邪恶八进制信息安全团队技术讨论组's Archiver

EvilOctal 2007-2-19 13:19

[转载]Data Recoverability

原始链接:<a href="http://www.runtime.org/recoverability.htm">http://www.runtime.org/recoverability.htm</a><br /><br /><p>In a data loss scenario the most important question is: Are the files still recoverable? This answer depends on what action needs to be taken, whether to pursue the data recovery or to develop strategies of coping with the data loss. </p><p>The situation is often very difficult to judge. Sometimes it is not fully clear what caused the data loss in the first place. Some technician might have already tried to solve the problem. Also, the effect of common remedies, such as Microsoft's "Checkdisk", on the recoverability is quite unknown.</p><p>This article is supposed to sort out what is possible and what is not. We will try to explain, for a given scenario, what can be expected. For this purpose we must restrict the idea of "recoverability" to "commercially available and affordable data recovery". While it might be possible that the magnetization that once constituted the data is still present on the media, often times the technology to recover the data for an economically reasonable price is not available.</p><h5>The Type of Data Influences the Success Rate</h5><p>We must also consider the kind of data that needs to be recovered. Just assume you are able to recover a hypothetical 90% of all lost files. If these files were pictures you can consider this rate a success, you got 9 out of 10 pictures back. If your files were tables of a database and 10% are missing, the entire database will probably be worthless because the data depends on each other. <strong>The more the data is depending on each other, the greater the devastation will be if even a small percentage of data is missing.</strong> We will also will look at what "90% recovered" really means. Another interesting aspect will be the "time dimension": a data recovery is usually worth less with each day, sometimes each hour, that passed by.</p><h5>Physical and Logical Data Recovery</h5><p>We need to distinguish between two different procedures:</p><ol><li>Extracting the raw data from the affected media (physical data recovery) </li><li>Reconstructing the files (logical data recovery) </li></ol><p>You can have pure logical data losses. For example, file deletion, drive formatting or virus attacks only require logical reconstruction (2). On the other hand, a mechanically failed drive that is successfully repaired (1) will not need logical reconstruction. </p><p>In reality many physical problems will need subsequent logical reconstruction because not all data has been retrieved.</p><h5>Dead Hard Drive</h5><p>A drive can be considered "dead", if it is not accessible by any software means, e.g. the BIOS, Windows' Disk Management or disk utilities such as Runtime Software's GetDataBack. A dead drive often shows additional symptoms. It does not spin or it "clicks" or it makes other kinds of strange noises. </p><p>Theses drives might have a damaged electronic board, damaged read heads, a damaged motor or damaged magnetic media. Data recovery companies with clean room facilities can often resurrect the drive by exchanging the damaged parts. They will then image the drive and perform a logical file reconstruction. </p><p>This approach is sometimes successful and then well worth the cost of several hundred or even thousands of dollars; however, sometimes it is not successful. </p><h4><strong>Physical recovery is not always possible</strong></h4><p><strong>First</strong>, success depends on the extent of the damage. It is not possible, even in theory, to recover data from a platter that was heated up to "Curie temperature" (which is 770°C for iron). This temperature completely demagnetizes the platters. It seems doubtful whether anybody will recover data from a drive that fell on a hard floor. If the platters are unbalanced due to bending or impact they will vibrate while spinning. If the vertical amplitude of this vibration is larger than the distance the read head flies at (50

页: [1]
© 1999-2008 EvilOctal Security Team