FAQ and Technical Articles

Regular and Raw Data Recovery

Technically, all recovery cases can be sorted out in groups by their recovery process outcomes:

1. Successful. Not only all files are recovered, but also every byte from every sector on failed medium are recovered and saved in drive's image. A cloned hard drive can be ordered for using as original bootable hard disk on the original computer.
2. Successful. All files are recovered, but system data is damage beyond restoration.
3. Partial. Not all of files are recovered. The rest of missed files salvaged by raw-recovery method.
4. Raw Recovery: Only this method can be used to trace for any remainders of files on the drive.
5. Failure. No data can be recovered.

Everything looks clear with the regular recovery. It is obvious that normally recovered files and folders will be just as same as they were before disaster occurs. At the end of such recovery we'll have not only the same content in files, but also, the same names and paths to folders will be presented in salvaged data.

But what happens, if your data medium device has undergone through severe damage before its final stop at data recovery lab? Then the ‘Raw recovery’ method might be the last resort and hope of the desperate customer to get at least some of the outlasted data from the failed disk.

To understand what ‘Raw Recovery’ is, let’s compare ‘ordinary-recovered file’ and 'raw-recovered file’ on demonstrated below lilies pictures:

Ordinary-Recovered files are usually identical to original ones by content; they have the same names and folder paths:	Successfully Raw-Recovered file has identical content with original file, but not the same name:	Bad Raw-Recovered file has damaged internal structure. A single lost byte will corrupt the picture:
Full name and path are recovered as well: ..\ My Pictures\lilies.jpg	..\ Dir.JPG \ file0001.jpg	..\ Dir.JPG \ file0002.jpg
	All Raw-recovered files have lost any information about their original names and paths! Instead of real names - some substitute names are assigned to every raw-recovered file. All those files are grouped in folders (by application / file extension).

Regular Recovery (Normal or 'Ordinary' Data Recovery)

If the retrieved binary information from the drive's platters is enough to recreate damaged/corrupted partition, operating system and file structure, all recovered data will be organized in files and folders in the same original logical order, as they were before drive's crash.

Raw Data Recovery

This recovery method uses a file signature search to locate the starting point for file reading. Luckily, almost all well-known software applications mark their data files with some unique binary code.

With Raw Recovery, all sectors on the disk are reading sequentially (sector-by-sector) to find specific file header signature as a beginning of file.

Typically, satisfactorily result can be achieved if lost files were stored in one cluster. However, even large-sized files can be successfully recovered by this method only if they have been stored in the consecutive clusters on the disk, otherwise, the integrity of the recovered file will be compromised due to the disruptions and overlapping of data chains. Such ‘tampered’ file will appear as corrupted, because some piece of its body has gotten blanks, garbage code, or parts of other files.

Naturally, better result will be achieved by raw recovery method, if the drive has not been much fragmented before the disaster happened. The fragmentation occurs naturally when you use a disk frequently, each time you create, delete, or modify the file. That is why using Disk Defragmenter on regular basis giving much more chances for fuller results by Raw Recovery.

WARNING: To avoid additional data loss, DO NOT de-fragment your hard drive if you already experiencing data lost or drive failure, as well do not start other disk utilities (Scandisk/ Check Disk / Norton Utilities/ etc.)

How Raw Data Recovery works:

As stated above, with Raw Recovery, all sectors on the disk are sequentially checked on the existence of specific file header signature, which is considered as a beginning of file.

Raw Recovery method does not use any partition (FAT/NTFS/MAC) and directory entries entirely. Say, you have a JPG image on the hard drive, but all records about this file on the disk are scratched, destroyed, corrupted, or erased. No name, no location, no size - nothing. But the body of this file can still be intact, just lost in the numerous sectors on the drive. What can be done in this case? Well, the whole raw stream of code in sectors will be used in search for trace of the file, instead of operating with the logical structures on the drive.

Fortunately, all JPEG image files begin with the same set of binary values in their code, known as the header signature. A sector on the drive starting with such signature will be considered as a beginning of file. The standard JPEG file headers are as following examples:

As you can see from this table, all types of JPEG files are starting with the same set of bytes, shown as a string of hexadecimal characters ‘FF D8 FF’.

Specifically designed software can scan the disk volume for any occurrences of the header string. Once it's been located, the appropriate sequence of sectors will be saved as the counterpart file (JPG picture in our example). Some random name will be assigned to the recovered file, since there is no way to trace the real name for such file. The name of the recovered file is to be, something like ‘file0055.jpg’, and all raw-recovered JPEG images will be grouped in one folder, named by the file's extension: 'Folder-JPEGs'.

Losing original names is not the last problem with the raw-recovery. The outcome of raw recovery produces a large amount of defective files. That happens not only due to de-fragmentation issue. When you move or delete file, its header will remain at the old place until the moment it will be overwritten by some other file. But the raw recovery grabs all headers without distinction and all debris of deleted files will be saved as though they were real files.

The example of corrupted file is demonstrated above (broken picture on the right side).