Corrupt File System
There are occasions when a complete data recovery that maintains the
original file structure is not possible. Severe file system corruption will
usually result in the directory structure being lost, and even file names
and modification dates are lost. When this occurs, the data may or may not
be recoverable. It depends on whether there has been any significant file
fragmentation.
When severe corruption of the file system occurs, we will generally use a
method of recovery called "carving". File carving is the process of
reassembling computer files from fragments in the absence of
file system metadata.
File carving can be used to recover data from a hard disk where the
metadata is missing or damaged.
When a file is deleted, only the entry in the file system metadata is
removed, while the actual data is still on the disk. After a format and even
a repartitioning it might be that most of raw data is untouched and can be
recovered using file carving.
This involves doing a full scan of the drive, and pulling out files based
on their header information. Each file type has a specific header associated
with it. We simply use a database of known headers, and then search for
those types of files throughout the raw data.
After we have carved out the data, it will be organized by file type.
Let's say our customer only needed Microsoft Word documents, we would
organize the data in a folder title "Microsoft Word", and the files within
the folder would be numbered 01.docx, 02.docx, 03.docx, etc . As you can
see, the original file information such as the file name, along with the
last modification date would be lost. However, the contents of the file,
will still be intact.
Having to use this method of recovery is not the norm, and it is very
rare that it becomes a necessity. It just helps customers who may be
desperate to get their data back, and know the file type, and will be happy
just getting it back in whatever format possible.
WE CURE WHERE OTHERS START PRAYING BECAUSE WE BELIEVE
IN OURSELVES
