Partition Recovery: An In-Depth Look

Hard disk partition recovery, though simplistic in concept, is often very difficult to accomplish. Even the most advanced partition recovery software can fail. A failed recovery process can create even greater complications.

Some of the best information on partition recovery can be located on educational domains. It is on these sites a user can find many specialized papers that address the specifics of Computer Forensics. The aspects of Digital Forensics include the following measures:

• Documentation: Accurate records preserve the reliability of any regained information.
• Preservation: Prior to any attempt to identify and extract hard drive information, the user should create dependable backups of the existing drive.
• Identification: An effective system recovery should include knowledge of the Master File Table (MFT), an understanding of the purposes and uses of boot sector pointers, and an awareness of the data to be recovered.
• Extraction: The physical process of retrieving information may involve a complete partition recovery or it may be limited to a few specific bits of information.

High Level Digital Forensics Issues

Consider your motivation for partition recovery. In order to protect information systems, one must grasp the nature and methods of digital exploits and attacks. Maybe you are involved in security implementation, or you may be seeking to restore your own system. Be sure to act with honor.

Understand the legal implications. Cyber crime is a federal offense. Make certain that you are not trying to circumvent digital copyright laws. If you are dealing with a criminal issue such as seeking to recover evidence, involve the local law enforcement agency. Incorrect handling of criminal evidence may well make it inadmissible to a court of law.

Partition recovery also involves knowing how digital data sources function. Not all devices follow the same partition methods. Use the right tool for a specific hardware.

Media Analysis

Disk access and restoration is a critical component of Digital Forensics. Here are some of the basic problems pertaining to media analysis:

• Complexity: Even as the size of physical hardware components shrink, the electronics of computer systems grows more complicated.
• Media Size Increases: With each increase in disk storage space, the operating systems and the programs they drive expand into a larger figurative electronic haystack.
• Data Encryption: Security, metadata, bit shifting, and any many other changes in data encryption methods lay snares before partition and data recovery efforts.
• Deliberate Concealment: Purposeful attacks against forensic traces include corrupted log files and MAC times.

Consider the following life cycle of HDD media:

• Begin with blank media.
• Perform a low level format. The individual storage units of a low level hard drive format are called sectors. Faulty sectors are remapped into an area that is identified as Redundant Sectors. Redundant Sectors are visible only to the HDD controller.
• Partition the media. The first sector on a disk contains a Master Boot Record (MBR) which includes the Master Boot Code (MBC) and the Master Partition Table (MPT). Each partition of a hard disk drive will contain a Volume Boot Code (VBC) and a Disk Parameter Block (DPB).
• Perform a high level format on one or more partitions. A high level format establishes a file system structure such as the NTFS Master File Table data base.
• Install the operating system.

Moving Into Personal Partition Recovery Needs

Though following the forensics aspects of partition recovery will take one deep into the principles and methods of data restoration, step now into the area of person computer needs. For sound understanding of what takes place during the application of partition recovery software, I suggest that you pursue an Internet search into the topic of Digital Forensics as it is presented in the education domains. For now, let us look at how partition recovery software relates to the NTFS.

Overview: Disk File System Internals

A file system is a structured method of storing computer data on a hard disk. How the data is stored is determined by the type of file system in use. The fundamentals of each file system type are OS dependant.

Along with an evolved file storage and security control method, the NTFS is designed to be recoverable. The NTFS establishes select control over each and every file and directory. The file information, along with the files attributes, is retained as a file unit. In turn, the file descriptions are retained in a Master File Table (MFT). The NTFS maintains a mirrored image of the MFT. Pointers to both the MFT and its mirror image are stored in the boot sector of the hard disk. A copy of the boot sector is also squirrel away in the logical center of the hard disk. This redundancy of data pointers and data information descriptions makes the NTFS a recoverable file system.

How Much Knowledge Do You Need

Intelligent software proves one of the greatest values of modern computer technology. Though not all inclusive (this would eliminate the need for data recovery specialists), several companies provide the average user with free or reasonably inexpensive partition recovery tools. In this final section, we will compare some of the options for home partition recovery.

Whether partition recovery software is free or expensive, the fundamental how-to of the recovery process will remain the similar. Though the internal methods of how the software performs its task may greatly differ between vendors, we are concerned with ease of use and with performance.

When applying a partition recovery software package, be certain to study the instructions. Look for differences between computers and specific hard drive layouts. Never execute a partition recovery program without thoroughly understanding how it will react to your specific computer hardware.

Here are the pointers.

The Internet links to various free partition recovery software providers. Most all free packages will include the following features:

• Basic partition recovery and undelete components, including create, move, resize, format, and delete;
• FAT/NTFS partition recovery;
• Original file name and file path restoration;
• Ease of use, graphical interface;
• Support for multiple operating systems;
• No cost and instant download;
• Limited user support.

Nearly every company that provides free partition recovery software also sells a comprehensive expanded package. Features not include in the free versions are such as follows:

• Absolute partition controls, including making a partition bootable;
• Handling features for establishing multi-boot environments;
• Complete disk and partition backup and restore routines, including disk-to-disk copying;
• Media building recovery tools;
• Low level disk defragment features;
• Extended user support.

If you are looking to resolve a one time problem and you have no great cares about maintaining an easy to implement backup and restore system, go for the free packages. Within the limits of their claimed functions, most of them will perform a successful partition restore.

For flexibility and user support, spend a few bucks.

Twenty dollars or less will purchase a basic, home-focused partition management software package. Consider also a full featured, hard drive management system. Look for the likes of Paragon Software Hard Disk Manager 2010 Suite. Such quality hard disk management tools will tap your pockets for no more than $50.00. The value is worth the price.