file carving is that original file names and folder structure will be lost. Also, not all file types have identifiable opening signatures.
What is a HDD or Hard Disk Drive
A hard disk drive, hard drive, or HDD generally refers to a data storage device that uses a spinning platter (disk) which has a substrate coating allowing the retention of magnetic signals to be stored. HDDs have a head stack assembly which contains individual read/write heads which can both read and write magnetic charges to the platter coating.
In modern times, hard drives come in both 3.5″ and 2.5″ form factor varieties and have either glass or aluminum platters.
What is an SSD or Solid State Drive
An SSD or solid state drive is a data storage device intended to replace the function of a HDD which uses solid state components rather than a mechanical spinning platter. Typically these use NAND flash memory; however, there are some newer varieties which use 3D XPoint memory.
Why is a Clean Room Needed for Data Recovery
Hard drives are extremely sensitive to dust or other contamination and should only ever be opened within an environment that has been HEPA filtered. If internal components of an HDD such as read/write heads have failed, a clean environment is necessary during the replacement procedure.
Very often, data recovery isn’t actually performed in a clean “room”, but rather in a clean hood which many argue is actually better. Clean hoods are generally able to meet a higher cleanliness standard than walk in clean rooms which may be more easily contaminated by their human occupants.
For many types of data recovery, a clean room isn’t necessary. Data recovery which only involves firmware repair, PCB repair or replacement, or logical recovery does not require a clean room at all.