Forensics and Cyber Threat Research Area

Threat Intelligence | Insider Threat Detection | User Behavior Analytics | Cyber Threat Management | Data Security Intelligence | Cloud Security Intelligence Application Security Intelligence | Anomaly & Pattern Detection |  Security Information Event Management | Digital Forensics | Data Recovery | Malware Investigation | Packet Analytics | Packet Forensics | security operations and analytics platform architecture (SOAPA)

Home » Blog » Data Recovery Concept

 Posted in Data Recovery

Data Recovery Concept

   22nd February 2015  Leave a Comment on Data Recovery Concept 1 1123

Data Recovery Concept

Data Recovery Concept
Data Recovery Concept

 

Data Recovery Concepts deal with following things

What is data Loss

Common Computer Problems

Data Analysis Concepts

Data Recovery Tips

Data Recovery Technique

Basic Data Recovery

Advance Data Recovery

Data Recovery is the process of extracting digital information in the form of data from damaged, failed, corrupted or inaccessible secondary storage media when it cannot be accessed normally. Data recovery may be required because of physical damage to the digital storage device or logical damage to the file system that prevents it from being mounted by the host operating system. Data Recovery is possible on FAT12, FAT16, FAT32, exFAT, TFAT, NTFS, Ext2, Ext3, Ext4, Next3®, CDFS/ISO9660/Joliet, UDF these file System. Data Recovery becomes more tedious job when it deals with RAID Recovery, LVM Recovery, VM Recovery, NAS Recovery, SAN Recovery, SSD Recovery

 

What is Data Loss?

  • Data has accidentally been erased or data control structures have been overwritten.
  • Data has been corrupted or made inaccessible.
  • Data is unable to be accessed from a previous functioning computer system or backup.

Common Computer Problems

  • Computer won’t boot up
  • Applications that are unable to run or load data
  • Hard drive crashes
  • Corrupt files or data
  • Accidental reformatting of partitions
  • Inaccessible drives and partitions
  • Media surface contamination and damage

Data Recovery Concepts

  • The majority of data loss situations & respective environments are recoverable.
  • Digital storage systems may fail, but the data stored on them is not always completely lost.
  • There are some situations when data is damage and permanently lost and complete data recovery is not possible. However, some part of data is usually always recoverable.
  • Data recovery professionals can recover data from crashed hard drives, operating systems, storage devices, servers, desktops, and laptops using various proprietary data recovery tools and techniques.

Data Recovery Tips

DO’s
1.      Backup your data frequently.2.      If you believe there is something wrong with your computer shut it down, do not continue to power up because you may do more damage.3.      If you hear a clunk sound when you power up the drive, shut down! Do not panic nor turn the power button on and off.4.      Package the drive properly when you send it in to a data recovery specialist. You can cause additional damage to the hard drive if it is poorly packaged.		DON’TS
1.      Do not ever assume that data recovery is impossible; even in the worst cases, such as natural disasters data recovery specialists have been able to retrieve valuable data.2.      Never remove the cover from the hard drive; this will only cause further damage.3.      Do not rest your computer on a moveable object or piece of furniture. Shock and vibration can result in serious damage to the hard drive.4.      Do not subject the drive to extreme temperatures changes both hot and cold.

5.      In the case where a drive has been exposed to water, fire or even smoke do not try to power up.

 

Data Recovery Techniques

  • Data extraction is the process of parsing data off  the imaged drive to another destination location.
  • Data extraction software scans sectors of the hard drive and restructures the file system either in memory or another hard drive.
  • The software data recovery can be used to copy the recoverable data to a different location.
  • Data loss can occur because the hard drive may have problems accessing the data it contains at a software or logical level.
  • By making a complete sector copy (an exact copy including all deleted information) of the hard drive, using a program such as Norton GHOST, most data recovery programs search for deleted MFT (Master File Table) entries to undelete files.
  • If the MFT is corrupt or defective, this method will not work. Some data recovery programs will ignore the MFT and search all of the unallocated clusters to try to find and recover files.
  • The user may send a failed hard disk drive to a private data recovery company that offers secure and confidential data recovery.
  • The data recovery company will carefully perform part replacement of the heads, spindle motor and base casting, the electronics board, etc. in a clean room environment.
  • Part replacement has historically been successful for data recovery about 40%-60% of the time
  • When data is written to a medium, the head sets the polarity of most, but not all of the magnetic domains.
  • When a 1 is written to disk the media records a 1, and when a 0 is written the media records a 0. However the actual effect is closer to obtaining a 0.95 when a 0 is overwritten with a 1, and a 1.05 when a 1 is overwritten with a 1.
  • Normal disk circuitry is set up so that both these values are read as ones, but using specialized circuitry it is possible to work out what previous “layers” contained.
  • The data recovery of at least one or two layers of overwritten data isn’t too hard to perform by reading the signal from the analog head electronics with a high-quality digital sampling oscilloscope, downloading the sampled waveform to a PC, and analyzing it in software to recover the previously recorded signal.

For more information please refer the following links

  • Basic Data Recovery  hard-drive-data-recovery

 

  • Advance Data Recovery  Hard disk-drive search

 

 

 

Author: Rohit Sadgune
Core Working Areas :- Threat Intelligence, Digital Forensics, Incident Response, Fraud Investigation, Web Application Security Technical Certifications :- Computer Hacking Forensics Investigator | Certified Ethical Hacker | Certified Cyber crime investigator | Certified Professional Hacker | Certified Professional Forensics Analyst | Redhat certified Engineer | Cisco Certified Network Associates | Certified Firewall Solutions | Certified Network Monitoring Solution | Certified Proxy Solutions
Website

Leave a Reply

Your email address will not be published. Required fields are marked *

Enter Captcha Here : *

Reload Image

Indicator of Attacks | Indicator of Compromise

Top SIEM Use Cases | Threat Hunting Hypothesis | Deep Packet Inspection | Insider Threat Hunting | Hunting Data Exfiltration | Banking Fraud | ATM Use Cases | Cross Channel Data Exfiltration | Hunting Endpoint Anomaly | Denial-of-service | Man-in-the-middle (MitM) attack | Spear phishing attacks | Drive-by attack | Eavesdropping attack | Birthday attack