Safeguard your Data

One of the most common causes of data loss is human error. After all, “to err is human”, and most of us would have lost important data at one time or the other by accidentally pressing delete. What usually follows is a frenzied scrambling for a solution to recover the lost data. The point is, why not take proper precautions to prevent this scrambling in the first place? As they say, “Prevention is better than cure”. Sadly, we often don’t realize the value of our data until we’ve lost it.

We’re not implying that human error is the only way of losing data. There are many other reasons as well, which we’ll soon get into, and it’s important to know ways and means of preventing them from happening. Of course once you’ve lost data (God forbid!), it’s equally important to know what to do. Doing things blindly can make things even worse.

Safeguarding data can therefore be divided into two parts–one is preventing data loss from happening in the first place, and two–recovering data once it’s been lost. In both cases, there are some things you can do yourself, and others which only software can do. We’ve looked at both in this story.

Causes and prevention

Besides human error, other major causes of data loss are virus attack, physical failures like a hard drive crash or bad media, system faults like an application going unsteady or the OS developing a fault, and user negligence.

In a hard drive crash, there are two possibilities. Either it’s a physical crash, or a logical one. A physical crash is one in which the hard drive itself gets physically damaged.

Bad sectors are the most commonly known example of a physical crash. There’s no way to cure bad sectors, but there are utilities that can mark these sectors as bad and pull out whatever data is stored in them and move it to another location on the hard drive. This is something that any user can do, because there are commonly available utilities for the same.

Norton Utilities is a classic example of such utilities, which has been used for ages for this among other things. In some cases, the hard drive stops getting detected by the system altogether, which can be due to a problem in the circuitry or the headgear assembly inside. This is something that a user can’t rectify on his own. It requires going to an expert, who will open the drive and do the needful. In most cases, it wouldn’t be possible to fix the hard drive, only recover the data somehow and move it to another location.

Most hard drives provide a MTBF (mean time between failures) rating that’s enough for it to last for several years. While failures are unpredictable and can happen, the best you can do is to maintain the hard drive properly.

If at home, ensure that you have a UPS in place, which can protect your system from the most basic power problems such as power cuts, surges, spikes, and sags. Any of these problems if allowed to pass through can cause a PC to reboot, and even damage the hard drive in the process.

Ensure that you don’t subject your system to any kind of shock. Even though hard drives can withstand several Gs of shock, they’re still susceptible to damage. Shocks can also reduce hard drive performance, and even cause bad sectors.

A logical hard drive crash on the other hand is related to a fault in the virtual storage structure of the hard drive. Data is stored on a hard drive in a structured manner, which can easily get corrupted due to many reasons, such as virus attack, accidental format, or partition deletion. In such cases, there are various things that one can do.

In case of a virus attack, the best thing to do of course is to keep your anti-virus software updated. To prevent data loss from a hard drive format or partition deletion, there’s one thing you must do, and that is to keep a backup of your important data.

You can keep it in a separate media like a CD-R, Zip drive, another hard drive, or even on your file server. Even if you’re not able to retrieve the original settings of your operating system after the crash, at least your data is safe.

There are also plenty of third party utilities that can prevent data loss. Some like Norton utilities will protect your Windows Recycle Bin, so that even when you empty it, it can recover the data. On other OSes like DOS or Linux, there are ways to retrieve deleted files or even unformat partitions.

If you want to retrieve all your original settings after a crash, there are ways to do that as well, again through software. Some software like Norton Ghost can basically create an image file of your entire hard drive or partition. This, however, would be pretty big in size, and you’ll have to a place to keep it, possibly in another partition or hard drive. Another problem in this is that you’ll need to keep manually updating or recreating it ever time there are changes.

Another option is to install software that can take snapshots of your system at different points of time, and restore it to a particular point of your choice in case of a crash.

Win XP has a built-in restore feature that lets you do this (see box). There’s also some hardware that let’s you do this. Finally, there are utilities that will take backups of the critical areas of your hard drive, which can later be used to rebuild the system.

Inside a Hard Drive

A hard disk is made up of several platters that can store data as electromagnetic pulses. Each platter has a separate head to read/write data. By design, all heads are bound together, meaning all of them move together at the same time.

Each platter is made up of concentric tracks, and each track in turn is broken up into sectors. The same track on each platter forms what’s called a cylinder. In other words, tracks on all the platters that are on the same radius form a cylinder.

The outermost track and cylinder are numbered 0, and this number increases as we move towards the center. Similarly, the heads are also numbered.

