Data recovery is the process of restoring data that has been lost, accidentally deleted, corrupted or made inaccessible.
In enterprise IT, data recovery typically refers to the restoration of data to a desktop, laptop, server or external storage system from a backup.
Data recovery can be performed on a variety of storage devices including internal storage drive of laptop or desktop, external hard disk drive, solid-state drive, USB flash drive, optical storage medium (CD/DVD/BD), and memory card (SD, SDHC, SDXC).
Most data loss is caused by human error, rather than malicious attacks, human error accounted for almost two-thirds of the incidents reported. The most common type of breach occurred when someone sent data to the wrong person.
Other common causes of data loss include power outages, natural disasters, equipment failures or malfunctions, accidental deletion of data, unintentionally formatting a hard drive, damaged hard drive read/write heads, software crashes, logical errors, firmware corruption, continued use of a computer after signs of failure, physical damage to hard drives, laptop theft, and spilling coffee or water on a computer.
The data recovery process varies, depending on the circumstances of the data loss.
Data recovery is possible because a file and the information about that file are stored in different places. For example, the Windows operating system uses a file allocation table to track which files are on the hard drive and where they are stored. The allocation table is like a book’s table of contents, while the actual files on the hard drive are like the pages in the book.
When data needs to be recovered, it’s usually only the file allocation table that’s not working properly. The actual file to be recovered may still be on the hard drive in flawless condition. If the file still exists — and it is not damaged or encrypted — it can be recovered. If the file is damaged, missing or encrypted, there are other ways of recovering it. If the file is physically damaged, it can still be reconstructed.
So, when data is deleted or a drive is formatted, the data is not removed from the storage drive. Rather, the data remains intactin the storage medium in an inaccessible state ready to be overwritten by new data. This marooned data can be retrieved by using a data recovery software that uses file signatures to scan the entire storage drive bit by bit. You can then preview and select the required data from the scanned items and recover them to a distinct storage drive to avoid overwriting. In case the data that you are trying to recover is overwritten or corrupt, it can’t be fixed by a data recovery software.