SHRI M.L. KAKADIYA MCA MAHILA COLLEGE SHRI M.L. KAKADIYA MCA MAHILA COLLEGE AndAnd

SHRI T.R. TANTI Msc.(IT & CA) MAHILA SHRI T.R. TANTI Msc.(IT & CA) MAHILA COLLEGECOLLEGE

By : Suresh By : Suresh HirparaHirpara

A Seminar On

Data Recovery

ContentsContents-What is Data?-What is Data?

-What is Data recovery?-What is Data recovery?

-What is Data Loss?-What is Data Loss?

-Some Common Computer Problems-Some Common Computer Problems

-What Causes Data Loss?-What Causes Data Loss?

-Data Recovery Tips-Data Recovery Tips

-Data Recovery Process and Techniques-Data Recovery Process and Techniques

-Software used for recovery-Software used for recovery

-Advantages and disadvantages-Advantages and disadvantages

-Summary-Summary

What is Data?

->Computer data is information processed or stored by a computer.

->This information may be in the form of text documents, images, audio clips, software programs, facts stored in a person's mind or other types of data.

->Computer data may be processed by the computer's CPU and is stored in files and folders on the computer's hard disk.

What is Data recovery ?

->It is the process of restoring data from damaged, failed, corrupted, or inaccessible secondary storage media when it cannot be accessed normally.

->Recovery may be required due to physical damage to the storage device or logical damage to the file system.

What is Data Loss?What is Data Loss?

->Data has accidentally been erased or data control structures have been overwritten.

->Data has been corrupted or made inaccessible.

->Data is unable to be accessed from a previous functioning computer system or backup.

Common Computer ProblemsCommon Computer Problems

-Computer won’t boot up-Computer won’t boot up-Applications that are unable to run or -Applications that are unable to run or

load dataload data-Hard drive crashes-Hard drive crashes-Corrupt files or data-Corrupt files or data-Accidental reformatting of partitions-Accidental reformatting of partitions-Inaccessible drives and partitions-Inaccessible drives and partitions

What Causes Data Loss?What Causes Data Loss?

Hardware ErrorHardware Error Virus AttackVirus Attack Software CorruptionSoftware Corruption Human ErrorHuman Error

Intentional deletionIntentional deletion Accidental overwriting of filesAccidental overwriting of files

Natural DisasterNatural Disaster

What Causes Data Loss?What Causes Data Loss?

How to Prevent Data LossHow to Prevent Data Loss

Don’t upgrade hardware or software Don’t upgrade hardware or software without having a backupwithout having a backup

Physically secure your system from Physically secure your system from intrudersintruders

Use firewalls and virus protectionUse firewalls and virus protection

Be prepared for physical disastersBe prepared for physical disasters

Possibility of Data RecoveryPossibility of Data Recovery The majority of data loss situations are The majority of data loss situations are

recoverable.recoverable. Computer storage systems may fail, but the Computer storage systems may fail, but the

data stored on them is not always completely data stored on them is not always completely lost.lost.

There are occasions when damage to data is There are occasions when damage to data is permanent and complete data recovery is not permanent and complete data recovery is not possible. However, some data is usually possible. However, some data is usually always recoverable.always recoverable.

Data recovery professionals can recover data Data recovery professionals can recover data from crashed hard drives, operating systems, from crashed hard drives, operating systems, storage devices, servers, desktops, and storage devices, servers, desktops, and laptops using various recovery tools and laptops using various recovery tools and techniques.techniques.

Data Recovery TipsData Recovery Tips DO’sDO’s

Backup your data frequently. Backup your data frequently. If you believe there is something wrong with If you believe there is something wrong with

your computer shut it down, do not continue your computer shut it down, do not continue to power up because you may do more to power up because you may do more damage. damage.

If you here a clunk, clunk sound when you If you here a clunk, clunk sound when you power up the drive, shut down! Do not panic power up the drive, shut down! Do not panic nor turn the power button on and off. nor turn the power button on and off.

Package the drive properly when you send it Package the drive properly when you send it in to a data recovery specialist. You can in to a data recovery specialist. You can cause additional damage to the hard drive if cause additional damage to the hard drive if it is poorly packaged. it is poorly packaged.

Data Recovery TipsData Recovery Tips DON’TSDON’TS

Do not ever assume that data recovery is Do not ever assume that data recovery is impossible; even in the worst cases, such as impossible; even in the worst cases, such as natural disasters data recovery specialists have natural disasters data recovery specialists have been able to retrieve valuable data. been able to retrieve valuable data.

