Data Recovery
Data recovery is the process of retrieving data that has been lost, corrupted, accidentally deleted, or made inaccessible. It covers recovery techniques for different failure scenarios, from restoring backups to salvaging data from damaged media.
itStorage, backup, and data protection | OpenSkills.info
Intro
Data Recovery
Data recovery is the controlled attempt to regain data that you can no longer access normally. The cause may be accidental deletion, file-system damage, failing media, a lost application record, or a larger incident.
The first recovery decision often matters more than the tool you choose. Continued use can overwrite deleted data. Repair attempts can change a damaged file system. Repeated reads can place more stress on failing hardware.
Your first job is therefore preservation. Stop avoidable writes, identify what happened, and choose the least destructive recovery path.
What recovery can mean
Several tasks share the word recovery, but they start from different evidence:
- Restore from a backup: copy known data from an earlier recovery point.
- Recover a deleted file: use remaining file-system metadata or file content that has not been overwritten.
- Recover from logical damage: extract data when partitions, directories, or file-system structures are inconsistent.
- Rescue readable sectors: copy as much as possible from media that returns read errors.
- Recover application records: inspect an application's internal format for deleted or older records.
- Reconstruct a system: restore data, configuration, identity, and dependencies until a service works again.
A backup restore is usually the safest path. It reads a copy created before the loss instead of experimenting on the affected media. Recovery tools become relevant when no suitable backup exists or when the backup is incomplete.
A simple mental model
Think in three layers:
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8354.pdf
Supports
- Metadata-based deleted-file recovery, file carving, and deleted-record recovery
- Deleted data may remain until its storage is overwritten or allocated to another object
- Partial overwrite can produce incomplete or mixed recovered content
- File-system metadata differences affect recovery outcomes
- Solid-state drives may replace TRIM-released blocks with blocks that read as zeros
- Recovery tools can differ in what they return at edge cases
- https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf
Supports
- Difference between logical backup and bit-stream imaging
- Bit-stream images include free space and slack space
- Analysis on copied media to avoid modifying the original
- Device identification, acquisition documentation, hashes, and chain of custody
- Master and working copies for repeatable analysis
- https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html
Supports
- Readable-area-first rescue from drives with read errors
- Mapfiles for efficient interruption, resume, and selective retries
- Avoiding rescue from a read-write mounted partition
- Avoiding file-system repair on a drive with input and output errors
- Repairing a copy while retaining a master copy
- Risk from destination selection and changing device names
- https://support.microsoft.com/en-US/Windows/Experience/Backup-Recovery/windows-file-recovery
Supports
- Minimizing computer use after deletion because released space may be overwritten
- Separate source and destination drives
- Local-storage recovery scope
- Regular and Extensive modes with path and file filters
- Reduced recovery prospects after overwrite, especially on solid-state drives
- https://csrc.nist.gov/pubs/other/2020/04/24/protecting-data-from-ransomware-and-other-data-los/final
Supports
- Backups as copies made to facilitate recovery
- Planning, conducting, maintaining, protecting, and testing backups
- Backup preparation for hardware failure, ransomware, and accidental or intentional destruction
- Testing whether backup files remain useful and available when needed
- https://csrc.nist.gov/pubs/sp/800/88/r2/final
Supports
- Media sanitization as rendering target data unrecoverable by logical and state-of-the-art laboratory techniques
- Clear, purge, and destroy as distinct sanitization methods
- Sanitization as a different objective from recovery after ordinary loss