Magnetic force microscopes may be able to read overwritten data on a platter, even if it can’t spin.
Data loss: we’ve all experienced it. Maybe you emptied the Recycle Bin milliseconds before realising that you’d deleted the wrong folder the day before; or perhaps your hard disk simply packed up, leaving behind it nothing more than an odd clicking sound and a system error screen. It might have been that the dog really did eat your homework by mistaking your newly burnt DVD for its latest toy. Whatever happened in your case, it resulted in your precious data ascending to that great filesystem in the sky.
Fortunately, dead disks, trigger-happy fingers and scratched CDs don’t always mean that you have to wave goodbye to your data. While not every problem has a happy ending, there are many that do. So when disaster strikes, don’t reach for the proverbial pistol: grab our guide to recovering data instead.
Lost files
Disaster rating: 1/5
Losing a file is a disconcerting experience. If you’re looking for a document but can’t find it anywhere, stay calm. Stop any programs that are writing huge amounts of data to your hard disk and exit as many applications as possible. Deleted files aren’t really deleted: they’re merely marked as disk space ripe for reuse. This means that you want to stop anything that’s writing to disk in case it overwrites the lost data.
When everything has been stopped, have another search for your lost file using Windows’ Search utility. If it’s really not there, your first port of call should be the Recycle Bin. If it’s not in there either, or you habitually use the more brutal [Shift]+[Delete] option, you should advance to the ‘Truly deleted files’ section below.
However, some programs may have already come to your rescue. Word and other Office applications, for example, store temporary versions of files as you’re working on them. Finding and extracting usable data from these temporary files can be complex, but it can enable you to retrieve missing data. Visit Microsoft’s support site for a very comprehensive guide.
Truly deleted files
Disaster rating: 3/5
Although files deleted normally (and therefore simply sent to the Recycle Bin) are easily restored, those ‘properly’ deleted are trickier to recover. However, it’s sometimes possible to resurrect these files using an undelete utility. If you’ve accidentally truly deleted a file, reach for one of these first.
To understand how these tools work their apparent magic, you need to know how a filesystem works and what happens when you delete a file. Each disk (or each partition if your disk is divided into more than one partition) contains a system area that contains directory information about all of its files. For each file, it contains the name of that file and the number of the first cluster (the smallest usable area of a disk) in that file. Another important system area is the File Allocation Table (FAT), which contains information about all the other clusters associated with a file. The FAT entry for a file’s first cluster is the number of the second cluster; in the entry for the second cluster is the number of the third cluster and so on until the entry for the last cluster in the file, which is an end-of-file indicator.
When a file is deleted, Windows does two things. First, it overwrites the first character of the filename in the directory with a question mark to indicate that the entry in the directory can be reused. Second, it overwrites the entries for all the file’s clusters in the FAT with zeros to indicate that those clusters are free to be reused. None of the data in the file is actually overwritten or erased, so, if you move quickly, it may be possible to recover the file. Undelete utilities start by looking in the directory for any filenames that start with a question mark. If the user opts to undelete any such file, the utility goes to the first cluster, as shown in the directory, and reads data from that and subsequent clusters until an end- of-file marker is found. Note that this method will work only if a file is sequential – if it’s fragmented then it can’t be recovered since the information in the file allocation table that is needed to find non- sequential clusters will have been overwritten. It’s also important to recognise that although it’s possible to successfully recover a file if you act immediately, the longer you leave it the more likely it is that Windows will have overwritten one or more clusters.
Corrupted filesystem
Disaster rating: 3/5
If your PC is shut down improperly, perhaps due to a power cut or system failure while Windows is in the process of writing to the system areas of the disk, the filesystem could become corrupted. This could result in data being present on your disk that Windows has no knowledge of – not an ideal situation to be in.
To understand exactly how this is corrected, we’d have to get into the intricacies of the filesystem. To cut a long story short, let’s say that software is used to analyse the filesystem and spot inconsistencies. Having found some, and based on information regarding the most likely ways in which a filesystem can become corrupted, the software attempts to rebuild the filesystem so that Windows can access those lost files. The technique is intended to recover data, not mend Windows and its intricate data structures. When your data has been rescued, you’ll need to reformat the disc and reinstall Windows.
Once it’s found the all-important inconsistencies, the software will attempt to figure out where the lost files are, based on information regarding the most likely ways in which a filesystem can become corrupted. Once identified, the lost files can be restored to a separate drive. If you want to have a go, try GetDataBack or >a href=”http://www.r-tt.com”>R-Studio NTFS.
Sometimes this process – and the undelete process described above – isn’t successful even though the data is still present on the disk. In these cases, you can recover files by analysing clusters to determine what type of data they contain. This takes a fair amount of research into the clusters of different types of files. However, if your disk isn’t particularly fragmented, it could be easier to reassemble a lost file than you might think.
Mechanical failure
Disaster rating: 4/5
A hard disk drive consists of a spindle motor, a voice coil motor, a read/write head, a circuit board and a platter, of which only the latter stores any data. So if your drive fails, it’s possible that the data is still present on the platter and the problem is due to a failure of one of the other components. Even an evidently mechanical sound might be nothing more sinister than a failure of the servo circuitry.
Replacing parts is a delicate operation that must be carried out in the safety of a clean-room environment.