Never remove the cover from the hard drive; Never remove the cover from the hard drive; this will only cause further damage. this will only cause further damage.

Do not rest your computer on a moveable Do not rest your computer on a moveable object or piece of furniture. Shock and vibration object or piece of furniture. Shock and vibration can result in serious damage to the hard drive. can result in serious damage to the hard drive.

Do not subject the drive to extreme Do not subject the drive to extreme temperatures changes both hot and cold. temperatures changes both hot and cold.

In the case where a drive has been exposed to In the case where a drive has been exposed to water, fire or even smoke do not try to power water, fire or even smoke do not try to power up.up.

Data Recovery ProcessData Recovery Process Data loss can occur because the hard drive may Data loss can occur because the hard drive may

have problems accessing the data it contains at a have problems accessing the data it contains at a software or logical level.software or logical level.

By making a complete sector copy (an exact copy By making a complete sector copy (an exact copy including all deleted information) of the hard including all deleted information) of the hard drive, using a program such as Norton GHOST, drive, using a program such as Norton GHOST, most data recovery programs search for deleted most data recovery programs search for deleted MFT (Master File Table) entries to undelete files.MFT (Master File Table) entries to undelete files.

If the MFT is corrupt or defective, this method will If the MFT is corrupt or defective, this method will not work. Some data recovery programs will not work. Some data recovery programs will ignore the MFT and search all of the unallocated ignore the MFT and search all of the unallocated clusters to try to find and recover files.clusters to try to find and recover files.

Data Recovery ProcessData Recovery Process The user may send a failed hard disk drive to a The user may send a failed hard disk drive to a

private data recovery company that offers private data recovery company that offers secure and confidential data recovery.secure and confidential data recovery.

The data recovery company will carefully The data recovery company will carefully perform part replacement of the heads, spindle perform part replacement of the heads, spindle motor and base casting, the electronics board, motor and base casting, the electronics board, etc. in a clean room environment. etc. in a clean room environment.

Part replacement has historically been Part replacement has historically been successful for data recovery about 40%-60% of successful for data recovery about 40%-60% of the time.the time.

Data Recovery ProcessData Recovery Process When data is written to a medium, the head When data is written to a medium, the head

sets the polarity of most, but not all of the sets the polarity of most, but not all of the magnetic domains.magnetic domains.

When a 1 is written to disk the media When a 1 is written to disk the media records a 1, and when a 0 is written the records a 1, and when a 0 is written the media records a 0. However the actual effectmedia records a 0. However the actual effect is closer to obtaining a 0.95 when a 0 is is closer to obtaining a 0.95 when a 0 is overwritten with a 1, and a 1.05 when a 1 is overwritten with a 1, and a 1.05 when a 1 is overwritten with a 1. overwritten with a 1.

Data Recovery ProcessData Recovery Process Normal disk circuitry is set up so that both Normal disk circuitry is set up so that both

these values are read as ones, but using these values are read as ones, but using specialized circuitry it is possible to work out specialized circuitry it is possible to work out what previous "layers" contained.what previous "layers" contained.

The recovery of at least one or two layers of The recovery of at least one or two layers of overwritten data isn't too hard to perform by overwritten data isn't too hard to perform by reading the signal from the analog head reading the signal from the analog head electronics with a high-quality digital sampling electronics with a high-quality digital sampling device, downloading the sampled waveform to device, downloading the sampled waveform to a PC, and analyzing it in software to recover the a PC, and analyzing it in software to recover the previously recorded signal. previously recorded signal.

Data Recovery TechniquesData Recovery Techniques

Scanning Probe Microscopy (SPM)Scanning Probe Microscopy (SPM) Magnetic Force Microscopy (MFM)Magnetic Force Microscopy (MFM) Scanning Tunneling Microscopy Scanning Tunneling Microscopy

(STM)(STM)

Scanning Probe Microscopy Scanning Probe Microscopy (SPM)(SPM)

Scanning probe microscopy (SPM) is Scanning probe microscopy (SPM) is a new branch of a new branch of microscopy that that forms images of surfaces using a forms images of surfaces using a physical probe that scans the physical probe that scans the specimen. specimen.

An image of the surface is obtained An image of the surface is obtained by mechanically moving the probe in by mechanically moving the probe in a a raster scan of the specimen, line by of the specimen, line by line, and recording the probe-surface line, and recording the probe-surface interaction as a function of position. interaction as a function of position.

SPM was founded with the SPM was founded with the invention of the invention of the scanning tunneling microscope in in 1981.1981.

