PC Data Rescue

Data Carving is a data recovery technique that allows for data with no file system allocation information to be extracted by identifying sectors and clusters belonging to the file.

Data Carving usually searches through raw sectors looking for specific desired file signatures. The fact that there is no allocation information means that the investigator must specify a block size of data to carve out upon finding a matching file signature.

This presents the challenge that the beginning of the file is still present and that there is (depending on how common the file signature is) a risk of many false hits.

Also, data carving requires that the files recovered be located in sequential sectors (rather than fragmented) as there is no allocation information to point to fragmented file portions. This method can be time and resource intensive.

A wide variety of failures can cause physical damage to storage media. CD-ROMs can have their metallic substrate or dye layer scratched off; hard disks can suffer any of several mechanical failures, such as head crashes and failed motors; tapes can simply break.

Physical damage always causes at least some data loss, and in many cases the logical structures of the file system are damaged as well. This causes logical damage that must be dealt with before any files can be salvaged from the failed media.

Most physical damage cannot be repaired by end users. For example, opening a hard disk in a normal environment can allow airborne dust to settle on the platter and become caught between the platter and the read/write head, causing new head crashes that further damage the platter and thus compromise the recovery process.

Furthermore, end users generally do not have the hardware or technical expertise required to make these repairs. Consequently, costly data recovery companies are often employed to salvage important data. These firms often use “Class 100″ / ISO-5 cleanroom facilities to protect the media while repairs are being made. (Any data recovery firm without a pass certificate of IS0-5 or better will not be accepted by hard drive manufacturers for warranty purposes.)

Despite this, there are many accounts of users getting a bad disk going long enough to pull their data off, often via slightly bizarre tricks. These include making the drive cold (in the freezer) or spinning it manually on the ground, both actions being used to unstick a jammed platter.

Most data recovery professionals deprecate the use of tricks such as these, since they can cause additional physical damage to the drive if the existing damage is such that further harm will be caused if the drive is operated before first being repaired.