In order to locate a particular sector, the PC must know its cylinder and head number. Using this numbering is very cumbersome for programs whey they have to access data, especially because a hard drive can have thousands of tracks.

That’s why, another technique called LBA (Logical Block Addressing) is used, which sequentially numbers all sectors. This way, the programs just have to specify which sector to read/write on, instead of specifying the cylinder and head numbers.

One point to note here is that each track on the hard drive doesn’t hold the same number of sectors. This is because as we move from the innermost track to the outermost, its circumference increases.

The outermost track therefore has more sectors than the innermost one. Due to this, a technique called zoning is used, which clubs tracks on multiple cylinders having sectors that are adjacent.

Critical Areas

These basically include the Boot Sector, Partition Table, File system, and Root Directory. In case you loose any data, these utilities will be able to recover your files using this information. The Master Boot Record or MBR is also known as the boot sector, and is the first place the BIOS of a system looks when the PC boots up.

The MBR contains information about all partitions on the hard drive and their type in what’s called the Partition Table.

In addition to this, there’s also the Master Boot Code. This is a small program that runs first on the PC and then transfers control to the OS. Because this is the first place where the BIOS starts to look, it’s also located on the first sector on the hard disk, which is located on Cylinder 0 and Head 0.

We’ve explained the hard drive structure later in this story. A file system as we already know is a structured way of naming and storing files on the hard disk. Usually when there’s a data loss, one or more of these areas gets affected and some sort of cryptic message pops up. Knowing what these areas really are can help understand these messages and then do something about it.

Once a crash has happened, there are ways to find out what could have happened from the error messages that pop up.

This can be useful in speeding up the data recovery process. Some of the most commonly known error messages are as

follows.

• Invalid Drive Specification
• Invalid Partition Table
• Missing Operating System
• ROM Basic error
• Drive not ready
• Invalid media type error
• Sector not found
• Data error reading file
• VFAT error
• FAT damaged
• File not found
• General failure reading device

Once you’ve identified the problem, you’re ready to do something about it.

Recovering Data

Alas, in spite of all precautions, have you still lost data? If so, this is where data recovery comes into play. If you’ve been using a data recovery utility, then it may not be difficult to recover your data. The utility would simply take all the backed up critical areas of your hard drive and copy them to the right places on the hard drive. Your system should be backed up.

However, if you’re not comfortable in using the utility, then don’t attempt to use it yourself. Ask someone to help you out. If you haven’t been using any utility before data loss, then there are a couple of things to do.

First of all, remember one thing that when you delete a file or directory, or even format your hard drive for that matter, the data doesn’t get deleted. It’s still there, and the only thing that’s deleted is the system area of your hard drive, which means the partition table, MBR, etc. The data can be overwritten if you continue using the hard drive and keep copying or removing files from/to it. In such a case, it becomes extremely difficult to recover the data. So, don’t do anything to the hard drive that has lost data. Don’t try to run any sort of utility on it, which could alter its structure. If you’re sure you know how to use a data recovery utility, then set up an alternate system to store all
the data that you manage to recover.

Lastly, remember that the more you complicate matters by running utilities on the hard drive, or modifying its content, the more difficult it becomes to recover data from it. As the difficulty level increases, then so does the price for retrieving it.

Anil Chopra

• Recycle
  Bin on Linux

Data recovery utilities on pcq essential D

File Scavenger 2.1

This is a handy utility for recovering corrupted data, quick formatted hard drives, or even files that have been deleted from DOS or the Recycle Bin. It can also recover data from crashed hard drives or files damaged by viruses. It works on Win NT/2000/XP and undeletes or recovers data only for NTFS volumes. It has three search modes, Normal, Exhaustive and Defunct volume search. Normal search is the fastest. It searches for recently deleted files and displays files that it can recover. Exhaustive search is good if the disk has been reformatted or gotten corrupt. It scans all sectors of the volume and therefore also takes longer. The Defunct Volume search scans the drive for volumes that no longer exist, including broken RAID volumes. This mode takes the longest to scan the disk and therefore should only be used as the last resort for data recovery. File Scavenger lets you search files by name or type (like *.DBF for database files or *.doc for Word documents). Along with filenames, it also shows the chances of recovering data, that is good, poor and so on. The trial version is limited to recovering only up to 32 kB of data, which can be useful for recovering small documents. 

