A leading private investigator singapore & worldwide explains data recovery
1. A LEADING
PRIVATE
INVESTIGATOR
SINGAPORE
&
WORLDWIDE
EXPLAINS
DATA
RECOVERY
http://www.sk.com.sg/ A Leading Private Detective Singapore & Worldwide 1
2. This eBook fully owned by a leading private
investigator Singapore and worldwide but is for free
access by the general public. You can share the whole
eBook or part of its contents but you are not allowed
to alter its contents. You are therefore prohibited from
altering the contents of this eBook as that can lead to
penalization. Do feel free to share it with your
friends, colleagues and any other external party
though without changing its contents whatsoever.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 2
4. Data recovery comes in handy when you lose critical data.
The demand for this service has grown a lot over the last
decade because everything is now computerized and needs
some sort of storage. It could be due to power outage or
forgetting to save a document that you lose your data or
even a disaster.
The bigger the size of the storage media, the more data is
lost when damages to the media occurs. Due to the increase
in the use of digital media and computers, increase in the
need of storage capacities has been realized. This has
further increased the risks of data loss.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 4
5. It has been noted that people are losing critical data that
takes a lot of time, energy and effort to create thus losing
such data can be very agonizing hence the need for data
recovery.
You can recover lost data on your own or use the services of
a data recovery company. Recovering data on your own can
be very risky because this is a serious and sensitive matter.
It is wise to seek professional assistance for lost information
that is worth more than the amount it will cost to recover
the data. Whatever the reason for your data loss, it is
possible to retrieve it.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 5
6. Data can be stored in media such as floppy disk,
CDs, PDAs (personal digital assistants) DVDs,
memory cards, magnetic disks, and RAID
configurations of HDD, hard disk drives
(HDD), Mobile phones, tapes, data cartridges,
zip disks, flash disks and Xboxes among others.
Data recovery can be sought by various people
or clients such as government, students, small
and medium businesses or enterprises, large
corporates or even those who are self-employed.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 6
7. Copyright/Disclaimer
Data Recovery
Introduction
Background Information
Chapter 1
Definition and Overview of Data Recovery
Sources/Causes of Data Loss
A Typical Data Recovery Process
Data Recovery Techniques
Mechanical/Physical Data Damages
Logical Data Damages
The Most Common Hard Disk Drive Problems
The Do’s and Don’ts In Case of Data Loss
The Process of Data Recovery
Importance of Data Recovery
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 7
8. Chapter 2
Data Recovery Software
Data Recovery Companies
Disadvantages of Data Recovery Companies
Choosing /Selecting the Best Data Recovery Company
Chapter 3
Prevention of Data Loss
Qualities/Attributes of Good Data Recovery Software
Data Backup and Disaster Recovery Plan
Types of Backups
Qualities of a Good Backup Device
Types of Backup Devices/Solutions
Backup Tips
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 8
9. Good Backup Strategy Tips
Disaster Recovery Procedure Development
Conclusion
About the Author
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 9
11. Retrieval of lost data and information from a storage media
that is inaccessible, deleted files or corrupted files is
referred to as data recovery. Electronic devices such as MP3
players, computers and digital cameras store information on
storage devices such as flash disks, hard disks or even
diskettes. Every storage media poses a different challenge in
data recovery. The process of obtaining data is very labor
intensive and complex. For a successful data recovery to
take place, you need to understand the technical aspects of
the latest technological storage media, file systems as well
as operating systems
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 11
12. Other resources required are well trained and
experienced technicians in data recovery and a
computer laboratory that is equipped and well
controlled. Using these resources reduces chances of
more data loss or devastating damages to the storage
media.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 12
13. Data losses are caused by either physical or logical failures.
Logical failures include virus infections, deletion of files, power
surges, human errors as well as formatting and reformatting of
hard disks.
Logical data losses are much easier to retrieve as long as the data
has not been tampered with or even overwritten. Physical
failures are brought about by mechanical damages to the storage
media. The damages can be as a result of water or fire and in
case of a hard disk, the spindle usually stops functioning.
When a physical failure occurs, the physical storage media that
is damaged must be repaired first before data can be recovered.
Whereas specialized techniques and technology enables data
recovery, it is impossible to recover or obtain data from storage
media that is extremely damaged.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 13
14. When a physical failure occurs, the physical storage media
that is damaged must be repaired first before data can be
recovered. Whereas specialized techniques and technology
enables data recovery, it is impossible to recover or obtain
data from storage media that is extremely damaged. Data
loss can also be caused by natural disasters or tragedies
such as earthquakes, tornados and floods, improper storage
of the devices, power failures, accidental and intentional
deletion of files, software bugs, fire, firmware corruptions,
business failures,
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 14
15. crimes (such as hacking, theft sabotage and acts that
are malicious such as viruses, worm and hackers or
even theft of physical storage media) dropping of
storage media and failure of semiconductor.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 15
16. A typical data recovery process involves four steps namely:
disk repair, disk image, data retrieval and data restoration.
