What can you expect after successfully finalized job?

» Home » Help » Frequently Asked Questions »Raw Data Recovery

Another question about Raw Recovery result which was a good point brought up by the client:
How do we determine if the result of the RAW recovery is satisfactory to the client? For example: What if a lot of the RAW data is corrupted and unusable, will they still be charged?

Regular and Raw Data Recovery

Examples of Raw recovered files:
#1. A 100% raw-recovered picture
Cat picture - 100% OK

#2. Next is the same file with 50% unrecovered sectors
Cat picture - 50% OK

The regular successful data recovery gives you the data in the same original order before disk failure. In the situation with excessive physical damage to data medium, when technical capability of digital restoration is significantly reduced, the raw recovery method may help to retrieve some types of files by their unique identifying signatures.

About Raw Recovery

Normally, the Raw Data Recovery method gives the satisfactory result only for certain well-identifiable types of files like images, photos, documents (jpg, pdf, doc, xls, and so on). At the same time, raw recovered files have no original names, no folder names, and many files might be corrupted - due to the nature of raw recovery method. All raw-recovered files are grouped (by file-extensions) and saved inside the separate folders.

Obviously, a better chance to be fully recovered will have the smaller size files; another factor is the degree of the fragmentation of medium at the moment of the crash. The less fragmented drive - the better raw recovery results.

For example, the average statistics for raw-recovered JPG images varies from 30 to 80% for good files for different cases. Note that many partially-corrupted files are still usable or can be fixed by user (pictures - in any image editing software).

The result of actual recovered cases by this method may be hundreds of thousands in raw-recovered files. Of course, we apply some filters to remove detectable unusable files and test few dozens of files to make sure the raw recovery result contains the user data. However it is all at data owner expense to spend their time checking every file and sort out the good from the bad ones. The data owner makes their own decision to accept or decline the recovery result according to the amount of bulk data generated by raw recovery tools and understanding of basic principles of this method described in this article.

More about all Data Recovery Methods including Raw-Recovery

Technically, all recovery cases can be sorted out in groups by their recovery process outcomes:

  1. Successful. Not only all files are recovered, but also every byte from every sector on failed medium are recovered and saved in drive's image. A cloned hard drive can be ordered for using as original bootable hard disk on the original computer.
  2. Successful. All files are recovered, but system data is damage beyond restoration.
  3. Partial. Not all of files are recoverable; some of the missed files can be still restored when extra raw-recovery method is applied.
  4. Raw Recovery: Only this method can be used to trace for any remainders of files on the drive.
  5. Failure. No data can be recovered.

Everything looks clear with the regular recovery. It is obvious that normally recovered files and folders are just as same as they were before disaster occurred. The recovery report will show you the same folder trees with the original names and paths. But what happens, if your drive has undergone through severe damage before its final stop at data recovery lab? Then the 'Raw recovery' method might be the last resort and hope of the desperate customer to get at least some of the outlasted data from the failed disk.

To understand what Raw Recovery is, let's compare few pictures as result of different recovery results.

A regular successful recovery retrieves copies of lost files identical to original ones, including all attributes, names, and location on the hard drive:

C:\Users\Owner Profile\Documents\My Pictures\My picture 001.jpg

Regulary recovered file

Raw-recovered picture, when 100% successfully retrieved information from sectors belonging to the original file, has also identical content and has no differences compare to the file if it would be recovered a regular way. The only loss here - the original name and chain of folders (path) where that file was located. Some order number will be assigned to every raw-recovered file and saved inside some type-distinctive folder:

C:\Raw Recovery\JPG Pictures\pic001.jpg

Good Raw-recovered file
Some or many files may (and must be) corrupted due to the technical nature of raw recovery method. Some of these partially recovered files are still usable or can be repaired, other must be wiped out as garbage files. Row recovered - corrupted file

Regular Recovery (Normal or 'Ordinary' Data Recovery)

If the retrieved binary information from the drive's platters is enough to recreate damaged/corrupted partition, operating system and file structure, all recovered data will be organized in files and folders in the same original logical order, as they were before drive's crash.

