Basics of Data Recovery

Roy Schestowitz

University of Manchester

Overview

• Progressive data backup
  • secondary computer
  • network drive
  • web-based accounts
• Restoring lost data
• Data disposal

Key Points

• Prevention better than the cure
• Backup data, think pessimistically
• Choose good hard-drive manufacturer, avoid cheap hard-drives
  • names to look out for: Seagate, Maxtor, Hitachi (IBM), Toshiba, Western Digital...
  • gentle care of hardware, e.g. laptop jitters, humidity

Restoring Accidentally-Deleted Data

• The first 'safety net'
• Use trash can (wastebasket), empty it infrequently
• Alternatively, use undeletion programs
  • historically this was more successful
  • security/privacy issues involved
  • tools exist for a variety of platforms including Windows
• Do not defrag hard-drive too regularly

Remote Backups

• Hard-drive crashes are more endemic than commonly assumed
• Delegate responsibility for data integrity to someone else
  • take advantage of storage area network (SAN)
  • managed reliably and backed-up overnight
  • put copies on another server if available

Remote Backups - Continued

• Mirror (copy entirely) all content periodically
• Establish data redundancy
  • duplicate hard-drive content fully
  • possibly just important files or recent changes (differences)
• Avoid disaster
  • assume that the hard-drive may be wiped by the end of the day
  • take measures to prevent it
  • protect the data, not the hard-drive (or media)
  • provides peace of mind, no catastrophic losses

Remote Backup Examples

• New data to be duplicated and placed somewhere else
  • Remote location is a must (not the same home)
  • For example, desk at work and desk at home
  • Consider cases of floods, fire, theft, etc.
• Use Internet to transfer data to a remote location
  • One possibility is an FTP server
  • Server provided by the University (also referred to as "P drive")
  • Compress new files and send by E-mail so that data sits on Webspace

Remote Backups - Summary

• Stories of data loss disasters are endless
• Users whose data archives go as far back as the last hard-drive crash
• Key message: a few minutes of work invested will prevent potential loss of days/weeks/months of work

Restoration Before Collapse

• Bad sectors can affect data or break the operating system
• The computer may not boot up properly
• Bad sectors - characterised by error messages that recur
• Surface test (Windows: 'full' mode in scandisk, Mac/Linux: check gets forced)
• If bad sectors (physical misperfections) found, backup data fully ASAP
• Errors tend to 'spread' due to degradation of the pin (head) and/or shift of data from one sector to another

Last Resort: Resurrecting Data

• Physical damage or mechanical failure
• If data is lost, professionals can fetch it
• Extremely expensive and not always fruitful
• Repair of isolated segments of the hard-drive
• Typically incomplete restoration

Last Resort: Resurrecting Data - Ctd.

• Magnetic storage device are sensitive
• Keep in dry environment without dust
• On average, the lifetime of a hard-drive would be a few years
  • some would die completely and unexpectedly
  • others may develop bad sectors first
• Consider hard-drive replacement and disposal

Disposing of Data

• Must be very cautious when selling a computer

Disposing of Data - Ctd.

• Formatting fallacies
• Shallow format/deep format (very slow)
• Applies to all types of magnetic storage (media) e.g. floppy disks, backup tapes, etc.
• Never sell hard-drive with data to a stranger
• Exceptions:
  • sold to a trusted friend/colleague
  • Windows: professional software was used in formatting
  • Linux: custom, hand-made commands

Stories of Failure

• Case study:
  • patient data reached the wrong hands
  • governmental data leaked to the Internet

Stories of Failure - Ctd.

• Sometimes better to physically destroy a hard-drive than sell it
• Destruction of magnetic storage is tricky
• Safer when hard-drive gets 'buried' in a drawer
• Avoid indifference or deceit

Take Home Messages

• Always duplicate data
• Be alert and react to 'warning signs'
• Remember that data can be resurrected partially
• Formatting does not fully eliminate data