Anyone have experience with data recovery?

[ArcticChicken]

For my capstone project I'm running a data recovery service for the staff at my school. Or at least writing a proposal that I do so. My first step is working out a list of questions I need to answer. I'm hoping someone with experience can look them over and tell me if I'm missing anything.

What types of media will I recover from?
What physical equipment do I need?
What software will I need?
What file types will I recover?

[EvilEmpryss]

This isn't my forte, but I've been working on theses and dissertations, so how about "How many servers/computers will I be recovering data from?"?

[wolfie]

What created the need for data recovery? By this, I mean was the file accidentally deleted (hard drive still works OK), did the computer stop working after a power surge/nearby lightning strike/car hit a power pole and knocked it onto lower-voltage lines (possibility of drive electronics being burned out, but platters still good), or was the computer in a fire/knocked off a desk/otherwise physically damaged (high probability that the platters themselves are damaged)? Needless to say, the deeper you go into this, the more complex the task becomes, and the higher the probability that the data is unrecoverable.

[dalesys]

If it's scholarly papers, just run a random selection of wikipedia articles through babelfish and a jargon generator.

Set up a betting pool on how many times the new papers will be cited by other scholars.

[Hyndis]

In my experience if you can recover data simply by plugging a drive into another computer as a secondary drive, the drive wasn't bad to begin with. That may just be an operating system problem rather than any hardware problem. Recover what you want, nuke the drive, and start over.

If the drive cannot be accessed as a secondary device, then its a hardware problem. Then you're talking clean room and surgery on circuit boards. Its also a very expensive and involved process.

[lordlundar]

Not necessarily It could be that the MBR wound up corrupted. In that case the files are still there and intact but the system doesn't know it. Running a data recovery program will work (with mixed results admittedly) but it's not just a jump from "working relatively fine" to "clean room required."

[Yfandes]

Iva had a lot of luck in recovering data by plugging the "bad" hard drive (Windows OS) into an external USB enclosure and opening it with a different operating system - Mac or Linux (even a bootable Knoppix drive). I'm not saying that Mac or Linux drives don't die, I've just never been asked to recover data from one.

I had one colleague (a programmer for the Feds) loose all her data on a Mac. When she moved to France she forgot to switch it from 110 to 240 VAC before she plugged it in. After the magic smoke got out (but the HD may still have been ok) she let her husband OPEN THE HARD DRIVE SO THEY COULD CHECK THE PLATTERS.

[BeeMused]

How can I prevent the data from getting lost in the first place? The answer might be training sessions for the users, or more reliable/resillient devices.

[Bandit]

How can I prevent the data from getting lost in the first place? The answer might be training sessions for the users, or more reliable/resillient devices.

Training sessions for (l)users is only effective if you can bring out the or clue-by-four.

B

[dalesys]

Ah yes, (l)users... the original /dev/null for all forms of data, including training.

[PepperElf]

For my capstone project I'm running a data recovery service for the staff at my school. Or at least writing a proposal that I do so. My first step is working out a list of questions I need to answer. I'm hoping someone with experience can look them over and tell me if I'm missing anything.

What types of media will I recover from?
What physical equipment do I need?
What software will I need?
What file types will I recover?

1) types of media. several options here, depending on what kind of money you want to spend. there's DAT (data tape), RAID, cloud just to name a few.

2) equipment: DAT - tapes, the tape deck thingy, RAID - hard drives, a case to hold them all, cloud - internet access.

3) software: dat - the ones i've done used a unix-based system for it.
RAID - the ones i used didn't actually use separate software, it was built in to the raid case itself. some will have software but the main idea for raid is that you just save your files to the raid and the raid will be able to rebuild a drive that fucks up, based on the data on the other drives.*
oh and cloud - not really sure.

oh one downside to the tapes - you have to manually do it. that can be a point for your presentation actually.

4) file types - anything really.



* the raids i use to work with were specialized 9-bay raids (about 500G total, including the data loss from repeating data on multiple drives). rebuild was about 3 hours. so we didn't actually have to do "backups" on it.




and o JOY! Capstone class! I remember going through that at my last college. we had an extra incentive... teacher said she rarely gives out As. but the incentive was that the group that "won" the proposal got a "A" - everyone else ... could get an "A" still, but they had to work hard for it.
(my group won )

[BeeMused]

Training sessions for (l)users is only effective if you can bring out the or clue-by-four.

B

Why yes! A clue-by-four was always among my classroom tools!

All backups should be made to /dev/null mwaaahaaahaaa

[Seshat]

- What filesystem am I working from?
- Have there been regular backups?
- Has recovery from the backups ever been tested?
- How about applications? operating systems? Are they backed up, serial numbers recorded, etc?


Note: Linux in its many variants can read many - not all, but many - different filesystems. For this reason, professionals often turn to Linux to read hard disks that have no hardware fault, but do have software faults. Specifically, 'fsck' - file system consistency check - is the tool of choice for corrupted file systems.

NOTE NOTE NOTE: recover onto ANOTHER media source. Always keep the media that holds the needed data un-written-to.

[suburbandecay]

If I'm looking at data recovery, here is my general list:

-How important is this data?
-How much are you willing to spend to retrieve it?
-What if anything changed/happened before failure? (noises, new hardware added to machine, lightning strikes, etc)
-Is this from a raid set?
-What raid level was used?(0,1,5,6, etc)
-What was the raid controller version and firmware version?(eg Dell Perc6)
-What file system was in use? (NTFS, HFS, EXT4)
-What OS was in use?
-Do you have backups?
-How recent are they?

The first two questions are pretty much the most important ones. If the drive(s) are actually dead dead, it can get very expensive to recover data. Not to mention, most people do not have anything important enough to warrant drastic recovery options.

[protege]

In my experience if you can recover data simply by plugging a drive into another computer as a secondary drive, the drive wasn't bad to begin with. That may just be an operating system problem rather than any hardware problem. Recover what you want, nuke the drive, and start over.

That's how I recover data at work. I keep an old computer around, whose sole purpose is to serve as a "recovery platform." Even though I don't have to do that very often, one of the side panels isn't bolted into place. I got tired of constantly having to unscrew things, so the panel just slides in. Anyway, most of the innards have been rearranged in such a way that it's easier to slide in a second drive. I'll throw any documents onto our server, and then blitz the drive and reinstall things. I simply don't have the time to spend hours messing about with files