GetDataBack

This software is available for NTFS and FAT file systems. It has a simple and easy-to-use interface. The utility can scan a physical disk, a partition of the physical disk, a logical partition or an image file. It also allows you to create an image file of the specified disk. After it has scanned the specified disk, it shows you the file names it can restore from the disk. These are displayed in a very organized tree structure. One good thing about this software is that it allows you to directly access the files it found. You can open, view or run, any file you want, depending on the file. It also offers two search modes. The first one completely scans the disk and the second can do a partial disk scan. In the partial scan, you can specify the sectors you want to scan. It also gives you details about the disk that you’ve selected to scan. While this may be a good utility for recovering deleted files, it won’t recover corrupted files.

BadCopy Pro

This can be used to recover data from corrupted or defective mediums, like bad floppy disks, CDs or hard disks. It’s a fully automatic and professional data recovery software which can recover and restore nearly all kinds of data, including images, applications, documents and MS-Office files. It also offers three disk scan options. The first tries to rescue corrupted files, and the second and third are rescue lost files mode 1 and mode 2. If it can’t rescue data from one method, it’ll ask you to use the next alternative and so on. The evaluation version can only scan for lost or corrupted data, but not recover them. The utility only tags them as file1, file2 and so on.

Drupad Parsai 

TIPS Tricker

Recover mail in Outlook Express

Have you ever accidentally deleted a mail or mail folder of your e-mail client? If you’re an Outlook Express user, then you have a chance of retrieving it, if you haven’t closed Outlook Express after deleting the mail. First, determine the location of your mail folder. To do this, go to Tools>Options. Click the Maintenance tab and then the Store Folder button. Go to this location and you should still find the mail folder you deleted there. Simply copy this folder to another location and then close Outlook Express. Open Outlook Express again and this time you won’t find the folder because it’s been deleted. Now simply create a new folder by the same name as the one that was deleted. Copy a mail from another folder to it. Close Outlook Express and go to the store folder again, and copy the original “deleted” folder that you saved earlier to this place. Re-launch Outlook Express
and you should be able to see the folder you had deleted with all your mail in it. 

Drupad Parsai 

System reSTORE in Win XP

Believe it or not, you can at last revert your system to an earlier point in time with a couple of clicks in Win XP. The “System Restore” application accessible from Accessories > System Tools allows you to create point-in-time snapshots, along with appropriate descriptions. The system also creates “system snapshots” whenever any programs are installed or uninstalled so that if problems creep in as a result, a single restore can at least leave your system usable. These points can be reverted to in any order and can even be undone. However,some operations like installing a service pack can invalidate previous restore/undo points.

A multi-step wizard presents you with four types of backup options: the first allows you to back up your own documents and settings, the second to back up the documents and settings of all the users on a multi-user system, a third to back up all data on the PC and the last one lets you do selective backups.

You can save the backup onto a separate medium–tape or disk, or write it onto a CD-ROM. To restore the states, either boot from the “System Restore Disk” you can create, or boot into “safe-mode with command prompt” and type in “rstrui”.

You can also invoke the same wizard and choose the “Restore my computer to an earlier point” option from the first screen.

Drupad Parsai 

Unformat your hard drive

There’s a glimmer of hope in recovering data even if you’re still running DOS on an old Pentium machine. It has an “unformat” command that can actually undo a format of your hard drive. 

This cannot however, be used when the disk has been formatted using the “/U” (don’t save unformat information) switch. The basic syntax of this command is “UNFORMAT ”. You can optionally specify the /J, /P, /L, /PARTN and /TEST switches. Issuing just the basic command will unformat the drive using the mirror-file if available, but continues just fine otherwise. 

/J checks for mirror file availability. /P sends the output to the printer and /L lists it on-screen. 

/PARTN option rebuilds the partition table, while /TEST will check if the command will succeed without actually doing anything.

Drupad Parsai 

Volume shadow copy

If you work with files that are located on shared folders on the network, configuring volume shadow copy as part of your overall disaster recovery strategy is a good option. It allows you to recover files that were accidentally deleted, recover from accidentally overwriting a file, and even compare version of files while working.

Volume shadow copy service is available with the Windows Server 2003 and is very simple to configure. This service makes scheduled snapshots or copies of the files that are located on shared resources, such as a file server. In case a file gets deleted or overwritten, you may be able to access previous versions of your files saved by the Shadow Copy service. Client software for accessing shadow copies of shared folders is also available with the server. 

The frequency of creating copies can be increased or decreased depending on the criticality of the data. For less important data, weekly copies and for crucial data, daily copies can be made. You can also make copies manually at any point of time.

Anoop Mangla