Unrecoverable Data
What is unrecoverable data?
This blog post will examine the depressing side of data recovery, namely unrecoverable media or data.
Let’s look at them in turn one by one.
Unrecoverable media such as hard disks, drives, or any storage device which holds electronic data, this situation would where the whole device is completely inaccessible in any way, here are a few scenarios that may cause this;
- Dropped or knocked hard drive, especially while it is powered up
- Water / liquid damage
- Fire damage
- SA damage to firmware modules
- Head crash after power failure
Check out the scoring to this 3.5″ WD hard drive, it has been left running by the user despite it making a clicking noise, it was unrecoverable.
Of course you must understand that not all cases that fall into this range are completely unrecoverable, in fact our labs do recover from such failures, but this is not always the case.
The 4th item on the list is SA damage to firmware modules along with servo field destruction would cause a HDD to become totally unrecoverable, as this information is vital for translation tables and mapping bad sectors among other vital areas for HDD operation.
The second point is unrecoverable data, this can be clarified as a HDD which is operable, however the data that you require, lets say .pst file from outlook express cannot be recovered, why would this be? What would cause this?
In an example the pst file may be 1GB is size, this would equate 2000,000 LBA, which would be ‘scattered’ around the disk, if now the hard drive has suffered media degradation the user will not be able to reach those sectors, this is where our services come into play, our tools would then try an ‘ECC’ or error correcting code in an attempt to read degraded sectors, if this fails even following multiple reads and all ECC techniques the sector and data will be declared unrecoverable.
Further to degraded media is the well known overwritten data scenario, in this example Alice sends Bob a very important document, Alice then overwrites this file intentionally or otherwise either with another file or a secure deletion application, if the new data is written to exact LBA co-ordinates that the original file occupied, it truly has been overwritten and will be declared unrecoverable.
This situation is not the same as deleting a file, as this will not necessarily make the file unrecoverable.
This is sector 0 of a working HDD, fully functional & readable.
Some situations are completely unrecoverable to anyone or lab on the planet, no matter how persuasive they may be, however please remember though that all labs are not equal, what may be declared unrecoverable by one DR lab may actually be recoverable, if you have been told that why not have a second opinion by ourselves?
