Data Recovery Concepts

What are the common causes of data loss?

• Accidental removal of files and folders and then emptying Recycle Bin (~75%)
• After physical damage of critical sectors on HDD ("bad clusters") some drives become unreadable (~6%)
• Loss of information due to a power failure or power surge (~5%)
• Deletion of logical drive/partition itself then recalling important data on it (~3%)
• Damage of MBR, Partition Table, Volume Boot Sectors by virus (~3%)
• Other (~8%) ...

In a situation where data is damaged, there are generally two reasons:

1. Original partition/drive has become invisible to Operating System (deleted or damaged or overwritten)
2. Drive is visible but important files/folders are not visible (i.e. they have been deleted or overwritten)

In the first case recovery software must analyze the surface of the physical drive for residual logical data  organization clues in order to reconstruct partition/drive parameters (clues such as the first sector number, cluster size, file system type, etc.). The user must have access to this virtual drive so that the lost data can be copied to another drive. For more information see the topics below.
 

 Partition Recovery Concepts

Q: What to do if partition is not bootable, i.e. Microsoft Windows NT/2000/XP is unable to start?

A: Choose a solution from the topics below.

• Partition/Drive Recovery
• MBR is damaged
• Partition is deleted or Partition Table is damaged
• Partition Boot Sector is damaged
• Missing or Corrupted system Files

File Recovery Concepts

Q: What to do if a file or folder was deleted from NTFS bypassing the Recycle Bin (or the Recycle Bin has been emptied after file deletion)?

A: If the Recycle Bin has been emptied, the recovery software must have full access to the existing partition or drive. The task is to scan the drive surface for the deleted file or folder entries in the Root Folder (FAT) or the Master File Table (NTFS). If such entries are found, Active@ UNERASER should display them and give the user an opportunity to save whatever is recoverable (that which has not been overwritten with other data). For more information see the topics below:

• File Recovery
• Disk Scan for deleted entries
• Defining clusters chain for the deleted entry
• Clusters chain recovery

It is assumed that you have some basic knowledge of HDD and File System organization to be able  to understand the recovery terminology and examples.