Surviving a home data disaster: How Shirley got her files back

Computerworld - Shirley didn't know that 736 digital images -- all of the photographs she had taken in the three years since her children bought her a digital camera -- had disappeared from her Dell Dimension PC. All she knew was that she couldn't print them anymore.

I was the one who got the call -- and who had to break the bad news. The thumbnail images still showed up in her Kodak EasyShare program, but my heart sank as I followed the path linking the thumbnails to the source files. The original image files and the folder containing them had disappeared. Only the tiny thumbnail images remained as ghostly reminders of lost memories.

This is the story of my attempts to recover Shirley's files. It's a story that I followed to its ultimate conclusion -- from the initial inspection of the Windows Recycle Bin to attempted recovery with various utility programs and finally to a stint with a professional data recovery service.

When I began, I was confident that I knew what I was doing. I didn't. My experience should give you a good idea of what you'd face in a similar situation -- as well as a behind-the-scenes look at the tools and techniques a recovery expert used to recover Shirley's files. Along the way, you'll also find tips on what you can do to prevent problems in the first place and ensure the best possible outcome when -- not if -- a data recovery problem crops up on your machine.

Yes, it could happen to you. Even if you're one of the few home office users who back up their computers properly, file system corruption, drive failure or accidentally deleted files can still put you in a tight spot -- particularly if you reuse your backup media and don't notice the problem until after you've overwritten those damaged or missing files with more recent backups.

Surviving a home data disaster Getting started Finding lost files What not to do Do-it-yourself recovery steps Free options Moving to the next level Going to the pros Initial setup The results Going for broke The final tally

Getting started

I got the first step right. As soon as I realized that files had been compromised I immediately turned the machine off, unplugged it and told everyone not to use it. Then I brought it home with me for further work. So far, so good.

Files that have been accidentally deleted can be restored using disk recovery tools, so long as no other program has overwritten the areas of the disk where the deleted files' data was stored. By quarantining the computer, I had ensured that someone wouldn't come along and save new documents or install new software on it, potentially overwriting the files Shirley wanted to recover.

But had this happened already? How long the digital photographs had been missing and whether any of the space used by those deleted files had since been overwritten was anyone's guess.

		Tip:  Once you realize that you have a data loss problem, turn the computer off immediately to prevent further damage.

This was particularly critical in this case, since the number of files affected was quite large and the lost files were compressed JPEG images, which present unique recovery issues. To understand why requires a brief detour into how a PC stores and manages files.

Finding lost files
Files on a hard disk are stored in discrete "chunks" called clusters, which may reside within or across specific regions of the disk called sectors. Those clusters may be contiguous, or they may be scattered across many sectors -- for example, the 78 million sectors that comprise Shirley's 34GB disk volume. (A sector is the format by which the hard drive itself physically organizes data on the disk drive. Each sector can hold 512 bytes of data. The Windows NT File System, or NTFS, used by Windows XP groups sectors into logical clusters, or blocks, as the primary allocation unit.)

The file system creates a file record that points to the locations on the disk where all of the fragments that belong to a given file name reside and identifies the order in which to properly reassemble them. If a utility program or recovery professional can find the record of the deleted file and none of the data it points to has been overwritten, then recovery should not be a problem. But if that file record is unavailable and the data is not contiguous on the disk, it can be difficult or even impossible to completely reassemble the original file in the proper order.

At one time there was a chance of resurrecting data from an overwritten area. Not anymore. "There is no chance of recovery with overwritten clusters. The bit density on hard disk drives is so great now that when the magnetics are rewritten, the data is gone," Barry says.

If the file record has been overwritten or has been damaged but the data is undamaged and unfragmented, a file recovery utility should be able to find and recover it. Every file type -- Word document, JPEG image, etc. -- has a different "signature" that indicates the beginning of the file on disk. The utility searches all of the unallocated space on the disk, sector by sector, for file headers that match the desired signature. The program then captures the data in each subsequent sector until another signature is found -- or until an arbitrary limit is reached. The user can then review the files that are recovered to find the desired file.

If the file record is unavailable and some data is damaged, you may still be able to recover some types of files with a signature search. If you regularly defragmented the hard disk drive before the deletion occurred, your chances of recovery are greater. "Personally, I defrag my hard drive every single night," Barry says, but he admits that he's very cautious after working with other people's disasters all day. Most of his colleagues defragment their disks about once a week, he says.