A

SYNOPSIS
ON
“Data Recovery from Catastrophic Failure”

Submitted in partial fulfillment for the award of

Post Graduate Diploma in Management
[2009-2011]

Submitted to: Submitted by:

Prof. P. K. AGARWAL PRITOSH KUMAR
(Director) PGDM 3rd SEM.
Roll N0. M09030

Under Guidance:
Miss Parul Bhatnagar

IIMT Professional College, Meerut

 DECLARATION

I, Pritosh Kumar, student of PGDM , here by declare that project entitled “Data

recovery from catastrophic failure” submitted in the partial fulfillment of the

degree for Post Graduate Diploma in Management to “IIMT Professional College“ is of
my own accurate work.

I further declare that all the facts and figures furnished in this report are the outcome of
my own intensive research and findings.

Date (Pritosh Kumar)

Place
 ACKNOWLEDGEMENT

Writing of acknowledgement is a very difficult task for the student because there are So
many people involve in completion of his Project by giving support. It is a custom to
thank all the persons involve in the attainment of his project.
First of all I am thanking to “GOD” who gave us the patience, energy and noble way to
complete this project.
I pay our special thanks to Miss Parul Bhatnagar, able guidance this work has
been completed. Though it is an academic Project but the support, constant
encouragement, guided us not only in this project but also pave a way for me to work as
a professional in our environment.
I am also very thankful to Dr.P.K.AGARWAL, Director of IIMT Professional
College Meerut for giving us this interesting topic and guiding us throughout.
At last but not the least, I would like to thank my Friends due to their encouragement
and support throughout the completion of my project.
 EXECUTIVE SUMMARY

Losing data can be very distressing, whether the information was for a work project,
precious photographs or anything else of great value stored on the computer.

First of all, frequently backing up your data can save a lot of trouble in future, especially
for important information in the system. This is a preventative option that prevents
permanent data loss and makes disk recovery easier.

Look for signs of computer failure like unusual sounds when powering up or error
messages when using the PC. If such symptoms occur, the best thing to do is to shut
down the computer and not to panic or keep switching it on and off. Shutting down your
computer can save you a world of problems when recovering the data on the drive.

If you know how to remove the hard drive from your desktop or laptop, do so carefully
and package it safely in an anti-static bag. Avoid using bubble wrap or paper because it
can cause further damage to the drive. Once it is safely wrapped, take it to an IT
specialist for diagnosis and recovery. On the other hand, if you don't know how to
remove the drive, call a specialist to see the desktop, or carry the laptop as it is to the
specialist. Avoid tampering with the computer's hard drive if you are unsure of what to
do.

If the damage is as a result of contact with fire or water, do not power up the computer or
try to remove the drive. Such damage can only be handled by a computer specialist to
recover the data. The same applies if there is physical damage like breaking or shock to
the hard drive.

With these tips, you can be sure that there will be as little damage and data loss as
possible so all the data can be recovered easily.
 INTRODUCTION TO TOPIC

Data recovery is the process of salvaging data from damaged, failed, corrupted, or
inaccessible secondary storage media when it cannot be accessed normally. Often the
data are being salvaged from storage media such as hard disk drives, storage tapes, CDs,
DVDs, RAID, and other electronics. Recovery may be required due to physical damage
to the storage device or logical damage to the filesystem that prevents it from being
mounted by the host operating system.

Recovering data from physically-damaged hardware can involve multiple techniques.

Some damage can be repaired by replacing parts in the hard disk. This alone may make
the disk usable, but there may still be logical damage. A specialized disk-imaging
procedure is used to recover every readable bit from the surface. Once this image is
acquired and saved on a reliable medium, the image can be safely analyzed for logical
damage and will possibly allow for much of the original file system to be reconstructed.
 DATA RECOVERY FROM CATASTROPHIC FAILURE

The most common "data recovery" scenario involves an operating system (OS) failure
(typically on a single-disk, single-partition, single-OS system), in which case the goal is
simply to copy all wanted files to another disk. This can be easily accomplished with
a Live CD, most of which provide a means to mount the system drive and backup disks
or removable media, and to move the files from the system disk to the backup media with
a file manager or optical disc authoring software. Such cases can often be mitigated
by disk partitioning and consistently storing valuable data files (or copies of them) on a
different partition from the replaceable OS system files.

Another scenario involves a disk-level failure, such as a compromised file system or disk

partition or a hard disk failure. In any of these cases, the data cannot be easily read.
Depending on the situation, solutions involve repairing the file system, partition table
or master boot record, or hard disk recovery techniques ranging from software-based
recovery of corrupted data to hardware replacement on a physically damaged disk. If hard
disk recovery is necessary, the disk itself has typically failed permanently, and the focus
is rather on a one-time recovery, salvaging whatever data can be read.

