Hard Disk External USB,FW,TB RAID, NAS Server USB Flash,SSD.. wherever your data is
In spite of the great diversity of technologies and devices out there, data recovery is surprisingly similar across all of them. Be it a disk or a flash drive, a digital camera or a smart phone, they all use the same fundamental approach to storing data. With great oversimplification:
- The disk/flash is organised into small chunks called sectors (generally 512 or 2048 bytes each).
- Each sector is referred to by its sequential number (start from sector 0, up to available capacity).
- They are grouped into partitions according to a "partition map" list at the beginning of the device.
- Each partition has a list (directory) of what files it contains and which sectors belong to which file.
Note: When you erase a file, its entry in the directory is removed and the corresponding sectors marked as available but rarely overwritten until a new file gets written on those available sectors. That is the reason erased files can generally be recovered complete. So, if you erase something by mistake, stop using the computer immediately and just pull the plug, not even shutting down if you can.
Therefore, to recover your files, we need to:
- Coerce the raw data sectors out of the failed device (this is usually the hardest part),
- Possibly assemble or decrypt them into a meaningful sequence (particularly RAID data),
- Rebuild the (directory) structures that keep track of which sector belongs to which files,
- Extract meaningful files from the underlying sea of data,
- Verify the results and return them to their rightful owner ;)
Simple really... But not always easy ;)
Depending on the actual problem, we may have a different entry point into the list above. The lower down the list we need to start, the faster and less expensive the recovery.
For example, if files were deleted or a volume formatted by accident, the raw disk sectors should still be easily accessible. So, our work would really start from the middle of the list above.
On the other hand, if a disk drive doesn't reach the "ready to accept instructions" state, we must first repair it (however precariously) to a level of being able to read raw sectors, use that to extract those raw sectors onto a good disk drive (cloning) and deal with the missing sectors. Only then can we search for file information to rebuild the directory.
The consequence is: When a device starts misbehaving, be careful. Trying to copy files off it again and again is only likely to make things worse and reduce your chances of recovering your precious work, photos, records, etc. Talking to us when things are just starting to misbehave will get your data back a lot faster and cheaper than after the head assembly fails completely or damages a platter surface. Sorry if this advice seems self-serving. Nonetheless, it's true.
Arguably, it is self-serving. But in a different way: We prefer by far to have happy customers who got their data back at a low cost than to spend weeks searching for an exact-match donor, only to see the good heads killed by a scratch on a platter, making recovery impossible...