Data recovery

Ogwal-Awio K.
Lira University
Unit objectives
• By the end of this unit, learners should be able to:
• Explain the concept of data recovery
• Discuss the causes of computer data loss
• Explain the types of data recovery
What is data recovery?
• Data recovery is a process of retrieving deleted, inaccessible, lost,
corrupted, damaged, or formatted data from memory, removable media,
or files, when the data stored in them cannot be accessed in the usual
way.
▪ It is the process of salvaging lost, deleted, or inaccessible data from damaged,
failed, or corrupted storage mediums.

• Data recovery encompasses getting back files lost due to storage

corruption, user negligence, or an unexpected outage.
▪ It includes the process of “undeleting” files that a user may have erased
unintentionally by restoring their system formatting.
Data recovery…
• Data recovery is an essential aspect of computer forensics
▪ Plays a pivotal role in ensuring the retrieval of lost or damaged data from
various storage devices.

• Generally, the data is recovered from an off-site backup copy.

▪ The more current the backup version is, the better the data’s recoverability in
the case of loss or corruption.
Data loss
• Data loss is an incident where data is destroyed, deleted, corrupted,
or made unreadable by users and software applications.
▪ This results in some or all of the data elements becoming unusable by the
owner or its corresponding software application.
o The theft or loss of a device containing data is considered part of data
loss.

• Data can become lost either in storage, transmission, processing, or

within a network.

• A data loss incident can be intentional or accidental.

Causes of data loss?
• Theft – losing data through theft usually happens when a data storage
device such as a laptop is stolen.
• Natural calamities – a natural event resulting in data loss of data loss
▪ Floods, earthquakes, natural fires, lightning, etc.
• Logical errors in application software – such as errors in database
access.
• Sudden power failures – damage the hardware and operating system
resulting in data loss.
• Hardware malfunction – due to hardware impairment leading to
irretrievable data loss.
Causes of data loss…
• Computer malware – can infiltrate and damage data stored in hard
drives and company network systems.
• Legacy software with absent security patches
• Incompatible third-party plugins or apps
• Users’ negligence or accidental deletion of data or folders
Data loss due to human error
• Accidental deletion of data files – human mistakes can compromise
your data and expose you to risks.
• Misconfigurations – leading to vulnerability to data loss
• Malicious insider attack – leading to the loss or vulnerability
• Opening emails from unknown sources – opening way for attacks.
• Spillage of liquids – cause a short circuit, which can affect the
electronic parts of a computer, including storage devices.

❑Human error is seen as the primary cause of most data loss in

business.
Types of data recovery
• Broadly, data recovery is categorised into two types:
• Logical data recovery, and
• Physical data recovery.
Logical data recovery
• Logical data recovery is data recovery that is performed when the
storage medium is physically intact, but the data cannot be accessed
through normal methods.
▪ This occurs when a disc is still functional but some data has been lost.

• Techniques and tools used for logical data recovery include:

▪ File recovery programs
▪ Data carving techniques
▪ Filesystem repair tools
▪ RAID reconstruction tools
Physical data recovery
• Physical data recovery – is recovery needed when the storage medium
has suffered physical damage.
▪ Such as a broken hard disks or damaged flash storage.
• The data recovery process involves repairing or replacing the damaged
components.
▪ Such as reconstructing faulty firmware so that the data can read and transfer.

• The techniques and equipment used for physical data recovery include:
▪ Head stack assembly replacement
▪ PCB board replacement
▪ Platter swap and alignment
▪ Cleanroom data recovery services
Other specific types of recovery…
• Hard drive recovery – this data recovery method is perhaps the most
prevalent, and also the most complicated.
▪ This calls users to seek a hard disc recovery provider, and to regularly back up data.

• Optical recovery – method of recovey from CDs, DVDs, and other laser-
written optical storage media.
▪ This presents the best possibility of recovering lost data from optical media.

• Instant data recovery – of data recovery method used when data is lost
and the user is promptly directed to a backup server.
▪ The recovery can be completed in the background
Data Recovery Process
• The process may involve multiple steps, often requiring specialised
software and equipment, as well as expertise in handling the
damaged storage medium.
▪ Understanding the data recovery process is essential for choosing the right
approach and tools to restore your lost or inaccessible data.

• It is crucial to use safe data recovery methods to minimise the risks of

further data loss, corruption, or irreversible damage to the storage
medium.
Data Recovery process – steps
• The data recovery includes:
✓An initial assessment of the data loss situation and device
✓Determining the appropriate data recovery method
✓Preparing the necessary tools and environment
✓Performing the actual data recovery process
✓Verifying the recovered data and ensuring its integrity
✓Implementing measures to prevent future data loss
Something to keep you busy
• For three groups and in your groups, discuss the following:
1. Step/Phases in the data recovery process
2. Precautions to be taken in executing the data recovery process
Thank you