Almost every business has dealt with a data loss event at some point, where important information has been lost or rendered unreadable by accident or indeed by malevolent design.
Understanding how data was lost in the first place is the first step towards recovery, and it will often determine whether the correct approach is as simple as loading from a backup or using a bootable drive to get important information back, or whether it requires specialist intervention.
There are a lot of ways for data to become inaccessible, from an operating system glitch, a computer virus or a hard drive malfunction, each of which requires its own restoration solution.
However, almost every data loss event can be separated into two root categories: logical data loss and physical data loss. Here are the differences not only in cause but also in repair approach.
Logical Data Loss
The most common causes of data loss do not involve the drive itself but instead, the software processes that read and write data to a hard drive or other form of physical media.
Sometimes this is simply a case of overzealous deleting, and whilst it still can need the help of specialist tools, a file that has been accidentally deleted or removed due to a virus attack can often be recovered as long as it has not been written over by another file.
Theoretically, overwritten data can sometimes be recovered, but whilst a theoretical method by Peter Gutmann suggests that overwritten data could be recovered, albeit with great difficulty, no practical evidence of recovering significant amounts of data has been found, at least with conventional hard drives.
Outside of basic issues, a bad drive sector, caused by a virus, shutting down a computer suddenly or a crash, can sometimes cause data to appear lost because the computer refuses to attempt to access it, something that specialist tools can sometimes help to bypass.
As well as this, corruption in the file system or partition table can cause a hard drive to suddenly lose data, and this can either be as simple as using a recovery tool or require data carving to access as much of a corrupted file as possible.
Physical Data Loss
The other main way in which data can be lost, one that is far more serious, is damage to the physical media holding it. CDs and DVDs can get scratched, data tapes can break, hard drives can have faulty disk heads or the spinning motors can fail, and most of this damage leads to data loss a user cannot typically fix on their own.
Exactly what is needed to fix a hard drive will depend on the fault itself. Replacing parts can sometimes be enough, but when it is not, a data recovery specialist will use a cleanroom to salvage the data on the drive and create an image of the disk that is saved to a working hard drive.
From there, analysis will examine and save any files they can and as much as they can from the files that are not salvageable in their entirety.
