DAVORY: Data Recovery

1
DAVORY Data Recovery

• Supervised By
• Dr. Lo'ai Tawalbeh
• Prepared By
• Ibrahim Al-Shurbaji

2
DATA RECOVERY

• Data RecoveryData recovery is the act of
  salvaging data stored on damaged media, such as
  magnetic disks and tapes. There are a number of
  companies and software products that can help
  recover data damaged by a disk crash or virus. Of
  course, not all data is recoverable, but data
  recovery specialists can often restore a
  surprisingly high percentage of the data on
  damaged media.

3
DATA RECOVERY cont.

• Data recovery cases can be divided up into two
  main categories
• Common Recoveries Involves floppies and hard
  drives that are usually from single-user personal
  computers.  
• Complex Recoveries Involves hard drives, RAID
  arrays, tape and optical media or corrupted
  databases and file systems usually from
  multi-user, business systems. Data storage at the
  high end has become a very complex field. In the
  case of these complex systems data recovery can
  be seen as "troubleshooting data storage."  
• Whether common or complex, each data recovery
  case is unique and the process can be very
  resource extensive and exceedingly technical.

4
DATA LOSS

• What is Data Loss?
• Typical Characteristics of a Common Data Loss
  Situation
• Accidental deletion of data
• The sudden inability to access data from a
  previously functioning computer system or backup
• Accidental re-forming of partitions
• Hard disk crash or hard disk component failure
• Ticking or grinding noises coming from the system
  unit where the hard drive is located while
  powering up or trying to access files. This
  symptom almost always indicates a failing hard
  drive and is often accompanied by some of the
  other symptoms.

5
DATA LOSS cont.

• Consider these facts
• More data is being stored in smaller spaces
  Todays hard drives store 500 times the data
  stored on the drives of a decade ago. Increasing
  storage capacities amplify the impact of data
  loss, making mechanical precision more critical.
  A slight nudge, a power surge, or a contaminant
  introduced into the drive may cause the head to
  touch the platter resulting in a head crash.

6
DATA LOSS cont.

• Data has become more mission-critical Users
  today store more data on their desktops and
  networks that is mission-critical to their
  organizations and to their personal lives. Loss
  of mission-critical data, by definition, causes
  major business processes to stop.  
• Backup technology and practices have failed to
  adequately protect data Many users back up
  their data only to find their backups useless at
  that crucial moment when they need to restore
  from them.

7
DATA LOSS cont.

• They fail because the systems are designed with a
  set of requirements that rely on a combination of
  technology and human intervention for success.
  Taped, tape drives and cartridges do not always
  work properly, due to their dependence on
  mechanical perfection. Backup software can
  become corrupted. Users accidentally back up
  corrupted or incorrect information

8
WHAT TO DO?

• What to do
• In cases where files have been deleted or
  overwritten, it is important for the best chance
  of recovering the files not to write any new data
  to the disk they were stored on, because the old
  data will only exist until such time as the space
  it occupied on the disk gets used for something
  else. If the files were on the main drive of the
  computer you're using now, this means that you
  should turn off the computer right now, and use
  another computer to search for a solution to
  recover your data. You may even need to consider
  putting your computer's hard disk in another
  computer to do the data recovery, because
  installing the software on your own computer
  could overwrite the data you want to recover.

9
WHAT TO DO? cont.

• We understand that this may not be easy or
  convenient to do. So it's your decision. It
  depends on how important these lost files really
  are to you. Continuing to use your computer, and
  installing software on it, won't necessarily
  overwrite the data you want to recover. But it
  could. It's up to you.

10
DATA RECOVERY METHOD

• Choosing the data recovery method
• Choosing the right method to use to recover your
  data isn't easy. There are many different
  recovery tools on the market. Some are better at
  recovering deleted files, others are better at
  restoring overwritten files, or recovering files
  from damaged disks. Some are specialized for
  recovering photo images, or Microsoft Word or
  Excel document files, because they know what
  these files look like, and can retrieve their
  data even when all other clues to its existence
  have disappeared. One tool may succeed at
  recovering your files, even if another failed.

11
DAVORY

• DAVORY SOFTWARE
• by X-Ways Software Technology AG.
• X-Ways Software Technology AG is a stock
  corporation incorporated under the laws of the
  Federal Republic of Germany.
• The following operating systems are supported
• Windows 95/98/Me
• Windows NT 4.0
• Windows 2000
• Windows XP
• Homepage http//www.x-ways.net

12
DAVORY

• HOW TO USE
• There are two ways how to recover data using
  Davory. Both require that you select the disk to
  recover from.
• 1) Automatic recovery of files with given
  filenames. Preferred method.
• 2) Automatic recovery of files of a certain type.
  Try if 1) is not available or if you are not
  satisfied with the results. Does not require a
  healthy file system)

13
DAVORY

• Important At any rate, do not use the drive that
  you wish to recover from for writing data any
  more! You may inadvertently overwrite lost files,
  making them unrecoverable. This includes not
  booting Windows from such a drive any more, as
  booting involves numerous write operations as
  well. Davory can be run directly from a floppy
  disk or CD, and does not require a real
  installation using the setup program. Davory does
  not recover files "in place", on the original
  drive, but it recreates them on a different
  drive, so there is no danger of inadvertently
  making the data loss situation even worse. The
  original drive is not touched except for reading.