In a third scenario, files have been "deleted" from a storage medium. Typically, deleted
files are not erased immediately; instead, references to them in the directory structure are
removed, and the space they occupy is made available for later overwriting. In the
meantime, the original file may be restored. Although there is some confusion over the
term, "data recovery" may also be used in the context of forensic applications
or espionage.
Recovery data from physical damage
A wide variety of failures can cause physical damage to storage media. CD-ROMs can
have their metallic substrate or dye layer scratched off; hard disks can suffer any of
several mechanical failures, such as head crashes and failed motors; tapes can simply
break. Physical damage always causes at least some data loss, and in many cases the
logical structures of the file system are damaged as well. Any logical damage must be
dealt with before files can be salvaged from the failed media.

Most physical damage cannot be repaired by end users. For example, opening a hard disk
in a normal environment can allow airborne dust to settle on the platter and become
caught between the platter and the read/write head, causing new head crashes that further
damage the platter and thus compromise the recovery process. Furthermore, end users
generally do not have the hardware or technical expertise required to make these repairs.
Consequently, costly data recovery companies are often employed to salvage important
data

Fragmentation

When the FAT entry is lost during accidental file deletion, formatting or partition
deletion that particular block of hard drive becomes inaccessible. Some data recovery
software makes an attempt to rebuild the files without a FAT entry. This technique is
very efficient if the file size is smaller than the clusters size. But it is inefficient in
recovery the larger files.

MFM (Magnetic Force Microscopy)

MFM is the latest technique that uses a sharp tip attached to a flexible cantilever placed
close to the surface of the damaged device where it interacts with the stray magnetic
field. While the tip is moving across the magnetic device, it is evaluated to detect the lost
data. The technique turns out each track that contains an image of everything ever written
to it, and finally recovers the lost data.
Recovery techniques
Recovering data from physically-damaged hardware can involve multiple techniques.
Some damage can be repaired by replacing parts in the hard disk. This alone may make

the disk usable, but there may still be logical damage. A specialized disk-imaging
procedure is used to recover every readable bit from the surface. Once this image is
acquired and saved on a reliable medium, the image can be safely analyzed for logical
damage and will possibly allow for much of the original file system to be reconstructed.
Hard drives

Whether you store files on a hard drive, floppy disk, or

other external storage device like a Zip Drive, USB drive,
compact flash card, or other media, the way in which the
computer stores your data is essentially the same. For the
purpose of this article will talk about data recovery for
hard drives but the principals can be applied to most
storage media.

A hard drive contains a number of disks called 'platters'.

These platters are coated with a magnetic substance. The platters spin at high speed under
an mechanical arm (the 'actuator' arm) that moves backwards and forwards over the
surface of each platter. On the end of this metallic arm is a small copper wire. The
computer sends a pulse through this wire which changes the state of the magnetic surface
of a platter as it passes underneath. In this way the files that you store on your computer
are encoded into the magnetic substance.
Hardware repair

physical recovery procedures are: removing

a damaged PCB (printed circuit board) and
replacing it with a matching PCB from a
healthy drive, performing a live PCB swap (in which the System Area of the HDD is
damaged on the target drive which is then instead read from the donor drive, the PCB
then disconnected while still under power and transferred to the target drive), read/write
headassembly with matching parts from a healthy drive, removing the hard disk
platters from the original damaged drive and installing them into a healthy drive, and
often a combination of all of these procedures. Some data recovery companies have
procedures that are highly technical in nature and are not recommended for an untrained
individual. Each of them will void the manufacturer's warranty. For companies who will
not void a warranty.

Data recovery software

Most data recovery program search for deleted MFT entries to undelete files (learn about
MFT records here). These programs usually give a give a probability of recovery rating
of 'good', 'medium' or 'poor'. What they are actually doing is locating the MFT record for
a deleted file and then checking the rest of the MFT records to determine if the clusters
that the deleted file occupied are being used by any other file stored on the computer. As
only one file can occupy any one cluster on a hard drive, if other files are using your

deleted files storage space then it is likely that the original data has been overwritten and
permanently destroyed.
This recovery technique is usually relatively fast way to get data back, as all the recovery
program has to do is find the deleted file entries in the MFT and then go directly to that
location of the hard disk to perform the data recovery. You will see an MFT search when
you execute a "Fast Search" using Recover My Files Data Recovery Software.

However, if your MFT is corrupt, defective or has itselfbeen overwritten, this method
isn't going to help you even though the file data still remains out on the disk waiting to be
found. What you need to do is search unallocated clusters.

Some software is:

 Tune up
 File recovery
 NAS data recovery
 EASIS data recovery
 RAID Recovery

NTFS recovery and FAT recovery

On older Operating Systems such as Windows 98 there is a storage area known as the
'Root Directory'. This is the place which stores the name of a file, the location of its
starting cluster, and the size of the file. In order to find a file the Operating System uses
this information to get to the first storage cluster of a file. It then uses a special table at
the start of the disk know as the File Allocation Table or FAT to identify the remaining
clusters that are used to store the file. It is important to realize that this information is
stored completely separate from your file data and is why FAT data recovery is possible.