The damaged hard disks are diagnosed before they can be
repaired as well as firmware failures. Any damaged
components of the hard disk are replaced with new ones.
Data is then removed from the repaired disk and transferred
to another onto which a disk image is created to ensure that
the data remains just as it was before damages occurred to
the previous disk. Data retrieval involves diagnosis and
repair of corrupted or damaged file systems so that
individual files can be accessed. Once the individual files
are opened, the corrupted ones are then repaired. Data
restoration involves moving of the retrieved data to a new
storage location and finally, it is given back to the owner
(client).
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 16
18. Storage media physical damages are caused by various
failures. The dye layer or metallic substrate of DVD/CDs
usually get scratched thus causing a physical damage.
Failed motors and head crashes cause mechanical failures to
hard disks. Breakage of tapes is another type of mechanical
failure. These mechanical damages not only lead to data
losses but also destruction of the file system logical
structures. Data or file recovery cannot take place until all
logical damages are fixed. End users are not in a position to
handle mechanical damages to storage devices because they
do not have the required technical expertise and the disk can
be exposed to data which is very harmful.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 18
19. Dust causes crashes of the read/write heads and platter
(which are very sensitive) of hard disks which can lead to
further damages that could render data recovery process
futile. There are several techniques of obtaining data from a
hardware that is physically damaged.
The damaged parts of the hard disk are replaced in order for
the disk to be used again but since there also logical data
failures in the disk, they have to be repaired as well. Disk
imaging is used to obtain all data that is readable from the
disk surface and the image stored on a new storage media.
Afterwards, it is analyzed for any logical data damages to
enable the reconstruction of the original file system before it
was damaged.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 19
20. Procedures of data recovery on damaged media may include
replacement of a PCB (printed circuit board) that is
damaged with one that is new or working, swapping of live
PCB in which a donor drive is used, assembling of
read/write heads with compatible working drives and
removal and installation of hard disk platters of a damaged
drive to one that is in good working condition. A
combination of these procedures can also be implemented
in a single data recovery process. Most of these procedures
require technical expertise and hence cannot be used by end
users.
The nicks and scratches on optical disks such as CDs and
DVDs using repair products that can be purchased from
computer shops. The nicks and scratches are filled with the
product and then the surface is sealed. When done
successfully, previously inaccessible data can then be read.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 20
21. In case of raid configuration errors such as RAID 0, it
is split over two physical drives that are different to
recreate the RAID array in order to salvage data on
the each of the drives. They are later merged to create
the original data.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 21
22. These kinds of damages can be repaired by end users unless
the extent of damages is so serious that it would need the
attention of an expert. Corrupt partition tables, damaged file
systems and media errors can render data unreadable.
Deleted data or files are never completely lost because they
usually leave footprints through which they can be tracked.
Specialized software for data recovery can be used to repair
these damaged and corrupted partition tables, file systems
and errors on the storage media hence recovery of all or
portions of original data before the damage occurred.
Testdisk is an example of such specialized software.
Imaging of media irrespective of the logical errors
discussed above can be performed by software known as
dd_rescue. Data carving which is salvaging of damaged
files using their file structures can also be used in data
recovery.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 22
23. There are also simple tools and methods that can be used in data
recovery that do not require any knowledge and experience in
using them hence can be used by end users. Magnetic force
microscope can be used to recover overwritten data theoretically
though practically it has not been proven. Hence it is difficult if
not impossible to recover overwritten data. Overwritten data on
SSD (solid-state drives) is easier to salvage than those on HDD
(hard disk drives). Data on SSDs are stores in blocks and pages
of flash memory that use LBA (logical block addresses) for
referencing. FTL (flash translation layer) is used to manage
these logical block addresses used for referencing. New data is
written to another logical block address by the flash translation
layer and updates mapped to reflect the changes. This ensures
that the pre-modified data remains intact and can be obtained by
specialized data recovery software.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 23
24. Unlike physical damages to storage media, logical damages
can be recovered from a remote location using remote
access software such a Team view and windows remote
desktop connection among others. All that is required is a
stable connection with adequate bandwidth between the two
locations connected either through the internet or any other
network connection.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 24
25. Deletion of files
Commercial software, proprietary software and HEX editors are
used to retrieve deleted files from hard disk drives. Before sending
a hard drive that contains the deleted files for restoration to a data
recovery company you can use the commercial data recovery
software to try restore the data.
Electronic Damage
Electronic damage is usually repaired using PCB swaps as well as
tools used to repair the hard disk’s firmware.
