winhex zip opened

File System Corruption & Deleted Data

Data loss can be independent of physical or electronic failure of a device. Instead, data loss can occur when the filesystem becomes corrupt, a drive is accidentally formated, or data is deleted.

When does this sort of failure occur?

Deleted data is typically a result of accidental user error. We normally see data loss as a result of a ‘format’ command, or the use of the ‘factory restore’ function which is embedded in many OEM computers. In the case of the latter, it will result in a fresh version of the operating system being installed over the top of the existing data. We also receive storage devices where individuals have deliberately tried to destroy the data. In these cases, we do offer investigative/forensic data recovery for organisations.

What should be done?

Turn the computer off and do not use the hard disk drive, memory stick, SSD  or other storage device where the data has been lost from. Turning the device on and using it can lead to new data being written to the storage device. Data can often be recovered so long as it has not been overwritten with new data.

Once new data has been written to the disk it is impossible to undo, and will lead to permanent data loss. When we receive an HDD, SSD or memory stick for recovery a full clone of the entire device is taken. This allows us to work safely on the device without running the risk of making matters worse.

What we can do that PC Shops cannot

Understanding how files are constructed is critical to the recovery of data which has been deleted, or where a filesystem is

corrupt. Frequently we get told that a PC Shop has run data recovery software and it has recovered files but they are corrupt. We can do a lot more. Why? Because we have a comprehensive understanding of how filesystems work, including:

  • Windows PC – NTFS
  • Apple Mac – HFS+
  • Mass storage filesystems – FAT16, FAT32, exFAT
  • Linux variants – Ext 2/3/4, XFS, ReiserFS
  • Virtual filesystems – VMFS, EFS
winhex zip opened

NTFS filesystem loaded, viewing a .ZIP files, with an intact file header

Experienced staff can use powerful software to improve results. CDR has the ability to search for data independently of folder and file structures and to identify unusual file types.  When filesystems are severely corrupt it can be possible to identify the critical data by search term within the raw data and then ‘carve out’ a working file.

On most occasions, CDR will attempt to rebuild index which creates the folder and file structure. These indexes have different names depending on which filesystem your storage device you are using. They include the ‘master file table (NTFS), the ‘catalog’ (HFS+), the ‘file allocation table’ (FAT) and the ‘index-node’ (Ext / XFS). Being able to successfully recreate these allows the best chance of a successful recovery.

Database rebuilds

Moreover, CDR can repair corrupt files, including Outlook .PST, Exchange databases (.EDB, .STM), all office files (.DOC, .DOCX, .XLS, .XLSX, .PPT, .PPTX etc.), accountancy files (Sage) and other database files (Access .MDB, SQL .MDF, .LDF).

If your IT support company or PC shop have told you that the data cannot be recovered please contact us. We are confident that we can improve the results of any previous recovery attempts; if we cannot improve the results, then there are no charges for the work conducted.