When it Does Not Compute: A Look at Logical Data Recovery

Most data recovery laboratories tend to highlight cases that involved physical damage and needed repair in an environment free of dust and contaminants. These are great cases, because they are usually dramatic, have visual appeal, and they highlight an expensive investment for a data recovery lab – a clean room.

We like these stories too, but what we want to confront with this post is the “logical data recovery.” This is where the data can’t be accessed because some link in the chain of instructions a computer expects to follow is missing or unreadable.

Maybe you turn on your computer, and the drive sounds normal, but you can’t get past a blue screen. Maybe you plug in your external drive, the light comes on, it hums along as usual, but you no longer can access your files.

These are typical, though not certain, signs of logical recoveries.

The data on a hard drive has to be thoroughly organized for a computer to access it reliably.

Think of a library: it’s functional because it has a very methodical system for cataloging its contents and allowing a reader to logically determine where information lies. Electronic storage devices are even more reliant on a precise and complete organizational system that can direct a machine to an exact location.

A hard drive’s organizational structure typically starts at Sector 0 with a partition table, which is part of something called a Master Boot Record. The partition table shows the basic divisions within the hard drive.

True to its name, you can think of a partition as a boundary — one room within your hard drive.

If you haven’t done any partitioning of your hard drive, it’s likely it has one main partition with your operating system and all your files, and a backup partition with the original factory settings. These used to come on a set of DVDs; now manufacturers typically place this data on a restore partition.

But maybe you’ve partitioned your drive several times, and you have one partition that’s formatted differently to hold your old files from a Mac computer.

Whatever the case, these partitions are distinct. From a logical standpoint, they are almost like separate drives.

At the beginning of any partition is a boot sector. A boot sector gives directions within the boundaries of the partition. It doesn’t know anything about the world outside the partition, such as where the partition lives on the hard drive. If you picture reading a partition as entering a room, imagine the boot sector just inside the door, ready to guide you. It doesn’t know where the room is, but it knows the room itself; it can tell you to go 20 paces from the door to find a map of the information you seek. In real terms, the boot sector gives the location of the master file table, the root directory and the bitmap in relation to the boundaries of the partition.

Taking those new terms in order, the master file table is constantly changing with the data held on the partition. It is a record of all the file names and where they live. The master file table exists in chunks or segments; it’s usually scattered around the partition. And again, it changes each time you add, alter or delete a file. The root directory is the beginning of the structure you control to organize your files. You probably have noticed paths to get to your files. The first step of this path is the root directory. Thirdly, the bitmap tells your hard drive where data has been written and where there’s available space. It doesn’t tell what’s where, it simply shows what’s been used.

There are a lot of other things to explore and detail, but if this is your introduction to how data is organized on a hard drive, you deserve credit for getting through that. It’s enough, I hope, to illustrate some of the issues with logical data recoveries.

You can probably already guess how this relates to data recovery: when some of the information we discussed above is gone, your information is suddenly inaccessible. It could have happened due to unexpected shutdown, or the data being written over something important. Whatever the reason, perhaps there is no longer any partition table, so the hard drive doesn’t know how to find the boot sectors. Or the boot sectors themselves are blown away. The more of this meta data that is lost, the more interesting it is to try to find and make sense of the data written to the drive.

Now when you walk into the room, it’s dark. There is no guide to point you to the map of your information. You’re not even sure you’re in the room, to be honest. You pick up a note that says some useful information is 20 paces from the wall, but there’s no longer a wall. That’s the picture as the meta data of a hard drive vanishes.

Logical obstacles, such as those bad sectors and other data corruption, will sometimes make data recovery more difficult than those visually appealing and more popular mechanical repair cases. Mechanical repairs are only half of the data recovery process. After the drive is restored to a workable state, our engineers still have a critical task ahead of them. They have to retrieve the actual data from the failed device.

Here at Gillware, we have our own data recovery software platform to help retrieve this type of data to make your life and our engineers’ lives easier. If you are experiencing logical problems to your device, give us a call. We will be more than happy to consult with you and provide a free evaluation.