Data Recovery: Engineers vs. Software, Part 2

No luck with recovery software? Guest author Sean Barry of OnTrack Recovery illustrates how obstinate drives and data loss in complex storage environments can use the human touch.
(Page 1 of 2)

Missed Part 1? Click here.

The Value of Experience

Professional data recovery companies are experienced at providing quality recoveries. In many cases, the recovery is not a straightforward process due to damage to the file system (either through data corruption or physical storage media failure). Using complex calculations, the engineer will begin determining the start of the data volume and then build structures pointing to the user data files. Additionally, a data recovery engineer can visually identify unusual corruption and correct it to complete the recovery process. In contrast, do-it-yourself recovery software would ‘brute-force’ a recovery despite corruption.

An example of the advantage of the human engineering process is where the user may have been using a third party partitioning application to move existing volumes and the software crashed leaving all of the data in an incomplete state—half of the data had been moved to the new partition, the other half left in its original location. An experienced engineer would notice the severe corruption to the file system and would work to recover both sets of file data.

In the case of multi-drive storage arrays or RAIDs (redundant array of independent disks), senior engineers are the preferred choice for accurate data recoveries. These complex recoveries require an expert understanding of how a RAID controller card distributes data and a thorough knowledge of how file systems organize file data. The recoveries of large storage arrays are successful because engineers work to piece these large ‘jig-saw’ puzzles of data together by hand; even when there is damage or corruption.

In one case, the RAID configuration of a large storage array composed of 32 hard drives was lost. The IT department had a power loss and the RAID controller could no longer identify the logical array. The IT department had tried working with the OEM manufacturer to get the 1.3 Terabyte array back online but without any success. The administrators of the storage volume were at an impasse—the array could not be restored and any further configurations would potentially damage whatever data was left on the volume. Without any backup of a volume of this size, the only choice was to engage a professional data recovery company.

When the drive cabinets arrived, engineers started work immediately to isolate the fibre channel drives. While the client had maintained that it was a single array, it was discovered that there were four separate arrays being presented to the storage management software. The software, in turn, then striped these 4 separate arrays together into a different configuration—the data was literally scattered throughout all of the hard drives. After working around the clock, the complete array was reassembled by hand and data was copied out. This was a 100% recovery—there were over a million files on the volume and they were all intact. This array could only have been completed by experienced engineers; automated recovery software could not have produced a successful recovery.

Understanding Data Organization

The way computers store data on media is different for every operating system. Whether the media is tape, CD-ROM, DVD, or hard disk, there is a unique data organization method for each media type.

All computer hard disk file systems can be categorized under two types of methods: Linked Allocation or Indexed Allocation. There are many file systems that have been designed over the years and only a handful are used in mainstream computing. Here are some examples of the two file system categories:

Linked Allocation
Indexed Allocation
  • FAT 12, 16, 32
  • Windows NTFS
  • Traditional Netware
  • Netware NSS
  • CP/M
  • Linux EXT2 and EXT3
  • Rieser3 and 4
  • MAC OS Standard, Extended
  • MAC OS Extended (Case Sensitive)

  • Page 1 of 2

    1 2
    Next Page

    Comment and Contribute


    (Maximum characters: 1200). You have characters left.