When the damage is physical, the obvious way to recover the data is to fix the malfunctioning parts before the data could be recovered. Commonly in hard disk crash situation, when the problems happen to be components associated with internal servo-assembly, then the only way is to open the disk in a class 100 clean room environment for further fixing before data could be copied out.

Logical corruption resulting in data lost may be due to the combination of one of the followings:

1. Virus attack
2. Operating system fail to boot
3. Corrupted file system such as damaged partitions, boot-sectors etc
4. Inadvertent format/ fdisk command
5. Inadvertent deletion of data
6. Partial or complete overwriting of data
7. Corruption of factory firmware codes

To understand how the data could be recovered despite severe file system damages, one should probably use the analogy of how books are stored in a library system.

In a simple way, we can treat data file in computer disk in two essential parts, the file system information and the actual file contents.

The file system information of a data file contains information such as name of file, type of file, directory where the file belongs, storage locations of the actual file contents and other system properties specific to the particular data file.

The file contents normally will start with a file header (which is specific to the type of file application) followed by the actual data contents.

This is similar to how books are being stored in a library system. To look up a book (which is equivalent to a data file), one must first search the library catalogue information (equivalent to the file system information) before picking up the book in the physical shelf location (equivalent to the location of data contents). The book cover and table of contents of each book is equivalent to the file header.

In a normal delete process, the file system will be marked to indicate that the associated data is "deleted". This is equivalent to placing a mark on library catalog to reflect that the book is "not available". The actual book (or the data content) is not affected in anyway. So recovery in this case will be rather easy if we can find a way to "unmark" them.

In a normal format process, some essential file system information will be destroyed (the extend of damage depends on the type of operating systems being used). The actual file contents remain un-altered. Going back to the analogy of a book library system, destroying the book catalogue information certainly does not destroy books in the bookshelf.

Even in some conditions where file system is severely corrupted and data being partially overwritten, it is still possible to scan through the disk and extract files based on file headers. This is identical to physically search and walk through all the bookshelves and then locate the required book by its book cover or table of contents of each book.

In a situation when even the data contents is completely overwritten, then it is of course no longer possible to recover the data (i.e all the physical books on bookshelf are lost).

The actual recovery process is obviously more complicated and hopefully the above will simply explain the art of data recovery in a simple perspective.

For more information, you may visit us at Adroit Data Recovery Centre.D