Understanding Your Recovery

Operating systems use a file system to store metadata and track which portion of the disk is used and which is empty. Windows defaults to the NTFS (New Technology File System) file system but also has FAT, ExFAT, and ReFS file systems. Apple defaults to APFS (Apple File System) currently but has created and used HFS+. Each file system handles data differently but uses the same core concepts. There is a file table that keeps and maintains all information about the file. This is the Master File Table on Windows and the Catalog on Mac. Information kept includes the files name, folder location, time stamps, permissions and most importantly the location of the data belonging to that file.

Data recovery primarily focuses on imaging data from a broken or malfunctioning device to a new device. In some cases, unreadable sectors are encountered during the recovery process. We attempt to reread them in different modes but sometimes read errors can be located where the filesystem is stored. Every error in the file system leads to between 1 and 4 files losing their attribute(s) and location information. Many read errors in the file system leads to not only many files not being listed and located but it breaks the folder structure too. Part of a folder chain can be orphaned from the root directory, so the file system no longer know where it belongs. Some recovery cases have most, or all of the file system stored on that damaged surface meaning most or all of the file structure and file names are now lost.

Recoveries including raw files are not ideal but are the only way to recover these orphaned files. We do our best to organize these files to make them easier to locate and browse. Fully orphaned files with no reference in the file table are sorted by file type. This structure would for example be “Extra Found Files\Graphics and Pictures\JPEG Digital Camera\0000023.jpg” The top level or root folder “Extra Found Files” refers to the contents being made up of fully orphaned files with no reference in the file system on the drive. Graphics and Pictures organizes these orphaned files into categories. Other categories include Archive, Documents, Spreadsheets, Audio, and Video. Within those category folders you find folders for each extension under that category. The folder “JPEG Digital Camera” has all jpg files that have camera metadata in the file. This is the most useful way we can find to organize these files to make them easier to browse and digest.

In other cases, there is partial folder structure information, and the file metadata is preserved. This is ideal because the file location is known and its name. These will also appear under Extra Found Files. Since the folder chain is disconnected from the root or base folder, it is placed under Extra Found Files but in its own folder chain instead of a file category. These can also be challenging because it is hard to know where the file came from. This is the best result in the circumstances because it will be a complete file due to the full location on the disk being known. It is easier to sort because the names, dates, and other attributes were preserved. The combination of orphaned files and broken folder structure is expected for a recovery with a high amount of read errors. We avoid raw results, when possible, but it is critical to present all of the data recovered and let you decide what data you wish to keep.

Partial Recovery — Physical Media Damage

A partial image recovery indicates that portions of the hard drive were physically inaccessible during the data extraction process. This is most commonly the result of internal mechanical damage, such as degraded read/write heads or a head crash, where the heads come into contact with the platter surface and damage the magnetic layer that stores data. This type of impact can create permanent surface defects, leading to persistent read errors when attempting to access affected sectors. Additional factors such as platter scoring, media wear, or internal contamination can further degrade the drive’s ability to return reliable data.

As a result of this physical damage, certain areas of the drive were unreadable and could not be imaged, leading to gaps in the recovered data. These regions, often marked by unknown or skipped sectors, represent portions of the drive where no usable data could be obtained despite exhaustive recovery efforts. Files associated with these areas may be incomplete, corrupted, or entirely missing. The recovered dataset reflects all accessible data, and any unreadable regions are considered permanently lost due to the extent of the underlying hardware failure.