Powered by Bravenet Bravenet Blog

Monday, January 11th 2010

2:15 PM

Will a recovered file be intact or corrupt?

"How do I know my files will be ok after recovery" is a question we get asked a lot. The final answer to this question is; you know a file is ok after recovery by trying. Recover the file and open it. That is the only sure way to find out.

There are however ways to predict if a file is recoverable before actually recovering them.

One way is by determining how the data was lost and what happened to a drive after it was discovered that the data was lost. For example, if a volume becomes unformatted or RAW all of a sudden (these things happen), then as long as you do not format the volume again, the data within the RAW volume is relatively safe. After all, you can not save new data on it, nor can Windows.

If however you deleted a file from your c: drive then there is a significant risk of you (or Windows, or background tasks) overwriting it. After deleting a file, it is by no means certain that the file will be uncorrupted after recovery!

These are just two examples.

Data Recovery software can also try to make educated guesses about the recoverability of files. Basically there are two ways, both nicely illustrated by two of our recovery tools:

Examine the (to be recovered) file content:
This method is used by iRecover. After iRecover has examined the volume it builds a virtual file system. One of the elements it determines for a specific file is the filename and the file extension (ZIP, DOC etc.). For certain file types iRecover knows the known-to-be-good file structures. So for a ZIP file it can read the clusters that belong to the lost ZIP file and see if the data in these clusters looks like a valid ZIP file. And if so, iRecover will assign this file a green icon in its file list.



Examine the file system bitmap:
iUndelete works this way. The bitmap is a structure that can tell for each cluster in a volume if it is in use or not. After iUndelete compiles a list of deleted files it determines if the clusters previously allocated to the deleted file are in use or not. If they are not in use then the chances are good that the file can be recovered intact. A deleted file for which all clusters are not re-used will receive a 100% score. However if one or more clusters are reported to be in use, these clusters have been assigned to a new file after the deleted file was lost.



Both methods can fail however: What iRecover assumes to be a ZIP file can be corrupt anyway. Theoretically it may even be an intact ZIP file but an entirely different one.
iUndelete may determine a file to be recoverable because all clusters are reported 'not in use' if they were written to and deleted again.

So, the final answer to the question is: you know a file is ok after recovery by trying. Recover the file and open it. That is the only sure way to find out.

0 total comments.

There are no comments to this entry.