In computing, data recovery is the set of techniques and procedures used to access and extract information stored in digital storage media that due to damage or breakdown cannot be accessed in the usual way.
Data recovery procedures can be used to retrieve information from various types of media such as hard drives, USB sticks, servers, digital cameras, CDs, DVDs, among others.
Data recovery is necessary for various reasons, such as physical damage to the storage medium (electronic breakdowns, mechanical breakdowns, knocks, fires, floods, etc.) or logical breakdowns (damage to the file system, damage to the partitions, deleted files, accidental formatting, etc.).
There are different methods and tools that can be executed to perform data recovery and everything will depend on the failure of the device, from specialized software to hardware tools designed specifically for this task.1
Data recovery scenarios
The most common scenario of “data recovery” involves a failure in the operating system (typically a single disk, a single partition, a single operating system), in this case the goal is simply to copy all the required files to another disk. This can be easily achieved with a Live CD, most of which provide a means to access the file system, obtain a backup copy of the removable disks or devices, and then move the files from the disk to the backup with a file manager or a program for creating optical discs. These cases can be mitigated by partitioning the disk and continuously storing the important information files (or copies of them) in a different partition than the system files in the operating system, which are replaceable.
We can recover data from a damaged hard drive
Another scenario involves a disk-level failure, such as a file system or disk partition that is compromised, or a hard disk failure. In any of these cases, the data cannot be easily read. Depending on the situation, the solutions may be between repairing the file system, the partition table or the loaded master record (MBR), or hard disk recovery techniques ranging from software-based recovery of corrupted data to the replacement of the hardware of a physically damaged disk. If hard drive recovery is necessary, the disk itself has typically failed permanently, and the purpose, rather than a one-time recovery, is to rescue any data that can be read.
In a third scenario, the files have been “erased” from a storage medium. Typically deleted files are not really deleted immediately; instead, references to them in the directory structure have been removed, and the space they occupy is made available for later overwriting. In the course of this, the original file can be recovered. Although there is some confusion about the term, “data recovery” can also be used in the context of forensic or espionage computer applications.