Safeguard your Data

We often don’t realize the value of data until disaster strikes. Understanding the causes of data loss can help prevent it. Plus, it’s equally important to know what to do after data is lost. Chances are that you can still retrieve it

Wednesday, July 09, 2003

One of the most common causes of data loss is human error. After all, “to err is human”, and most of us would have lost important data at one time or the other by accidentally pressing delete. What usually follows is a frenzied scrambling for a solution to recover the lost data. The point is, why not take proper precautions to prevent this scrambling in the first place? As they say, “Prevention is better than cure”. Sadly, we often don’t realize the value of our data until we’ve lost it.

We’re not implying that human error is the only way of losing data. There are many other reasons as well, which we’ll soon get into, and it’s important to know ways and means of preventing them from happening. Of course once you’ve lost data (God forbid!), it’s equally important to know what to do. Doing things blindly can make things even worse.

Safeguarding data can therefore be divided into two parts—one is preventing data loss from happening in the first place, and two—recovering data once it’s been lost. In both cases, there are some things you can do yourself, and others which only software can do. We’ve looked at both in this story.

Causes and prevention
Besides human error, other major causes of data loss are virus attack, physical failures like a hard drive crash or bad media, system faults like an application going unsteady or the OS developing a fault, and user negligence.

In a hard drive crash, there are two possibilities. Either it’s a physical crash, or a logical one. A physical crash is one in which the hard drive itself gets physically damaged.

Bad sectors are the most commonly known example of a physical crash. There’s no way to cure bad sectors, but there are utilities that can mark these sectors as bad and pull out whatever data is stored in them and move it to another location on the hard drive. This is something that any user can do, because there are commonly available utilities for the same.

Norton Utilities is a classic example of such utilities, which has been used for ages for this among other things. In some cases, the hard drive stops getting detected by the system altogether, which can be due to a problem in the circuitry or the headgear assembly inside. This is something that a user can’t rectify on his own. It requires going to an expert, who will open the drive and do the needful. In most cases, it wouldn’t be possible to fix the hard drive, only recover the data somehow and move it to another location.

Most hard drives provide a MTBF (mean time between failures) rating that’s enough for it to last for several years. While failures are unpredictable and can happen, the best you can do is to maintain the hard drive properly.

If at home, ensure that you have a UPS in place, which can protect your system from the most basic power problems such as power cuts, surges, spikes, and sags. Any of these problems if allowed to pass through can cause a PC to reboot, and even damage the hard drive in the process.

Ensure that you don’t subject your system to any kind of shock. Even though hard drives can withstand several Gs of shock, they’re still susceptible to damage. Shocks can also reduce hard drive performance, and even cause bad sectors.

A logical hard drive crash on the other hand is related to a fault in the virtual storage structure of the hard drive. Data is stored on a hard drive in a structured manner, which can easily get corrupted due to many reasons, such as virus attack, accidental format, or partition deletion. In such cases, there are various things that one can do.

In case of a virus attack, the best thing to do of course is to keep your anti-virus software updated. To prevent data loss from a hard drive format or partition deletion, there’s one thing you must do, and that is to keep a backup of your important data.

You can keep it in a separate media like a CD-R, Zip drive, another hard drive, or even on your file server. Even if you’re not able to retrieve the original settings of your operating system after the crash, at least your data is safe.

There are also plenty of third party utilities that can prevent data loss. Some like Norton utilities will protect your Windows Recycle Bin, so that even when you empty it, it can recover the data. On other OSes like DOS or Linux, there are ways to retrieve deleted files or even unformat partitions.

If you want to retrieve all your original settings after a crash, there are ways to do that as well, again through software. Some software like Norton Ghost can basically create an image file of your entire hard drive or partition. This, however, would be pretty big in size, and you’ll have to a place to keep it, possibly in another partition or hard drive. Another problem in this is that you’ll need to keep manually updating or recreating it ever time there are changes.

Another option is to install software that can take snapshots of your system at different points of time, and restore it to a particular point of your choice in case of a crash.

