Data Recovery: There’s Always Hope

In an ideal scenario, an enterprise's data is always appropriately backed up and ready for recovery. Then, if an unforeseen event (e.g., inadvertently deleted data, a power outage, a disk crash) occurs, the company doesn't face a crisis. Unfortunately, most of us don't live in an ideal world: When it comes to backup, many companies don't follow best practices and face nasty surprises when they try to restore their data after disaster strikes.

Too frequently, when companies attempt to restore data after a system crash or major human error, they discover that despite the policies they've implemented, they haven't backed up data on a systematic schedule, or they've been backing up an empty directory, or they've been trying to back up an open file and the backup procedure failed. In one well-known example, an insurance company tried to restore data after a system crash and found that no data whatsoever had been backed up for 14 months because a tape had jammed and nobody noticed.

Bill Margeson, president of CBL Data Recovery Technologies, told me that in his experience, the longer a company has had a backup program in place, the more likely it is that systems aren't backing up as expected. He said that when his company begins a project, frequently, no one remembers how to log on to the backup system.

But even a massive disk crash with no backup doesn't mean that all data and hope are lost. Since the mid-1990s, many companies have emerged that specialize in supporting organizations experiencing a data-loss crisis. Kroll Ontrack is probably the largest of these businesses, and a dozen more companies dominate what Margeson estimates to be an approximately $150 million market.

Data recovery in crisis situations exists in two forms--software recovery and hardware recovery. Software recovery is often the less complicated of the two. If your OS has become corrupted, the data is still on your hard disk, but the paths to access your data have been obliterated. Simply reinstalling the OS might not help because, as Margeson put it, reinstalling an OS is like retracing your steps in the snow--subsequent steps aren't in the same places that the initial steps were in. For example, data can be overwritten and connections lost. In this situation, software tools such as Symantec's Norton Disk Editor can work with data at the hexadecimal level. A skilled technician can plow through a disk and identify and reconstitute a Exchange database, for example. Although such tools are widely available, not every IT shop has professionals with the appropriate skill set to perform such software operations.

Hardware recovery can be more stressful for an IT professional. If, when your system crashes, you reboot your disk and hear a repeated clicking sound, you might be suffering from "head slapping." The drive's electronics still work, but the read/write operation is slapping the platter. In this situation, not only is the read/write head damaged but the servo code on the platter, which orients the head, can be wiped away. With each slap, additional data might be destroyed. But even hardware problems don't have to be total disasters. Data recovery specialists can replace head assemblies and recover much of the data. Some data, however, is typically lost.

So what should an administrator do when confronted with a failed system and no backup? The first step is to listen. If the drive is clicking, the problem most likely lies in the read/write head. You might only exacerbate the problem by continually rebooting the drive.

If the drive isn't clicking, install the drive into another platform as a slave. In many cases, the drive will successfully boot, and you can transfer data to a new disk. The imperative here is that you need to actually transfer the data and not let yourself believe that the drive has miraculously fixed itself.

If you can't reboot the drive, you probably need to send it to a lab-based service to determine whether the lab can recover data. But even in the worst of circumstances, data is probably still on the disk and you can recover at least some of it with the right approaches.