14
DAVORY

• Selecting the Disk

15
DAVORY

• Select the disk that contained the files you have
  lost.
• Preferably, select a logical drive (also called a
  "drive letter" or "volume"). In that case WinHex
  relies on Windows being able to access the drive.
  Selecting a physical disk (also called "raw
  device") on the other hand, means opening the
  entire medium, as it is attached to the computer,
  e.g. a hard disk including all partitions. If the
  disk is not properly formatted, damaged, or if
  its file system is unknown to Windows, so Windows
  is unable to make it accessible as a drive
  letter, select the physical disk instead. When
  you select a physical hard disk, it is
  recommended to open one of the partitions
  separately. Note that File Recovery by Name can
  only be applied to a logical drive or a single
  partition.

16
DAVORY

• If you notice that Davory does not detect the
  size of your disk correctly, you could either
  enable the option "Check for last accessible
  sector" in the case of a physical disk when
  selecting the disk, or use Disk Parameters later.
  Please note that searching the last accessible
  sector may cause very long delays, strange
  behavior or even damage on some systems.

17
DAVORY

• Limitations
• Under Windows NT, 2000, and XP administrator
  rights are needed to access hard disks.
• Davory cannot operate on remote (network)
  drives.
• File Recovery by Name
• Works on FAT12, FAT16, FAT32, and NTFS logical
  drives/partitions. You may specify one or more
  filename patterns that cover all the files you
  wish to retrieve, e.g.
• Letter to Mr. Smith.doc
• Invoice.pdf
• m.xls
• Image.gif
• .tif

18
DAVORY

• Please note that files that were moved to the
  recycle bin prior to permanent deletion are
  internally renamed by Windows, where only the
  filename extension remains the same. So if you
  wish to undelete files that were in the recycle
  bin before, specify only an asterisk before the
  dot (e.g. ".jpg", not "mypicture.jpg").
• Optionally WinHex only recovers files that are
  explicitly marked as deleted in the file system.
  It may be wise not to use that option if you are
  looking for files that got lost other than by
  normal deletion, e.g. due to file system
  corruption. In that case you can even switch to
  files that are not marked as deleted. With that
  setting you will recover only those files that
  existed at the time when the corruption occurred
  and no duplicates (like previously existing
  working copies, temporary files etc.) that were
  deleted because they were no longer needed.

19
DAVORY

• If you deselect "Use file allocation table where
  possible", Davory will always rely on files not
  being fragmented, recovering them as a continuous
  stream of consecutive clusters.
• Check Intercept invalid filenames to prevent a
  failure of the recovery because of filenames with
  characters considered as invalid by the file
  system. Useful for example if you wish to recover
  files that had filenames in a non-western
  language with a western-language Windows version.
  This option will rename such a file if necessary
  to ensure that it can be recreated.

20
DAVORY

• If you enable "Recover from one folder only",
  Davory will not search for the files on the
  entire drive, but only within the specified
  folder and optionally its subfolders (if traces
  of these subfolders can still be found). Only
  with both of these options (folder tree and
  subfolders) enabled, Davory will recreate the
  original folder tree within the output folder and
  will place recovered files into their respective
  subfolders. Not available for NTFS drives.
• On an NTFS drive, if the file you are looking for
  cannot be found, it may help to enable the
  "thorough" search. It is not enabled by default
  because it takes significantly more time.

21
DAVORY

• You also specify an output folder where Davory
  should recreate the original file(s). Important
  make sure this folder is on a different drive.
  Specifying a folder on the same drive where you
  are recovering from could easily overwrite disk
  space where deleted files reside that you still
  wish to recover! That way they would be lost
  forever. It might also lead to a loop, if Davory
  repeatedly "recovers" files that it has just
  recreated.
• Unlike File Recovery by Type, "File Recovery by
  Name" will also restore the file date time and
  its attributes.

22
DAVORY
23
DAVORY

• File Recovery by Type
• A data recovery function that searches for files
  that can be recognized by a certain "signature".
  Many file types have such a signature. Choose one
  more more file types from the list. To select
  multiple file types, hold the Ctrl key on your
  keyboard while clicking list items. More than 30
  file types are pre-defined.
• Davory tries to detect the original correct size
  of JPEG, GIF, PNG, BMP, TIFF, AVI, WAV, ZIP,
  HTML, RTF, and MS Office files automatically. If
  this fails, or for other file types, the files
  are recovered the fixed maximum size that you
  specify. Usually it does no harm to recover with
  a "too big" size (unlike "too small"), since the
  programs that deal with these files can tell from
  the file format where the actual end of file is.
  So be "generous" when specifying the size.

24
DAVORY

• The resulting files are named according to a
  pattern you provide (e.g. will result in
  files like 0001.jpg, 0002.jpg, and so on). A log
  file is written to the output directory as well.
  Optionally, files of each type will be put into
  their own subfolder, i.e. .jpg files into to the
  subfolder "jpg", .html files into the subfolder
  "html", and so on.
• By default, all files found on the disk (existing
  or deleted) are recovered. Optionally you can
  limit the recovery to files that are found in
  unused parts of the disk, that is to presumably
  lost or deleted files. Please note that this
  recovery mechanism does not produce sound results
  in the case of files that were stored in a
  fragmented way (in discontiguous clusters).

25
DAVORY

• You also specify an output folder where Davory
  should recreate the original file(s). Important
  make sure this folder is on a different drive.
  Specifying a folder on the same drive where you
  are recovering from could easily overwrite disk
  space where deleted files reside that you still
  wish to recover! That way they would be lost
  forever. It might also lead to a loop, if Davory
  repeatedly "recovers" files that it has just
  recreated.