Greetings! I’ve had this idea for a blog post for a while and I’m finally getting around to actually writing it. Go me.
So, the day will inevitably come when you need to reach back to a backup and retrieve some data. A drive has failed, someone overwrote your documents, a natural disaster has claimed your location, whatever. Shortly after looking at your backup, your expression changes that to horror as you realize that either A) Your backups haven’t been working like you thought they were, or B) You never had them in the first place. Neither are good situations to be in. So what can you do? Well, first of all make sure this problem doesn’t happen.
CHECK YOUR BACKUPS!
Make it a part of your routine to check them <plug>or hire us at Simplex-IT to do it for you.</plug> Whatever you decide, just check them and avoid the frustrations, time loss and cost of your remaining options. Remaining options? You mean there’s hope? Well, the answer like so many other things is “it depends”. Here’s a brief run through of a few ways to recover data.
DON’T PANIC!
Douglas Adams never spoke truer words. Stop using the drive and execute your game plan for recovery. Even if that plan is “call your favorite IT support company” that’s a great place to start.
Check the Recycle Bin
If the victim was a file on your computer, check here first. You might have just deleted it and it’ll be sitting there waiting for you.
Check Windows Shadow Copies
Shadow Copies? Isn’t that something an anime character does? (I had to get the Naruto joke in there somehow). If you’re using Windows Vista, 7, Server 2008 or Server 2008 R2, you might be able to restore a file or folder on your computer by looking at previous versions of the object. These can also be enabled for network shares, talk to your network administrator if they have it enabled or not. To use it, right click the file or folder you overwrote/deleted and choose the “Previous Versions” tab. If you have any restore points they will be listed there. You can view them or do a restore from here.
The major downside to this is it isn’t always turned on by default and it will use up some system resources (hard drive space, processing power) depending on how long you want the previous versions stored. But generally speaking it doesn’t consume much so I would suggest enabling it on any system. The default settings work well, but you can tweak it as you see fit.
Stick the Drive in the Freezer
I’m serious. Depending on how a drive fails, freezing a drive overnight might allow it to operate long enough to pull the most critical data off. I’ve personally tried this about a dozen times and roughly half have succeeded. The technical explanation for why this is freezing causes physical parts of the drive to change shape, so in the case of a mechanical failure the changing shape might be enough to allow the drive to function. It’s crazy but it can work.
Undelete Tools
If the above didn’t help, there are tools available that will scour a drive looking for any bits and fragments of a file and attempt to reconstruct them. How can it do this? When you delete a file, Windows doesn’t delete the contents, it only delete references to it. A good analogy is think of your hard drive as a filing cabinet. Your data is like the files in it, and outside of the cabinet is a binder with the location of everything inside. Deleting a file is like crossing out the entry in the binder outside, the file is actually still in there, but any reference to it is gone. Undelete programs manually sift through the entire contents of the drive and will report back what it can or cannot retrieve. The problem here is that as Windows operates, it goes through and potentially overwrites the original data. The longer you wait to recover the higher chance you will lose the data.
If I had to list out the cons of any of the undelete programs, I would start at speed and reliability of recovery. Depending on the size of the drive, it could take days to scan. During that time you cannot use your computer less you compromise your reliability of anything it finds. The programs generally aren’t expensive, but depending on how thorough it scans, how it scans and a host of other options, the programs can be a little as free, and go up into the thousands of dollars. In my opinion you get what you pay for. I’ve personally used several pieces of software to do this and I’ve had good luck on simple recoveries. I recently had a family member’s computer hard drive catastrophically fail and lose hundreds of family pictures. The family member also had recently deleted the pictures from their camera, but I was able to go through and extract almost 800 deleted pictures from the memory card with no corruption on the photos.
Data Recovery Services
If nothing else has worked, this is your last resort. In this scenario, you package up your drive and ship it someplace for them to peel the drive apart (both logically and/or physically) and extract everything they can. Most places charge a fee to even look at a drive, and then depending on how it has failed the costs add up, quickly. A simple FAT corruption could be a few hundred dollars to recover, whereas a head crash or firmware corruption might be several thousand dollars to recover. It boils down to how bad you want your data. I’ve worked with a few of these places throughout my career and have had good success with them. They aren’t cheap, but your chances of recovery are much higher here than any other solution.
I can’t stress how important it is to test you backups regularly and not have to do anything that I just ran through. Outside of the inconvenience of it all, depending on the data for your business there might be legal issues involved with being unable to reproduce old records.
I think I’ve rambled on enough. If there are any questions or comments feel free to contact me at kevin@simplex-it.com
And if I didn’t mention it already, CHECK AND VALIDATE YOUR BACKUPS! Just hearing a tape spin up or job marked “successful” isn’t enough. Verify contents and test them regularly.
