Data Recovery

Techniques
By

Danny Seltzer
and
Evan Hollander
NOT a Data Recovery Technique
 What is Data Loss?

 Data has accidentally been erased or data control

structures have been overwritten.

 Data has been corrupted or made inaccessible.

 Data is unable to be accessed from a previous

functioning computer system or backup.
 Common Computer Problems

 Computer won’t boot up

 Applications that are unable to run or load data
 Hard drive crashes
 Corrupt files or data
 Accidental reformatting of partitions
 Inaccessible drives and partitions
 Media surface contamination and damage
 What Causes Data Loss?
 Sabotage
 Natural Disaster
 Hardware Error
 Virus Attack
 Human Error
 Intentional deletion
 Accidental overwriting of files

 Software Corruption
What Causes Data Loss?
 How to Prevent Data Loss

 Don’t upgrade hardware or software without having a

backup

 Physically secure your system from intruders

 Use firewalls and virus protection

 Be prepared for physical disasters

 Things to Know About Data Loss
 Data loss is disastrous at home, but for companies it causes
setbacks in time and money.
 “93% of companies that experience data loss for more than
10 days file for bankruptcy within one year of the disaster.”
 If the data loss recovery is dealt with quickly or the
necessary precautions are taken prior to any problem, the
company could retrieve the data more easily or not
experience a problem at all.
 Data Recovery
 The majority of data loss situations are recoverable.

 Computer storage systems may fail, but the data stored on

them is not always completely lost.

 There are occasions when damage to data is permanent

and complete data recovery is not possible. However, some
data is usually always recoverable.

 Data recovery professionals can recover data from crashed

hard drives, operating systems, storage devices, servers,
desktops, and laptops using various proprietary data
recovery tools and techniques.
 Data Recovery Tips
 DO’s  DON’TS
 Backup your data frequently.  Do not ever assume that data
 If you believe there is recovery is impossible; even in
something wrong with your the worst cases, such as natural
computer shut it down, do not disasters data recovery specialists
have been able to retrieve
continue to power up because valuable data.
you may do more damage.
 Never remove the cover from the
 If you here a clunk, clunk hard drive; this will only cause
sound when you power up the further damage.
drive, shut down! Do not panic  Do not rest your computer on a
nor turn the power button on moveable object or piece of
and off. furniture. Shock and vibration
 Package the drive properly can result in serious damage to
when you send it in to a data the hard drive.
recovery specialist. You can  Do not subject the drive to
cause additional damage to the extreme temperatures changes
hard drive if it is poorly both hot and cold.
packaged.  In the case where a drive has
been exposed to water, fire or
even smoke do not try to power
up.
 Data Recovery Techniques

 Use of software to recover data

 Use of machines to recover data

 Software Data Extraction
 Data extraction is the process of moving data off of
the imaged drive to another destination location.

 Data extraction software scans sectors of the hard drive

and restructures the file system either in memory or
another hard drive.

 The software can be used to copy the recoverable data

to a destination location.
 Software Recovery
 Data loss can occur because the hard drive may have
problems accessing the data it contains at a software or
logical level.

 By making a complete sector copy (an exact copy including

all deleted information) of the hard drive, using a program
such as Norton GHOST, most data recovery programs
search for deleted MFT (Master File Table) entries to
undelete files.

 If the MFT is corrupt or defective, this method will not

work. Some data recovery programs will ignore the MFT
and search all of the unallocated clusters to try to find and
recover files.
 Data Recovery
 The user may send a failed hard disk drive to a private
data recovery company that offers secure and
confidential data recovery.

 The data recovery company will carefully perform part

replacement of the heads, spindle motor and base
casting, the electronics board, etc. in a clean room
environment.

 Part replacement has historically been successful for

data recovery about 40%-60% of the time.
 Data Recovery

 When data is written to a medium, the head sets the

polarity of most, but not all of the magnetic domains.

 When a 1 is written to disk the media records a 1, and

when a 0 is written the media records a 0. However the
actual effect is closer to obtaining a 0.95 when a 0 is
overwritten with a 1, and a 1.05 when a 1 is overwritten
with a 1.
 Data Recovery
 Normal disk circuitry is set up so that both these values
are read as ones, but using specialized circuitry it is
possible to work out what previous "layers" contained.

 The recovery of at least one or two layers of

overwritten data isn't too hard to perform by reading
the signal from the analog head electronics with a high-
quality digital sampling oscilloscope, downloading the
sampled waveform to a PC, and analyzing it in software
to recover the previously recorded signal.
 Data Recovery Techniques
Scanning Probe Microscopy (SPM)
 A technique that is used to image and measure
surfaces at the atomic level.
 Scans an atomically sharp probe over a surface
which produces a 3D topographic image of the
surface at the atomic scale.
 Data Recovery Techniques
Magnetic Force Microscopy (MFM)
 MFM (Magnetic Force Microscopy) is a new technique
which images the spatial variation of magnetic forces
on a sample surface.

 MFM is derived from scanning probe microscopy

(SPM) and uses a sharp magnetic tip attached to a
flexible cantilever for analysis.

 An image of the field at the surface is formed by

moving the tip across the surface and measuring the
force.
Magnetic Force Microscopy (MFM)
 Detectable old data will be present beside new
data on the track which is usually ignored.

 Together with software, MFM can see past

various kinds of data loss/removal.

 Each track contains an image of everything ever

written to it, but each layer gets progressively
smaller the earlier it was written.
Magnetic Force Microscopy (MFM)
 MFM looks at the minute sampling region to
detect remnant magnetization at track edges.
MFM image showing the bits of a
hard disk
 Data Recovery Techniques
Scanning Tunneling Microscopy
(STM)
 STM (Scanning Tunneling Microscopy) is a
more recent variation of MFM which uses a
probe tip typically made by plating nickel onto a
pre-patterned surface.
 The probe is scanned across the surface that is
to be analyzed. STM measures a weak electrical
current flowing between the tip and the sample.
The image is then generated in the same way as
MFM.
 Summary
 Individuals or companies may experience data loss at
any time for many reasons.
 There are various steps that should be implemented to
help prevent data loss.
 Data loss can be very costly and very upsetting.
 There are several data recovery techniques that have
proven to be successful or partially successful in
recovering data.
 Utilizing qualified professional data recovery specialists
will aid in the degree of success of data recovery.
 Bibliography
 http://www.intellirecovery.com/data/recovery.html
 http://www.data-recovery-info.com
 http://mechmat.caltech.edu/~kaushik/park/1-3-0.htm
 http://www.eng.yale.edu/reedlab/research/spm/spm.h
tml
 http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_
del.html
 http://www.ebaumsworld.com
 http://www.disklabs.com