Data recovery glossary of terms
Our modern world is full of technology that comes with plenty of often confusing jargon. If you are new to the world of data recovery or are in contact with a data recovery company then this quick guide to the terminology may help you make sense of things.
A sector is a small area on the surface of the magnetic disk which holds data. This sector is a sub division of a track that runs around the circular disk surface. If a sector becomes damaged or unreadable it is classed as a bad sector.
A boot loop occurs on a mobile phone or iPhone when the operating system is prevented from completing its launch. This happens for a number of reasons from physical damage to software corruption and viruses. This quite often occurs on iPhones that are low on storage memory when the operating system is trying to perform an update.
A chip-off recovery is when a memory chip is de-soldered and removed from the printed circuit board (PCB) of a damaged device. This is common practice for mobile phone and USB memory sticks. Once removed, raw data is then read from the microchip using independent hardware and software. The raw data is then re-constructed into its original format.
Hard drives often make a clicking sound when the read/write heads or the disk surface is damaged.
If you hear this sound, turn off your drive immediately and contact a data recovery specialist.
For more details see our article Why is my hard drive making a clicking noise?.
Often the first step in a hard drive data recovery is to make an exact copy (Clone) of the sectors containing the data on the disk surfaces. This ensures that we have any available data in the event that the drive is failing. We then recover data from that clone and not the failing/failed hard disk.
We will often target data that a customer designates as critical first.
A hard drive contains one or more spinning metal, glass or ceramic disks. Each of these disks is coated with a layer of magnetic particles which are used to hold the data for a device to access. These platters (which we also sometimes refer to as media) are written to and read from by the read/write head(s) which are moved backwards and forwards across the disk surface by an actuator arm. The platters will contain data on both sides.
Encryption is when data is converted or encoded so that its original meaning is hidden. Only an authorised party with the correct password can access or view it. Without a password the data will appear scrambled.
Firmware is a program or instructions embedded onto a hard disk drive (or other device) and allows communication between the device and the operating system (Windows, Mac OS etc.) that accesses it. The firmware controls how the device behaves and differs from manufacturer to manufacturer. Firmware can become corrupted meaning the device no longer functions correctly.
A Forensic data Recovery is a recovery undertaken for legal and evidential purposes that can be used in a court of law. This type of recovery is done by a company specialising in forensic techniques.
A format, is when a drive is being prepared for use. The media is prepared during low level formatting and then partitioned ready for operating system installation and file storage. When a device is formatted all data is lost and unlikely to be recoverable.
A head change is the process of removing a set of damaged ‘read/write heads’ from a hard drive and replacing them with a suitable ‘donor’ set, in an attempt to recover data from the disk surfaces. Suitable donor heads must meet a number of criteria to be compatible with the recipient drive. Depending on the model, this can mean, manufacturing date, elements of serial number, site of manufacture and more.
A head crash is when the read/write heads hit the surface of the platter and cause physical damage to the magnetic surface that holds the data. The heads usually hover a fraction of a millimetre over the surface of the disk, so an impact while the disks are spinning will often result in a head crash. When the device is switched off and the disks not spinning the heads usually sit in a ‘parked’ position away from the disk surface.
The MFT (Master File Table) is a database of information about every file and directory on a computer, this includes their names and locations. If this is damaged or corrupt it may mean that a raw recovery is required. Data may still be recovered but will not contain files names and the files will not be organised in a structure.
USB Monolith flash drives are where the internal chips and components are housed within a ceramic covering as opposed to a plastic enclosure. This makes a more durable device but means the chips are not readily exposed to perform micro soldering.
NAND is a non-volatile flash memory chip that does not require power to retain data on it. NAND chips are found in USB memory sticks, mobile phones, memory cards and solid state drives.
Sometimes lost data can be recovered from a NAND chip using software, it is also possible to do a ‘chip-off’ recovery using specialist hardware to read the NAND chip directly.
A drive partition is a logical section of a physical drive. It is an area separated from other parts of the disk that can be managed as an entity of its own. Hard drives need at least one partition, but can have many depending on the requirements of the operating system.
A partition table is a table on the disk that keeps a record of the disk partitions, their size and where they physically are on the disk surface.
A Printed Circuit Board (PCB) contains connected electrical and electronic components and is at the core of all electronic devices.
A RAID (Redundant Array of Independent Disks) is a collection of multiple hard drives that work together to provide varying degrees of redundancy and performance. It is a way to protect data by providing a failover mechanism should there be an issue with one of the drives.
A raw recovery is a low level forensic style recovery that picks up all remnants of data on the hard drive. This type of recovery loses the file structure and filenames, however picks up data that would not be discovered with standard recovery techniques.
Read / write heads
Put simply the read/write heads move above the spinning disk’s magnetic surfaces and use electrical current to read and write information to and from the disks magnetic surface. The heads hover above the surface at a height as little as 3 nanometres and never make contact with the surface.
Remapping is the process of locating a physical bad sector on the disk surface and remapping it to a location on the disk surface that is okay.
ROM (Read Only Memory) is memory that holds permanent data and cannot be overwritten or altered.
A Sector is a subdivision of a track on the magnetic disk surface. Each sector is a fixed size and holds user data. A sector is the smallest unit of storage on a hard disk drive.
The service area is an area of the disks surface that contains firmware. This area of the disk is not accessibly through the operating system.
Stiction in when the read/write heads of hard drive become attached to the surface of the disk platter. This will often result in a beeping sound as the spindle motor tries unsuccessfully to spin the disks.
Trim is when the operating system is allowed to wipe blocks of data that are considered to be no longer in use. These blocks can then be reused to store new data.