Data Recovery Advice

Do not

• DO NOT Reformat the drive.
• DO NOT Remove the ESD partition created by the Microsoft program.
• DO NOT Delete the files in the ESD partition.
• DO NOT Create new partitions in order to regain the user of the now-unallocated space
• DO NOT Attempt any in-place fixes like editing the partition table.

Do

• Scan the drive with GetDataBack or TestDisk.
• Select the appropriate candidate filesystem and parse it.
• Select the files and directories you want to recover.
• Save those files to a different drive.
• Read warnings of data erasure in the future, which may not necessarily be given by the program at the time of execution, but may instead be present in the documentation or instructions.

Clone Disks Before File Recovery

It would be a good idea to clone the drive at the sector level before doing anything else. This means with dd, ddrescue, hddsuperclone, or similar tool. Do not use a filesystem-aware process like Reflect, True Image, Ghost, or Clonezilla. You could use the HDD raw copy tool from hddguru.com under Windows, but it will not work correctly if the drive has any bad sectors. This isn't strictly necessary, but really is the best practice, as accidents happen.

The job of a technician tasked with recovering data from a heavily damaged disk is similar to that of a restoration expert working on an antique or historical document. The goal is to recover as much valuable information as possible while keeping the original source material intact. Likewise, data recovery technicians and antique restoration professionals share a best practice for achieving this objective: handle the delicate object as little as possible.

When your hard drive becomes corrupted or physically damaged, every action you perform on it can cause the loss of more data. Think of your hard drive like the original Declaration of Independence. It's important to study the contents of the document, but it doesn't make sense to roll out a 300+ year old piece of historical parchment onto your desk to do so. That's because every time you fold or unfold the document, you are degrading its integrity and destroying irrecoverable bits of history. Instead, it's just as prudent to make a copy of the document and study that.

It's the same with your hard drive. When there is a physical defect in your hard drive, say with the read/write arm, it usually means that each time you read or write to a sector, it destroys it. That means you only get one chance to recover the file. So, if you open the file to preview its contents and it becomes irrecoverably damaged thereafter, you've missed your opportunity.

You'd avoid this situation in the same way that you'd avoid damaging the original Declaration of Independence while studying it: make a duplicate. Creating a disk image is much less invasive than reading/writing to a disk normally, and you only have to do it once. Your first step when attempting to recover data from a damaged disk is to clone the disk. Then, you would perform your intensive data recovery operations on the disk image, rather than the original disk.

This has a number of benefits. First and foremost, you don't cause any further damage to the original hard disk. Cloning a disk performs damage control, putting an end to any further degradation or loss of data. Secondly, reading from a disk image is much faster than attempting to read from a faulty hard disk drive. Just like a vinyl record skips when it gets scratches, your computer will stumble when it encounters a bad sector on a hard disk drive. It'll attempt to read and re-read the sector multiple times before declaring it damaged and then moving on. Not only can this cause further damage to the drive, but depending on the size of your drive and the extent of the damage, it could take hours to go through the whole disk in this fashion. By creating an image, you only have to do this once. Lastly, disk images are more portable. Rather than physically removing the hard drive and attaching it to another computer, you can simply load the disk image onto a removable storage device or access it via a network connection.

Bottom-line: Your first step when recovering data from a damaged hard drive should always be to clone the disk. It'll save you time and increase your chances for successful data recovery.

What are Bad Sectors

Modern data storage devices generally store data within various sectors within the drive itself. Bad sectors occur when one of these sectors are damaged. Sectors can be damaged in a number of ways, including:

• Normal wear and tear across the lifespan of the device: Every electronic device or component has a normal life expectancy.
• Hard drive head crash: Numerous mechanical issues can result in bad sectors, but they're usually caused by sudden drive head crashes.
• Physical shock to the drive: Physical shock is generally caused by sudden and abrupt movement, such as dropping or throwing the device.
• Sudden and unexpected power outages: Power outages can cause other issues, too, so it's best to protect your equipment with an uninterruptable power supply (UPS). Intrusion of dust or other debris into the hard drive casing: Internal hard drive components are easily damaged by dust, dirt, and other debris.
• Flaws in the manufacturing process: Some drives experience flaws in the manufacturing process that lead to premature bad sectors. It's normal for modern hard drives to experience bad sectors throughout its normal lifespan. After all, every electronic device is susceptible to wear and tear over an extended period of time. When these bad sectors occur to a young or healthy drive, however, or if you're frequently experiencing new bad sectors, it's cause for concern.

Dealing with Bad Sectors

Bad sectors are a common cause of data loss in modern computing. If a sector containing information goes bad, that data will be lost. This is yet another reason why it's so important to backup your important data on a regular basis.

However, a bad sector doesn't necessarily mean the end of your hard drive. In fact, many bad sectors can be self-repaired using spare sectors that are contained within modern drives. However, the data that was contained within the original sector will still be lost.

In Microsoft Windows, for example, bad sectors can be repaired when checking a drive for errors. By checking the box "Automatically Fix File System Errors," the operating system will automatically attempt to repair any bad sectors it detects.

Some hard drive manufacturers also include built-in tools for diagnosing and repairing bad sectors. Consult the documentation that came with your hard drive for more information on accessing and using these tools.

Other times, a bad sector might be detected by the firmware of the disk controller. In this case, the data in the bad sector will be remapped to a different sector on the drive. When successful, this process happens transparently in the background. It also mitigates the data loss that occurs when a sector fails outright.

Avoiding Bad Sectors

Unfortunately, there are no tricks to avoiding bad sectors. While you can go to great lengths to minimize the risk of physical damage to your drive, every drive will experience a few bad sectors if it's used for a long enough time. Although some bad sectors can be automatically repaired via your OS, or manually by formatting your drive, this still results in data loss. Instead of trying to avoid bad sectors altogether, the best defense is a consistent and efficient data backup system.

You may read more about bad sectors in Wikipedia.

TestDisk, Data Recovery