A technique that is used to image A technique that is used to image and measure surfaces at the and measure surfaces at the atomic level.atomic level.

Image showing the bits of a Image showing the bits of a hard diskhard disk

Some important types of Some important types of scanning probe scanning probe

microscopymicroscopy

AFM, AFM, atomic force microscopy EFM, EFM, electrostatic force microscopeFMM, FMM, force modulation microscopyMFM, MFM, magnetic force microscopySTM, STM, scanning tunneling microscopySVM, scanning voltage microscopySVM, scanning voltage microscopySHPM, scanning Hall probe SHPM, scanning Hall probe microscopymicroscopy

Software Data ExtractionSoftware Data Extraction

Data extraction is the process of moving Data extraction is the process of moving data off of the imaged drive to another data off of the imaged drive to another destination location.destination location.

Data extraction software scans sectors of Data extraction software scans sectors of the hard drive and restructures the file the hard drive and restructures the file system either in memory or another hard system either in memory or another hard drive. drive.

The software can be used to copy the The software can be used to copy the recoverable data to a destination location.recoverable data to a destination location.

Software used for recoverySoftware used for recovery CDRoller:CDRoller: Recovers data from optical discs. Recovers data from optical discs. Data LifeSaver:Data LifeSaver: Data recovery for FAT and NTFS file Data recovery for FAT and NTFS file

systems.systems. Data Recovery Wizard: Data Recovery Wizard: Microsoft Windows file recovery Microsoft Windows file recovery

utility.utility. Drive Vaccine: Drive Vaccine: Microsoft Windows Auto Restore of files on Microsoft Windows Auto Restore of files on

RebootReboot FileSalvage:FileSalvage: A Mac OS X recovery program. A Mac OS X recovery program. IsoBuster: IsoBuster: Recovers data from optical discs, USB sticks, Recovers data from optical discs, USB sticks,

Flash drives and Hard Drives.Flash drives and Hard Drives. Recuva: Recuva: Microsoft Windows 2000 & later, FAT and NTFS.Microsoft Windows 2000 & later, FAT and NTFS. TotalRecovery : TotalRecovery : Microsoft Windows. Bootable backup and Microsoft Windows. Bootable backup and

recover system.recover system. TuneUp Utilities: TuneUp Utilities: Microsoft Windows XP & later. A suite of Microsoft Windows XP & later. A suite of

utilities that has a file recovery component.utilities that has a file recovery component. Power Data Recovery: Power Data Recovery: Data recovery software by MiniTool. Data recovery software by MiniTool.

1GB free data recovery for personal use.1GB free data recovery for personal use.

Advantages Software for data recovery facilities

instant recovery of misplaced data from external HDD, PenDrive or other similar storage devices.

Store data for future use.

Disadvantages

To successfully use a data recoveryTo successfully use a data recoverytool you will need to determine the tool you will need to determine the cause of your data loss.cause of your data loss.

A simple reboot cause the overA simple reboot cause the overwriting of data.writing of data.

Data security.Data security.

Recovery may generate virus.Recovery may generate virus.

SummarySummary Individuals or companies may experience data Individuals or companies may experience data

loss at any time for many reasons.loss at any time for many reasons. There are various steps that should be There are various steps that should be

implemented to help prevent data loss.implemented to help prevent data loss. Data loss can be very costly and very upsetting.Data loss can be very costly and very upsetting. There are several data recovery techniques that There are several data recovery techniques that

have proven to be successful or partially have proven to be successful or partially successful in recovering data.successful in recovering data.

Utilizing qualified professional data recovery Utilizing qualified professional data recovery specialists will aid in the degree of success of specialists will aid in the degree of success of data recovery.data recovery.

BibliographyBibliography http://www.intellirecovery.com/data/http://www.intellirecovery.com/data/

recovery.htmlrecovery.html http://www.data-recovery-info.comhttp://www.data-recovery-info.com http://mechmat.caltech.edu/~kaushik/park/1-3-http://mechmat.caltech.edu/~kaushik/park/1-3-

0.htm0.htm http://www.eng.yale.edu/reedlab/research/spm/http://www.eng.yale.edu/reedlab/research/spm/

spm.htmlspm.html http://www.cs.auckland.ac.nz/~pgut001/pubs/http://www.cs.auckland.ac.nz/~pgut001/pubs/

secure_del.htmlsecure_del.html http://www.ebaumsworld.comhttp://www.ebaumsworld.com http://www.disklabs.comhttp://www.disklabs.com