Logical Data Recovery Methods
A Backup Article Contributed by Andrew Whitehead
Data Recovery the Logical Way
Logical data recovery is rebuilding files that have been damaged or corrupted by user error or virus attack, rather than repairing hard drives that have been physically damaged. In this situation the BIOS still recognizes the drive, but returns a read error when trying to access data.
Data Recovery from Drives with Bad Sectors
If at all possible you need to make an image of your drive. You can do this yourself with a commercial disk utilities, or you can give it to a data recovery service company. If the drive is making unusual noises you should not try to make the image yourself, as this could physically damage the drive.
Imaging a drive is not an easy process. You willneed some commercial imaging software installed on a separate computer that has enough space on its hard drive to store the entire image of the bad drive. The time it takes to create the image primarily depends on the number of bad sectors on the drive. It ranges from 30 minutes to several days, and the computer cannot be used for anything else during this time.
An alternative way is to attach an external USB drive to the faulty computer as a second slave hard drive. If you decide to do this, it is better to use the IDE ports on the motherboard rather than on an additional PCI card, as the motherboard ports have better error handling - a very important feature when you are attempting data recovery. When you have made an image, you can run one of several commercial logical data recovery software packages. These are frequently part of the imaging software.
Data Recovery from Fragmentation
Accidental file deletion, formatting, or partition deletion can result in a missing File Allocation Table entry. If the file size is smaller than the cluster size (clusters are commonly 32 KB, but it varies with drive size) you should get a 100% recovered file as you do not actually need the FAT entry.
Larger files are usually allocated in consecutive clusters, and most data recovery software assumes this when it rebuilds files without a FAT entry. This will work for most types of files, but runs into problems with files that grow over time. Files like this are invariably fragmented, allocating consecutively is impossible due to other files taking the intermediate clusters. There are some important files that fall into this category, such as Databases, Email files, large text documents, and directories.
Heavily fragmented files are unrecoverable, even though their content is still somewhere on the drive.
Data Recovery is Not Feasible after Overwriting
When a file's allocation has been overwritten by another file, data recovery is practically impossible. It is theoretically possible to use highly advanced technology such as MFM (Magnetic Force Microscope), to read the rest magnetization, but it is extremely expensive and not very reliable. If a file has been overwritten more than once, even this level of technology cannot help. File 'shredder' software relies on this to delete files beyond recovery, by simple overwriting the deleted file several times.