In newer Operating Systems the FAT and Directory Entry method has been merged and
replaced by a single table known as the Master File Table or MFT. Whilst an MFT is
more complex, the principal of locating the start of a file and its subsequent storage
clusters is essentially the same.
Data Recovery by Searching for Deleted MFT Records
Most data recovery programs search for deleted MFT entries to undelete files or
unformed drives. These programs usually give a give a probability or hard drive data
recovery rating of 'good', 'medium' or 'poor'. What they are actually doing is locating the
MFT record for a deleted file and then checking the rest of the MFT records to determine
if the clusters that the deleted file occupied are being used by any other file stored on the
computer. As only one file can occupy any one cluster on a hard drive, if other files are
using your deleted files storage space then it is likely that the original data has been
overwritten and permanently destroyed. This recovery technique is usually relatively fast,
as the entire recovery program has to do is find the deleted file entries in the MFT and
then go directly to that location of the hard disk to perform the data recovery. You will
see an MFT search when you execute a "Fast Search" using Recover My Files Data
Recovery Software.

Recovery data from logical damage

Overwritten data
When data have been physically overwritten on a hard disk it is generally assumed that
the previous data are no longer possible to recover. In 1996, Peter Gutmann, a computer
scientist presented a paper that suggested overwritten data could be recovered through the
use of Scanning transmission electron microscopy.In 2001, he presented another paper on
a similar topic.Substantial criticism has followed, primarily dealing with the lack of any
concrete examples of significant amounts of overwritten data being recovered.To guard
against this type of data recovery, he and Colin Plumb designed the Gutmann method,
which is used by several disk scrubbing software packages.

Corrupt filesystems
In some cases, data on a hard drive can be unreadable due to damage to the file system. In
the majority of these cases, at least a portion of the original data can be recovered by
repairing the damaged filesystem using specialized data recovery software. This type of
data recovery can be performed by knowledgeable end-users as it requires no special
physical equipment. However, more serious cases can still require expert intervention.

Online Data Recovery

"Online" or "Remote" data recovery is yet another method to restore the lost or deleted
data. It is same as performing the regular software based recoveries except that this kind
of recovery is performed over the Internet without physically having the drive or
computer in possession. The recovery technician sitting somewhere else gains access to
user's computer and complete the recovery job online. In this scenario, the user doesn't
have to travel or send the media to anywhere physically.

Although online data recovery is convenient and useful in many cases, it still carries
some points making it less popular than the classic data recovery methods. First of all, it
requires a stable broadband Internet connection for it to be performed correctly, which
many third world countries still lack. Also, it cannot be performed in case of physical
damage to media and for such cases, the traditional in-lab recovery has to take place

Some Cases of data Recovery

 FIRE S
CRUSHED
Found after a fire destroyed a 100 year old home – All data Recovered
PowerBook trapped underwat
A bus runs over a laptop – All data recovered

OBJECTIVE

 To understand the process of data recovery from catastrophic failure

 To understand how arise the catastrophic failure
  To remove the risk of data lost
 To recover important files of an organization
 To retrieving deleted/inaccessible data from electronic storage media (hard drives,
removable media, optical devices, etc...)


RESEARCH METHODOLOGY

The study will be conducted with reference to the data related to data recovery issue. A
good process of data recovery provides the foundations for the successful implementation
of data recovery related projects in the future.
Research design
Descriptive research.

Sample Design
This study covers a periods of ten years from 1998-2010.

Sources of Information:

Secondary data
The study is purely based on secondary data.The data required for the study will be
collected from websites and newspapers and books.

CONCLUSION

In todays world as we know that in in every field computer is been used and all the
important information are stored in the form of data in the computer .So every data is
very important for the organization and if any one of the data lost then it put the
organization stand still. So recovery of these data are very much important if it is lost,
thaen the computer should not be powered it should be taken to the IT specialist so that
the data can be recovered . It can be repaired by replacing parts in the hard disk . A
specialized disk –imaging procedure is been used to recover every readable bit from the
surface.

BIBILIOGRAPHY

Websites:
http://en.wikipedia.org/wiki/Data_recovery
 http://www.wisegeek.com/what-is-the-recovery-point-objective.htm

http://www.ncbi.nlm.nih.gov/pubmed/8981901

http://www.recovermyfiles.com/ntfs-fat-data-recovery.php

http://ezinearticles.com/?Data-Recovery-Tips&id=5697202

http://www.answers.com/topic/catastrophic-failure

Books:

Oracle RMAN 11g Backup and Recovery by McGraw-Hill

Multivariate Analysis of Ecological Databy Leps, Jan

The Data of Ethics: by Spencer, Herbert

An Introduction to Statistical Inference and Data: by Trosset, Michael W.