Raw Data Recovery

This recovery method uses a file signature search to locate the starting point for file reading. Luckily, almost all well-known software applications mark their data files with some unique binary code.

With Raw Recovery, all sectors on the disk are reading sequentially (sector-by-sector) to find specific file header signature as a beginning of file.

Typically, satisfactorily result can be achieved if lost files were stored in one cluster. However, even large-sized files can be successfully recovered by this method only if they have been stored in the consecutive clusters on the disk, otherwise, the integrity of the recovered file will be compromised due to the disruptions and overlapping of data chains. Such ‘tampered’ file will appear as corrupted, because some piece of its body has gotten blanks, garbage code, or parts of other files.

Naturally, better result will be achieved by raw recovery method, if the drive has not been much fragmented before the disaster happened. The fragmentation occurs naturally when you use a disk frequently, each time you create, delete, or modify the file. That is why using Disk Defragmenter on regular basis giving much more chances for fuller results by Raw Recovery.

How Raw Data Recovery works

As stated above, with Raw Recovery, all sectors on the disk are sequentially checked on the existence of specific file header signature, which is considered as a beginning of file.

Raw Recovery method does not use any partition (FAT/NTFS/MAC) and directory entries entirely. Say, you have a JPG image on the hard drive, but all records about this file on the disk are scratched, destroyed, corrupted, or erased. No name, no location, no size - nothing. But the body of this file can still be intact, just lost in the numerous sectors on the drive. What can be done in this case? Well, the whole raw stream of code in sectors will be used in search for trace of the file, instead of operating with the logical structures on the drive.

Fortunately, all JPEG image files begin with the same set of binary values in their code, known as the header signature. A sector on the drive starting with such signature will be considered as a beginning of file. The standard JPEG file headers are as following examples:

File Type Header in Hexadecimal Notes
Standard JPG FFD8FFE0nnnn4A464946 nnnn varies depending on the file size
EXIF JPG FFD8FFnnnnnn45786966 nnnnnn varies depending on the file size

As you can see from this table, all types of JPEG files are starting with the same set of bytes, shown as a string of hexadecimal characters FF D8 FF.

Specifically designed software can scan the disk volume for any occurrences of the header string. Once it's been located, the appropriate sequence of sectors will be saved as the counterpart file (JPG picture in our example). Some random name will be assigned to the recovered file, since there is no way to trace the real name for such file. The name of the recovered file is to be, something like ‘file0055.jpg’, and all raw-recovered JPEG images will be grouped in one folder, named by the file's extension: 'Folder-JPEGs'.

Losing original names is not the last problem with the raw-recovery. The outcome of raw recovery produces a large amount of defective files. That happens not only due to de-fragmentation issue. When you move or delete file, its header will remain at the old place until the moment it will be overwritten by some other file. But the raw recovery grabs all headers without distinction and all debris of deleted files will be saved as though they were real files.

The example of corrupted file is demonstrated above (broken picture on the right side).

Request to retrieve data from failed Western Digital WD800BB - 32BSA0 from Carl A. OZ Communications Cary, North Carolina USA
» BIOS S.M.A.R.T errror. Drive still spins. I can see files on disk and browse them but during browse / access they do not read. I ran drive recovery routines in OSX and fsck.

FIXED!
Of course you already knew that... ;-) Thanks so much for getting my data!
Thanks again!
Carl


Request to retrieve data from failed Seagate ST3500841NS Barracuda NS.2 from Jan O.M. Mashburn Construction, L.P. Roopville, GA USA
» Recognized by BIOS - no, spinning sound - yes. I did send this to a local guy to try to restore data. He was unsuccessful.

I think I have everything I needed. I will recommend your services any time I have the opportunity. You have made me very happy. Thanks. Jan M.


Databe in reviews and testimonials from people around the Globe:
Read more real cases...