Elementary Knowledge of Data Recovery

Preview this chapter:

Elementary Knowledge of Data Recovery, Page 1 of 1

< Previous page | Next page > /docserver/preview/fulltext/9789815274677/chapter-1-1.gif

Data recovery is the process of recuperating deleted, formatted, corrupted, damaged, or inaccessible data from storage media or obtaining files that have no backups. In forensics, data recovery is a crucial stage that aids in extracting digital evidence from devices under suspicion. As cybercrime continues to rise daily, IT enterprises must develop strategies and resources to manage these criminal activities. Logical recovery and physical recovery are the two types of attempts to damage data. Physical damage refers to the act of permanently deleting evidence, which requires specialized tools to fix broken components of the storage device, such as burnt chips, halted spindles, and scratched or smashed plates. In contrast, logical damage occurs when the device's internal data is corrupted by virus attacks, but its physical components remain operational. Software-based techniques can restore data from a storage device that has experienced an operating system logical error or unintentional user deletion. Cybervandals cause damage or destruction in digital form. Digital vandalism seeks to damage, destroy, or disable data, computers, or networks. Various methods are used to retrieve and examine data, even when the file structure has been destroyed or damaged. This chapter addresses many tools and methods available for data recovery from a forensic standpoint.