Corrupt Data Recovery

The impact of data corruption can vary significantly depending on the type and cause of the corruption. Individual files and entire data arrays can be affected by this problem. Data can become corrupt when files or data objects become damaged and unreadable. Data corruption is comparable to tearing the pages out of a book; if you tear out enough pages, or even just one important page, the book stops making sense. Gillware Data Recovery offers financially risk-free corrupt data recovery services if you have lost critical data to corruption.

What is data corruption?

Data corruption of digital assets is when data objects become inaccessible, unreadable, illegible or produce unexpected results to a computer operating system or device. Users, applications and databases will not be able to read, write, store or transmit the data object or files, resulting in a loss of data integrity.

In a real-world scenario, this might be a corrupt file system or missing documents and folders on a file server. The impact of data corruption will vary from causing a nuisance to a potential system-wide outage to business-critical production systems. Some applications may be able to attempt to automatically repair the corruption, but whether this process will be successful depends on the level of corruption depends on the level of corruption.

As always, if you are concerned about mission critical production data corruption, please ensure you send it to Gillware as soon as possible. Any unnecessary reads, writes or attempts to recover the data will likely have a detrimental effect on the data objects integrity.

What can cause data corruption?

Data corruption can be caused by several reasons. Some of the most common causes relate to ungraceful shutdowns of infrastructure or unexpected system outages, either of which might be caused by a major incident or infrastructure disaster.

Server and storage components commonly start to cause technical challenges if power is cut inexplicably or unexpectedly. Enterprise and business servers are designed to be functioning at all times; if you need to power down devices, this should be done in a graceful, controlled manner to prevent data loss.

Servers need to finish running active processes when being shut down, and storage arrays need to write the data cache stored in volatile memory back to disk. Killing power prevents these clean-up tasks from being completed, which can result in data corruption.

Some of the most common reasons might be:

• Power failure – data corruption caused by unexpected power outages
• Power fluctuation issues – data corruption caused by irregular power being fed to a device; this could be a faulty UPS power bank or fluctuations on the nation power grid
• Disk failure or block level corruption – data corruption caused by hardware faults
• Associated hardware failure or firmware errors resulting in corrupted data
• Ungraceful shutdowns – such as shutdowns caused by unexpected power outages or forced hardware resets
• Failure to eject external hard drives gracefully and related storage devices before disconnecting them or powering them off
• Legacy or aging out-of-support hardware

Types of data corruption

Most commonly, data corruption is the result of either media issues or logical corruption of the file system. There are several scenarios which may cause this:

• A physical problem on the disk – this is typically an internal hardware issue or failing component on a disk which usually results in the disk “clicking” or giving off an audible alarm could be the cause of data corruption. Common examples include faults on the disk platters or the head mechanisms.
• An electronics problem on the disk – this might be a broken SATA/USB connection or a burnt-out PCB (printed circuit board). The problem might even be a failed RAID controller card. The most common symptom of this type of data corruption would be silence when the disk is powered on, as if the disk were dead.
• A firmware problem on the media – diagnostics tools are required to investigate this issue. These tools can attempt to read the firmware or bypass it if issues occur. In complex issues, the firmware may need to be re-written to recover the corrupted data.
• Logical corruption on the disk – this is arguably the most common scenario and is caused by a software issue, such as an index on the disk pointing to incorrect data. This can be fixed using one of several software utilities which directly scan the file system to give a holistic view of all the disk data that is recoverable.

Read instability –  this problem occurs when there is no knocking or clicking of the drive, but the disk often “hangs” the operating system when attempting to access the corrupted data. This is often the first stage of disk failure and may require specialist hardware to fix.

How does data become corrupt?

Our data recovery experts here at Gillware believe the data corruption scenarios discussed above can be simplified into two classifications. We refer to them as Soft Corruption and Hard Corruption.

Soft Corruption

Soft Corruption is what we refer to as a corruption that manifests itself as a symptom of an overriding problem, and fixing the overriding problem will likely to resolve the corruption issue in its entirety.