Win XP has a built-in restore feature that lets you do this (see box). There’s also some hardware that let’s you do this. Finally, there are utilities that will take backups of the critical areas of your hard drive, which can later be used to rebuild the system.

Inside a Hard Drive
A hard disk is made up of several platters that can store data as electromagnetic pulses. Each platter has a separate head to read/write data. By design, all heads are bound together, meaning all of them move together at the same time.

Each platter is made up of concentric tracks, and each track in turn is broken up into sectors. The same track on each platter forms what’s called a cylinder. In other words, tracks on all the platters that are on the same radius form a cylinder.

The outermost track and cylinder are numbered 0, and this number increases as we move towards the center. Similarly, the heads are also numbered.

In order to locate a particular sector, the PC must know its cylinder and head number. Using this numbering is very cumbersome for programs whey they have to access data, especially because a hard drive can have thousands of tracks.

That’s why, another technique called LBA (Logical Block Addressing) is used, which sequentially numbers all sectors. This way, the programs just have to specify which sector to read/write on, instead of specifying the cylinder and head numbers.

One point to note here is that each track on the hard drive doesn’t hold the same number of sectors. This is because as we move from the innermost track to the outermost, its circumference increases.

The outermost track therefore has more sectors than the innermost one. Due to this, a technique called zoning is used, which clubs tracks on multiple cylinders having sectors that are adjacent.

Critical Areas
These basically include the Boot Sector, Partition Table, File system, and Root Directory. In case you loose any data, these utilities will be able to recover your files using this information. The Master Boot Record or MBR is also known as the boot sector, and is the first place the BIOS of a system looks when the PC boots up.

The MBR contains information about all partitions on the hard drive and their type in what’s called the Partition Table.
In addition to this, there’s also the Master Boot Code. This is a small program that runs first on the PC and then transfers control to the OS. Because this is the first place where the BIOS starts to look, it’s also located on the first sector on the hard disk, which is located on Cylinder 0 and Head 0.

We’ve explained the hard drive structure later in this story. A file system as we already know is a structured way of naming and storing files on the hard disk. Usually when there’s a data loss, one or more of these areas gets affected and some sort of cryptic message pops up. Knowing what these areas really are can help understand these messages and then do something about it.

Once a crash has happened, there are ways to find out what could have happened from the error messages that pop up.
This can be useful in speeding up the data recovery process. Some of the most commonly known error messages are as
follows.

• Invalid Drive Specification
• Invalid Partition Table
• Missing Operating System
• ROM Basic error
• Drive not ready
• Invalid media type error
• Sector not found
• Data error reading file
• VFAT error
• FAT damaged
• File not found
• General failure reading device

Once you’ve identified the problem, you’re ready to do something about it.

Recovering Data
Alas, in spite of all precautions, have you still lost data? If so, this is where data recovery comes into play. If you’ve been using a data recovery utility, then it may not be difficult to recover your data. The utility would simply take all the backed up critical areas of your hard drive and copy them to the right places on the hard drive. Your system should be backed up.

However, if you’re not comfortable in using the utility, then don’t attempt to use it yourself. Ask someone to help you out. If you haven’t been using any utility before data loss, then there are a couple of things to do.

First of all, remember one thing that when you delete a file or directory, or even format your hard drive for that matter, the data doesn’t get deleted. It’s still there, and the only thing that’s deleted is the system area of your hard drive, which means the partition table, MBR, etc. The data can be overwritten if you continue using the hard drive and keep copying or removing files from/to it. In such a case, it becomes extremely difficult to recover the data. So, don’t do anything to the hard drive that has lost data. Don’t try to run any sort of utility on it, which could alter its structure. If you’re sure you know how to use a data recovery utility, then set up an alternate system to store all the data that you manage to recover.

Lastly, remember that the more you complicate matters by running utilities on the hard drive, or modifying its content, the more difficult it becomes to recover data from it. As the difficulty level increases, then so does the price for retrieving it.

Anil Chopra

• Recycle Bin on Linux

Page(s)   1  2  3