Even if you mistakenly delete a file, it still exists on the hard disk. This is termed as data remanence. The file names are usually only removed from the system directory or shifted to a holding area for safe keeping (even if said area hasn’t been specified in advance by the user). One biggest causes of data loss is logical damage. It is primarily caused by power outages that prevent files from being completely written to the storage medium. Problems with hardware like RAID controllers and system crashes usually cause the same but the result is the same. The file system is left in an inconsistent state. This can lead to more problems such as drives reporting negative amounts of free space, system crashes and actual lost data.
Logical damage can be prevented through the use of journaling file systems like NTFS 5.0. It decreases the incidence of logical damage by rolling back to a consistent state. Only the data present in the drive’s cache at the time of system failure will be lost. That being said, two common techniques for recovering data from logical damage include:
1. Consistency checking – Scans the logical structure of the disk and makes sure it is consistent with its specifications. A file repair system repair program reads each directory and makes sure these entries exist and point to the correct directories.
2. Data carving – Allows for data with no file system allocation to be extracted by identifying sectors and clusters belonging to the file. Usually searches through raw sectors looking for specific file signatures.
It should be mentioned that data recovery cannot be done on a running system. A boot disk, Live USB, etc. containing a minimal operating system and a set of repair tools is usually required. One of these is Nero BackItUp Image Tool which restores the image created by the application to roll back the system to a consistent state. A good consistency checker is Checkdisk (CHKDSK, for short). It runs on DOS, OS/2 and Windows OS systems, displaying file system integrity status of disk drives. It can fix logical file system errors and can also check the disk surface for physical errors or bad sectors. CHKDSK can be run from the Windows Shell, the Windows Command Prompt or the Windows Recovery Console. Some general tips for recovering data: Don’t delete files instantly. Move them to a temporary location such as the recycle bin before deciding whether you need them or not.
Mark important files as read-only. The OS will then warn you if you try to delete the file. Under systems that allow file system permissions, users can often only delete their own files. This prevents the erasure of critical system files or other’s work.