Consider a hard drive that has a failing read/write head. This problem is often associated with clicking or beeping noises from the disk drive. There are multiple read/write heads inside a disk headstack, and in such a scenario, it is unlikely every single head has failed; however, data corruption is discovered due to bad disk sectors, likely caused by the faulty head’s inability to read data altogether, as the data it reads might span multiple physical disk platters.

This scenario can be resolved by fixing the faulty read/write head, which will in turn fix the bad sector corruption, which was a symptom of the original hardware fault. Once the drive has been sent to the Gillware’s data recovery lab, the disk can be stripped down in a clean and sterile environment, and the headstack or faulty read/write head can be replaced. It’s important to maintain a perfectly clean environment when opening up a disk to ensure no foreign particles get inside the disk platters, potentially causing further damage.

Upon resolving the issue, the expectation is that all the disk data will be readable and recoverable. We would recommend that a customer consider replacing this disk immediately once the data is recovered, as failed read/write heads are usually a symptom that a drive that is on its way out completely. If you delay in reaching out to a data recovery specialist you may end up with a disastrous USB device not recognized or device not detected error.

Soft Corruption might also be recognized within a RAID storage array if the storage is not managed and maintained correctly. Take for example a RAID 5 configuration: RAID 5 uses disk striping, where data is split up over a number of physical disks, and parity data blocks are all split over each disk as well. This results in the ability for the RAID array to rebuild itself using the parity blocks in the event of a disk failure, resulting in no data loss.

However, if your RAID storage array experiences a disk failure which goes unnoticed, followed by another disk failure, the whole array can fail. Data can be put at risk if disks are replaced in the wrong order, which can result in ineligible parity data being written to the entire array, further resulting in masses of data corruption.

This scenario demonstrates soft corruption where data corruption is not the cause of the problem, but instead is a symptom of the failure of multiple disks. Gillware engineers can still repair issues such as these by reconstructing data off the original failed disks.

Hard Corruption

At Gillware, we also classify certain data corruption scenarios as hard corruption. Hard corruption occurs when file or data objects are known to be corrupt as a result of a root cause. However, fixing the root cause will not fix the corruption, as the corruption itself must be targeted for fixing.

Take, for example, a hard drive with damage to its magnetic data storage platters. The magnetic coating on its platters stores all of the data on the disk. If parts of that coating are damaged, those sectors may be gone forever. Sectors can go bad as a result of old age, and even if the heads are fine, the bad sectors will still be lost. Data that is stored on bad sectors can become corrupted at source and is likely to be completely non-functional.

This type of corruption is regularly seen when power to a system is lost or when there is an unexpected shutdown. When an application terminates unexpected, it is a possibility that some of the critical data is not flushed to disk quick enough and the result is incomplete data objects. When power is restored to the system, this may manifest itself in a server that fails to boot, errors such as “operating system not found,” or it might be garbled information within your data files.

Again, Gillware can fix the vast majority of these hard corruption issues by reconstructing the data in our controlled engineering labs.

Methods of verifying integrity of data

First, you need to decide as to whether you can afford to lose the data; is the data mission critical such that its loss would impact you significantly? If the answer is yes, then the best recommendation is to switch off the device or computer and send the data to Gillware’s expert recovery engineers for investigation and data recovery.

Whenever you work on a problematic data object, there is a real chance that your investigations might damage or corrupt the data even more. This is because the disk will continue to perform read/write executions upon the disk platters, potentially making the problem worse.

If you are not too concerned about recovering the data, or if you have a verified backup, it might be possible for you to run a diagnostics application which can determine if the problem is data corruption or a disk level fault. Software diagnostics applications can only identify logical errors on datasets, and many provide recovery tools which can attempt to recover logical data.

A word of caution: there are many such tools online, but often you will be asked to purchase the application prior to running any type of verification, and there is no guarantee the software will be able to fix the corruption.

Gillware’s expert data recovery engineers can do far more than even the best diagnostics software. If there is an underlying hardware issue, we can often repair the damage and recover the underlying data. If we cannot recover 100% of the data, we can often repair the drive, regenerating missing or corrupted data using parity blocks to correct the logical damage and rebuild the corrupted data, recovering as much as possible.