What are the different types of data recovery?
Posted on 19th November 2021 at 15:49
What is data recovery?
Data recovery can broadly be described as the process of retrieving data from corrupt, damaged or otherwise inaccessible storage devices, in most cases where a recent enough backup does not exist.
This could be data that was accidentally deleted, a partition that was formatted in error, an electrical issue with a device or even equipment damaged by flood, fire, or other catastrophe.
This type of data recovery is distinct, of course, from reuniting you with the data on your laptop that you left in a taxi. You’ll need to call Uber for that…
Data recovery with software.
For deletions and minor formatting / reinstalling challenges, or even some virus attacks and minor software malfunctions, there is a very good chance of recovery provided the storage device has not been significantly used to write fresh data since the incident. (Continued use could potentially overwrite data that would be retrievable, so always best to stop what you are doing as soon as you notice something is amiss, and review your options.)
There are many data recovery software tools that can be downloaded either for free or as a trial version, and running one is usually relatively simple. This can be a great way to establish whether or not the files are recoverable with software, or if the problem is more complex and you need to employ a data recovery company.
Look for software products that have a good range of reviews, that allow you to try before you buy, and preferably come from a data recovery services outfit so you have an easy (and sometimes discounted) escalation path should the software not get everything back.
Next steps: download a free data recovery software tool, or the trial version of a paid tool, and see if that flags your lost files as recoverable, if not, contact a trusted data recovery expert.
Tip: do not download any software to the device with the issue, as this would potentially overwrite recoverable data – instead, download the tool to a different device and connect the device to be recovered to it.
Removable storage device data recovery.
Digital cameras, camcorders, home CCTV devices, laptops, phones, and many other devices that are portable or based around the home can use removable storage cards as a primary or secondary source of data storage.
Even though there are no moving parts with these media types, they are certainly not immune to data loss. Failures could be the result of heat or water damage, physical damage to the circuitry, damage to the on-board chips that hold the data or even logical malfunctions.
It is worth trying a free software tool initially, just in case the data is recoverable via this method, but beyond that you will need to find a data recovery expert that has a broader suite of software tools, or even a clean bench in a lab for those physical issues as oftentimes circuitry will need to be repaired and other electrical components might need to be replaced.
Next steps: if your removable device is not seen by a software recovery tool, look for a data recovery expert that has a lab as well as advanced software tools, and engage only with a data recovery company that commits to a fixed price for recovery up front, as the cost for recovery in many cases can exceed the value of the data on these devices.
Tip: sounds simple, but make sure you clean the contacts on your storage device and also any port or adapter before declaring data lost – these devices and their ports are susceptible to pocket lint and household dust!
Single hard drive data recovery.
Hard drives come in many shapes and sizes, and can be found in many different devices from desktops to laptops to external backup devices and even DVRs and games consoles.
There are also several different technologies available - from SATA to SCSI to SSD - depending on when the hard drive was made and what application it was designed for, and each of these present different recovery challenges.
All devices however are susceptible to both physical and logical issues that can cause data loss, and each device will likely require a different solution and level of expertise. For this reason, in most cases you will need to seek professional assistance.
In order for your files to be recovered, the raw data must first be extracted from the hard drive. If there are physical issues – maybe a power surge has caused electrical damage, the internals of a spinning drive have failed causing a head crash, or the user has dropped the device or spilled liquid on it – then these will first need to be overcome in order to get the best read possible of the raw data, called an ‘image’.
Once this hard drive image has been extracted, invariably there will be some missing or scrambled data that needs to be fixed before files become usable. This requires advanced software, either commercial or custom built, and a certain degree of expertise to understand the data maps and perform the structural rebuild.
So as you can see, not for the fainthearted!
Next steps: power down the device and engage an expert that can assess your equipment. Usually this involves sending the device to a lab location, although sometimes a recovery can be attempted remotely via a secure internet link. Do not attempt to dry any wet device, this can cause further damage, seal the equipment in airtight packaging as is.
Tip: Find a data recovery expert that has a free (or low cost) evaluation stage before committing to recovery fees. Data recovery is not an exact science, and there are many cases where the data, or at least the data that has value to you, is irrecoverable. Only agree to a recovery when you have a good degree of confidence that you will get back what you need.
Server, RAID and virtual machine (VM) data recovery.
Now we are at the higher end of the data recovery range, and things can get complicated very quickly. That said, all is not lost, and data recovery will in most cases not only be possible, but also a great deal cheaper than the cost of recreating the lost data or living without it.
Whether you are running a RAID 0, RAID 1, RAID 5, or any other configuration, and no matter whether your server is physical, virtual, or cloud-based, recovery can still be a viable solution provided the correct steps are taken quickly.
As with all data recovery scenarios, the quicker you respond the better, in order to prevent further hardware degradation by continued use of failing equipment, or further data loss by continuing to (over)write to storage devices that need recovery.
The first step, as with other recovery types, will be an evaluation – this will often be chargeable as the work required to understand the complexity of the data loss can be significant. Thereafter, a range of fees is often quoted for the recovery, with pricing factors including whether or not physical damage exists, whether existing tools will be able to be used or new tools will need to be developed to solve the problem, how much data needs to be extracted and of course, how quickly it needs to be done.
Oftentimes these servers are business critical, and downtime can cost enterprises millions per day, so most data recovery companies offer 24/7/365 services for these types of situations. Expect to be charged handsomely for these services however, as you are not only paying for the company's time and skill, but potentially the millions they might have invested over the years in R&D to create the tools to save your data.
Next steps: power down and isolate the equipment, then call a data recovery expert for an initial phone consultation. These are almost always free, and will give you good advice as to what you need to do next to improve your chances of recovery. Sometimes a remote evaluation is possible, and this will give immediate insight into the root cause of the issue and chances of recovery. In many cases the storage devices will need to be packed up and collected for delivery to a lab, or made available for inspection where an onsite recovery attempt is preferable.
Tip: Try to take servers out of production immediately to prevent overwriting, and be sure to include all storage devices in the system for data recovery evaluation as important parity information is often found on perfectly functioning drives.
Ransomware data recovery.
This is one of the fastest exploding risks you have to both your data and your reputation, and as a result ransomware and cyber-attacks are routinely cited as the highest pressure points an IT manager faces today.
Highly publicised multi-national or governmental attacks might catch the headlines, but companies large and small are increasingly vulnerable to ransomware attacks and demands, which can be crippling to productivity in the short term, but very quickly ruinous financially if not overcome.
There are hundreds and hundreds of different types of ransomware variants in the wild, and as a result it is extremely difficult to stay ahead of all the threats. Not only does this make proactive protection difficult, it also makes reactive recovery much harder as many of these new strains require a new (and sometimes custom-built) solution to overcome.
Furthermore, the route to successful data recovery after a ransomware attack is rarely the same, usually combining a mixture of decryption tools, file and volume recovery tools, backup recovery tools and techniques and of course, the experience to understand what tools are needed.
However, it is frequently much cheaper to engage a ransomware data recovery company to decrypt your files than it is to pay a ransom, both financially and from a reputational perspective. Especially when you consider that often a paid ransom is no guarantee of your files actually being returned safely!
Next steps: isolate all affected devices / systems from the network and engage a ransomware recovery expert immediately, even before engaging in any capacity with the attacker. It is also worth putting a call into your insurance company, as they understand the implications of ransomware and will often offer support to mitigate the risk.
Tip: Not only does paying a ransom offer no guarantee that your files will be returned safely, it could also send a message to the attacker about your data value, and as such encourage them to attack you again in the future or even make a copy of your data to exploit you further, now it knows you have deep pockets!
Share this post: