16 February 2017

Recovering missing or corrupted files

Are you suddenly unable to read an important file from a hard disk, a memory card, a tape or some other medium? Backups are nonexistent or do not work? Help is available.

Shut down the system

The surest way to prevent further damage is shutting down the system abruptly, such as by unplugging a desktop computer from the mains or removing the battery from a notebook computer. In normal usage, shutting down the computer cleanly (for example, through the Start menu in Microsoft Windows) is important so that the operating system can write certain information to the hard disk. However, in case of data loss, it is safer to avoid those writing operations.

In short: the less you try to operate a logically or physically damaged disk or other medium, the better. Additionally, making notes of what happened, as well as of your own actions, may prove useful should you later need to consult a recovery specialist.

Types of damage

Logical errors

These problems are typically caused by careless use or by defective or malicious software. The disk or other medium is not physically damaged, but one or more files cannot be found or opened. They may have been deleted entirely or in part, or there may be an error in a file table, an allocation table or similar metadata.

Logical errors can often be repaired using special software tools. This avoids invasive action such as opening the casing of a hard disk drive. However, you should only use a high quality software tool that is designed for the kind of situation in which you are. Any failed attempt is likely to make the problem worse and may make recovery more expensive.

Physical damage

If the medium is physically damaged, such as by wear, impact, water, electricity or fire, recovery will probably require the data to be lifted off the damaged medium in a laboratory environment. Do not try to use software tools. At best, they will have no effect; at worst, they will worsen the damage.

How to proceed

Contact a provider such as Ibas Kroll Ontrack; they can help you decide on the most cost-efficient course of action.

The following details may help them assess the situation.

  • Type of device (camera, telephone, notebook, desktop, server…)
  • Operating system (macOS, Windows, Linux…) and version
  • Medium information
    • Type of medium (memory card, hard disk drive, RAIDDVD…)
    • Manufacturer and model
    • Quantity, size, capacity, partitioning and file-system (APFS, NTFS, FAT…)
  • Problem description
    • What happened? How did you notice the problem?
    • If an external cause (transport, lightning, fire…) was involved, please describe it
    • What was done after the problem began? Please describe all actions taken
  • Data missing
    • Directory and file names
    • Type, size and quantity of files
    • Is the data encrypted? If yes, please specify how
  • Delivery deadline, if any
  • Your name, organization, email address, postal address, telephone number and fax number

Comparing costs

For your own use in weighing up your options, you should estimate the costs involved with rebuilding the data as well as with abandoning it. Comparing these expenses with those for recovery will help you make cost-effective choices.

Rebuilding refers to work such as re-entering the information from paper documents. The costs of abandoning the data may include, for instance, giving up receivables that due to loss of billing data cannot be invoiced.

An ounce of prevention

Implementing an efficient backup strategy will minimise your likelihood of ever having to recover data from a damaged medium. Here are a few points to keep in mind:

  • Backup media must be in perfect working condition.
  • Backups should be created daily at the least.
  • Restoration should be tested before an emergency arises.
  • Some backups should be stored off-site.

Also, remember to keep your backups secure; do not allow them to become an intruder's shortcut to the information in your data centre. However, if you decide to encrypt your backups, ensure that encryption does not prevent their intended use.