If something other than the platter has failed, then the solution is obvious – replace the offending part. You might be tempted to try this yourself, but be warned: it’s tricky. Firstly, unless you’re an expert you won’t know for sure which part needs replacing. Secondly, attempting the operation in anything other than a spotless room is doomed to failure. Finally, you’d have to buy an exactly identical disk drive from which to salvage the parts. Thus we highly recommend employing the services of a data recovery company.
Software like the custom-writter application by MjM Data Recovery enables the company’s engineers to diagnose and correct logical errors to the filesystem
This isn’t a cheap option, so you’ll have to decide whether your lost data is worth it. The good news is that some companies offer a ‘no fix – no fee’ guarantee on repairs, or will first carry out a diagnosis and then provide you with a report that will specify how much data they can be sure of salvaging, should you accept the quotation. If you want to attempt this, try contacting Xytron.
Overwritten files
Disaster rating: 5/5
If your file has been truly deleted and then overwritten, the sad news is that you probably won’t be able to retrieve it. However, there are two theoretical methods that seem promising, so perhaps the situation will be more hopeful in the future.
The first method is to do with variations in magnetic flux. When data is written to disk, the resultant magnetic flux depends mostly on the value written. However, the flux is also provided with a tiny contribution from the overwritten data. So, if you replace the normal read electronics that decide whether a bit is a 1 or a 0 with circuitry that can extract the analogue value from the head, subtracting the known contribution of the most recently written data should make it possible to determine what value was in place before it.
This method of extracting overwritten data is commonly reported and academic papers have been written on the subject, but we’ve been unable to find any organisation that claims to have done it successfully. The problem is that the signal to the previously written data is so small that it effectively gets lost in the random electrical fluctuations commonly referred to as noise. However, Western Digital’s Gerardo Bertero – while questioning whether the technique is really a practical proposition – did suggest one possible solution. By reading each bit thousands if not millions of times and averaging all those signals, electrical noise, being random in nature, would average out to zero – whereas the genuine signal would build up and become visible. The snag is that this would be hugely time-consuming and costly – which is why nobody offers such a service. Whether it becomes feasible when national security is at risk is another question entirely, and one we’re not likely to get an answer to from the Secret Service.
The second theoretical technique for recovering data is to use a Magnetic Force Microscope (MFM). It’s claimed that this method offers an additional benefit – it can read data, overwritten or not, from the surface of a platter that is no longer able to spin because of damage. For the normal read operation of a hard disk, the platter must be able to rotate because an electrical signal can only be produced in the read head’s coil if it’s moving with respect to the magnetic field. However, an MFM is able to read a static magnetic field – so the platter doesn’t have to be able to spin.
An MFM is a laboratory instrument that has an ultra-fine magnetised tip suspended on a cantilever. As the tip moves over the surface of the object being imaged, the magnetic field of that object exerts a force on the tip, which in turn causes a displacement of the cantilever. This is measured using optical techniques. It’s self-evident how an MFM could be used to read data from a platter that can no longer rotate, but what isn’t as obvious is how the technique lends itself to recovering data that’s been overwritten – at least in theory.
Data is written to a hard disk’s platter in concentric circles known as tracks. A highly accurate servo control system is used to position the read/write head over the required track, but, even so, the head isn’t always positioned to exactly the same radial position. What this means is that if a track is overwritten but the head wasn’t at exactly the same position as it was on the previous occasion, a narrow band of the previously written data might remain intact at the edge of the track. Again, despite hearing so much about this technique, and despite the fact that hard disk drive manufacturers already use MFMs for research and development, we haven’t found any company who offers this technique for recovering overwritten data.
We’d have to speculate on whether it’s in use by the military, although the fact that military standards require disks to be physically destroyed at the end of their lives might just suggest that they know it’s feasible.
Scratched discs
Disaster rating: 1/5
Methods such as undeleting files, repairing logical errors to the file structure and reassembling files also work with media such as memory cards and pen drives.
However, there are certain methods of data recovery that apply only to optical disks. Except in the most extreme cases, when a CD or DVD won’t read it’s usually scratches in the outer plastic layer that are causing the problem. The plastic layer is there to provide protection to the layer of data underneath, but scratches can impair the passage of the light used to read the data. The solution is to remove the troublesome scratches using a mild abrasive so that light will pass through the plastic layer without obstruction.
Scratches may prevent CDs from being read, but devices such as Digital Innovations’ SkipDr could restore it.
Although there are reports of this being done successfully using household substances such as Brasso, a more reliable solution is to use a product designed for this job. Such products range from kits comprising a bottle of suitably mild abrasive and a lint-free cloth to mechanical disk polishing devices such as Digital Innovations’ SkipDr. The latter claims a greater chance of success since the polishing process is more uniform and controlled.
Shattered discs
Disaster rating: 4/5
Researchers at the University of Arizona’s Optical Sciences Center have published a peer-reviewed paper in which they describe how they used an optical microscope to extract data from fragments of broken CDs or DVDs. However, the process is time-consuming and so isn’t likely to be viable unless the rewards are huge. What’s more, any data in the vicinity of the breaks is totally unrecoverable, so in many cases we’d be talking of recovering fragments of data rather than files in their entirety. A shattered disc still means lost data – although the future may hold more hope for broken optical discs.
