Data recovery is necessary when source material fails and where no good backup exists, either Physical or Logical. There are two types of data recovery in the standard basic sense. One type of data recovery is when there is damage to the media and the pre-existing data need to be retrieved. This will usually require the media to be repaired.
The second form of data recovery is when files were purposely or accidently deleted. When this type of data recovery is necessary there is usually no damage to the media and standard software can be used to recover the data. This is the process that most software performs. Very few software programs understand damaged media. Because most software relies on calls and functions from the operating system for its input, it has no control itself over error correction or any functions that the operating system performs on the drive. I believe there a four phases to any data recovery.
Four Phases of Recovery
1. Repair the Hard Drive so it is running in some form, usually requiring hardware or special equipment.
2. Image, Copy or recover the physical drive and sectors primarily by bitstream imaging. If the drive is functioning, it is possible to do this with software, however there are some hardware solutions that work very well; i.e. DeepSpar Disk Imager. This is a situation where some software is better than others, such as dd_rescue (use with dd_rhelp script) on a Linux system has a special feature that allow it to image backward (understanding why you need to image backwards is very important in data recovery).
3. Perform Logical Recovery of files, partition structures, or necessary items; usually this is by software and is the most common type of application sold.
4. Repair of files that might have existed in damaged space or sectors to recover what is possible. This is usually the requirement in Forensics to be able to re-assemble data to display what was there, if whole or not. This is also applied in data recovery for corrupt Word and Excel documents.
