Recovering data from deleted files...

Human error accounts for a significant amount of lost data on hard drives and even on the most complex RAID data storage systems installed on sophisticated servers. The most simplest error is the deleted file where the operator accidentally removes an important file. They may inadvertently clear out numerous files in one click to gain more storage space, only to find at a later date that they have lost some important files.

Files can be deleted or the data corrupted by inadvertently switching off the power to the computer without going through the shut down procedure. The computer could be immobilized by a general power failure, which the user has no control over. In these instances it depends on the exact function the computer is undertaking at the point of power failure as to whether data is lost. It may be just the file that it was working on that is lost, or the entire data base can be corrupted.

The most important factor in recovering data from a deleted file is that once the failure is recognized, the user should not write any further files or use the computer in any other way. A deleted file is not deleted from the hard drive. It may be inaccessible but it is still written on the hard drive. Any further use of the computer may over-write the deleted file which will make it permanently inaccessible even to specialist data recovery professionals.

Although RAID systems are supposed to be immune from lost data, this is not true. Within a RAID system the data is mirrored over a number of hard disk drives so if one drive fails the data on it is automatically copied to other drives and can be rebuilt automatically in a failure situation. The RAID system should therefore continue to work even if one or more drives fail. Often though, a hard drive fails but no action is taken to replace the failed drive. If subsequent drives fail there may be not enough data stored to ensure a satisfactory rebuild. In this case the RAID system fails to operate and all the data becomes inaccessible.

Recently we were presented with a RAID array whereby a disgruntled employees had physical cut through contacts on the PCB's of all hard drives in the system in order to cause the most disruption to their employer. This had been undertaken in such a way that it was not obvious what the cause of the failure was. They were not aware that the data was recoverable by specialist RAID data recovery companies. The offender was identified and subsequently was the subject of a criminal prosecution.

In order to minimize permanent data loss due to deletion it is important that some form of data back up is undertaken. This can take one of many forms from external storage devices including hard drives, USB sticks, tape drives and DVD drives. The data may also be uploaded to the cloud. Whichever method is preferred, it is important not only to regularly back up the data but also to verify it. Trial restorations will ensure it is still accessible and not corrupted. A most common cry is that “I backed up my data regularly but when I came to reload it after a failure the backed up data was inaccessible”.

If data is lost for any reason all is not lost. Specialist data recovery companies are able to recover the data with a high degree of success. Once data has been lost immediately stop using the storage device and seek professional help.