Data Recovery: Engineers vs. Software, Part 2

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More .

Missed Part 1? Click here.

The Value of Experience
Understanding Data Organization
The Goals of Quality Data Recovery
References:
RELATED NEWS AND ANALYSIS

The Value of Experience

Professional data recovery companies are experienced at providing quality recoveries. In many cases, the recovery is not a straightforward process due to damage to the file system (either through data corruption or physical storage media failure). Using complex calculations, the engineer will begin determining the start of the data volume and then build structures pointing to the user data files. Additionally, a data recovery engineer can visually identify unusual corruption and correct it to complete the recovery process. In contrast, do-it-yourself recovery software would ‘brute-force’ a recovery despite corruption.

An example of the advantage of the human engineering process is where the user may have been using a third party partitioning application to move existing volumes and the software crashed leaving all of the data in an incomplete state—half of the data had been moved to the new partition, the other half left in its original location. An experienced engineer would notice the severe corruption to the file system and would work to recover both sets of file data.

In the case of multi-drive storage arrays or RAIDs (redundant array of independent disks), senior engineers are the preferred choice for accurate data recoveries. These complex recoveries require an expert understanding of how a RAID controller card distributes data and a thorough knowledge of how file systems organize file data. The recoveries of large storage arrays are successful because engineers work to piece these large ‘jig-saw’ puzzles of data together by hand; even when there is damage or corruption.

In one case, the RAID configuration of a large storage array composed of 32 hard drives was lost. The IT department had a power loss and the RAID controller could no longer identify the logical array. The IT department had tried working with the OEM manufacturer to get the 1.3 Terabyte array back online but without any success. The administrators of the storage volume were at an impasse—the array could not be restored and any further configurations would potentially damage whatever data was left on the volume. Without any backup of a volume of this size, the only choice was to engage a professional data recovery company.

When the drive cabinets arrived, engineers started work immediately to isolate the fibre channel drives. While the client had maintained that it was a single array, it was discovered that there were four separate arrays being presented to the storage management software. The software, in turn, then striped these 4 separate arrays together into a different configuration—the data was literally scattered throughout all of the hard drives. After working around the clock, the complete array was reassembled by hand and data was copied out. This was a 100% recovery—there were over a million files on the volume and they were all intact. This array could only have been completed by experienced engineers; automated recovery software could not have produced a successful recovery.

Understanding Data Organization

The way computers store data on media is different for every operating system. Whether the media is tape, CD-ROM, DVD, or hard disk, there is a unique data organization method for each media type.

All computer hard disk file systems can be categorized under two types of methods: Linked Allocation or Indexed Allocation. There are many file systems that have been designed over the years and only a handful are used in mainstream computing. Here are some examples of the two file system categories:

Linked Allocation	Indexed Allocation
FAT 12, 16, 32	Windows NTFS
Traditional Netware	Netware NSS
CP/M	Linux EXT2 and EXT3
	Rieser3 and 4
	MAC OS Standard, Extended
	MAC OS Extended (Case Sensitive)

Understanding the details of these various methods of storing data is what an experienced engineer brings to each job. Whether the file system is enterprise-level handling millions of files or something as simple as a floppy diskette, using the File Allocation Table (FAT) file system, experienced recovery engineers understand the principles of data storage and organization.

For instance, in the FAT file system, there are many structures that define a volume and point to data. If just one byte changes on any of these definitions, the data will not be accessible. The directory system is another clearly defined structure that holds the names of folders and files. If this area is damaged ever so slightly, the names will not correspond to the data. Other file systems, such as Linux (EXT, XFS, JFS), Netware (Traditional, NSS), and Windows (NTFS), are unique in how data is organized through out the storage media.

The expertise required for data recovery is more than just running automated software. In your IT organization, it may not be possible to staff engineers with the background needed to provide quality recoveries. This is when employing a reputable data recovery service is crucial.

The Goals of Quality Data Recovery

The two disciplines of data recovery are engineers who specialize in electro-mechanics and work in a cleanroom, and engineers who work in the lab and specialize in file system structure repair. Top recovery providers hold these two disciplines separate and develop the engineers to become experts in their fields. This approach has allowed the engineering staff to concentrate fully on challenging recoveries. Data recovery is a science. Quality recoveries come by thorough investigation and observation, developing recovering strategies, testing those strategies, and verifying the data.

Automated software utilities have their place in providing solutions for simple data loss situations. When using these utilities, the files should always be tested before releasing the user’s data. If the quality of the recovered data is not usable, then turning to a professional data recovery service with experience would be in the best interest of the user or client. After all, what are the goals of true data recovery? To get back the original file data.

References:

Microsoft Scandisk for the Win 9.x/ME operating system – Link

Microsoft CHKDSK for the Windows XP operating systems – Link

Novell Netware VREPAIR – Link

Novell Netware NSS rebuild – Link

Unix-Sun; FSCK usage – Link

Unix-IBM AIX FSCK usage – Link

Linux SuSE FSCK usage – Link

Linux RedHat FSCK usage – Link

Apple Mac Disk First Aid – Link 1, Link 2

About the Author: Sean Barry is the remote data recovery manager for North America at Ontrack Data Recovery. He joined Ontrack Data Recovery, a subsidiary of Kroll, in 1997.