Failure of Heads
Hard disks always become inaccessible when its read/write head
fails to function. The failed heads are either repaired or replaced.
The hard drive platters are usually swapped to a working hard disk
to retrieve the data it contains.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 25
26. Head stack assemblies can also be swapped and in case the
platters are not damage, a full and successful data recovery
can take place. Head swaps must always be done in a clean
100 room.
Spindle lock up
Removal or repairs of platters are usually done when
spindles lock up. Removal and swapping of platters is done
using special tools. This type of head transfer requires a
high level of skill and not just anybody can do it.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 26
27. There are certain data losses that cannot be recovered
no matter what. These types of losses can be said to
be irreversible. Extreme electronic damage, damaged
platters and overwritten information (overwritten
several times) or data on hard disk drives cannot be
repaired for data recovery. This simply means that
data loss due to these scenarios is impossible to
recover.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 27
28. In case of data loss, note down the last installed software, the
last upgrades and the last application that was run. Do not alter
anything on the drive where the data is saved or on the data
itself.
Do not attempt to open the drive to try and repair as the
condition of the environment can cause irreversible damages to
it.
Do research for a good data recovery company which should be
among the best in the industry if not the best.
If you need to continue working on something else, create a
mirror and use a different drive so that you do not affect the
drive with lost data.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 28
29. Cover up the hard drive with a thick layer of shock
absorbent material because it is sensitive to any
knocks.
Remember that the faster you solve the problem the
better and vice versa.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 29
30. The data recovery process ranges from simple to complex
processes that are very detailed and exhaustive.
Evaluation
Evaluate the damaged storage media to determine the
potential of recovering the lost data, the kind of work that
will be involved to salvage the data and the extent of
damage to the media.
Estimation
Estimate the steps that will be taken to recover the data,
amount of data that can be recovered, amount of work that
will be involved and ultimately the amount of money it will
cost to recover the lost data.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 30
31. Mirroring
If the storage media can still function physically,
mirror all accessible data to a new location as this
will ensure that the original storage media is
preserved just in case future access to it will be
needed. Chances of a full data recovery are also
greatly improved.
Repair
All physical and electrical damages that prevent the
storage media from accessing data must be repaired.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 31
32. Logical Data Recovery
The raw data on the storage media (drive or disk) is recovered
logically using specialized data recovery software.
Data Analysis
To ensure that the recovered data from the damaged media is intact
and can be used, it has to be analyzed. A report containing
information such as the kind of recovered data and what could
have possibly brought about the data loss among others, is written
and provided to the client.
Storage and Return
The salvaged data is then stored on any type of storage media and
returned or given to the owner.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 32
33. The importance of data recovery sorely depends on
the importance of the data that has been lost. If the
lost data is very critical to you or to the business in
that you risk losing a lot of money time, then data
recovery becomes very important and must be
considered as soon as possible before more damage
occurs to the data or the storage media containing
it. It could lead permanent loss of the data.
It prevents loss of critical data when the data is
backed up from the damaged storage media.
It is the most economical and effective way of
salvaging important files and data.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 33
34. It ensures recovery of lost emails, fails, tasks and data
comprehensively.
Specialized data recovery techniques that improve the
chances of a successful full data recovery are used.
Information on data protection can be provided by
data recovery companies.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 34
36. Data recovery softwares are specialized programs that are
mainly used in obtaining lost data from a storage media.
They are very efficient and effective in repairing as well
recovering lost data, storage media, databases and corrupt
file partitions. They help to obtain data and files safely
without errors or further damage to the storage media
before the lost data is obtained. Some of the software used
are open source (free to be downloaded from the internet)
while others have to be purchased from the vendors. They
can be bought online from the vendor’s website.
Data recovery is not done on an operating system that is
running but a live or bootable CD, disk or USB.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 36
37. Examples of these types of programs are BartPE, Knoppix,
BackTrack, SpinRite, WinPE, SystemRescueCD, Hiren’s
BootCD, Ultimate Boot CD for Windows, Trinity Rescue Kit
and Lazesoft Recovery Suite Home Edition among others.
The programs used to check for consistency are Disk Utility,
Disk First Aid, CHKDSK and fsck among others. Data recovery
software programs used in the process of obtaining or salvaging
data are Foremost, Norton Utilities, Recuva, TotalRecovery,
TestDisk, TuneUp Utilities, FileSalvage, IsoBuster, CDRoller,
dvdisaster, DataLifeSaver, PhotoRec, PC Tools File Recover,
GetDataBack and Disk Drill Basic among others. Program
imaging tools that are used in the data recovery process are
ddrescue, StoreGrid BMR and CopyCatX among several others.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 37
38. These are professional data recovery companies that specialize in
salvaging of lost data from storage media at a fee. These
companies have highly trained data recovery technicians and
engineers with expertise and experience that are required for a
successful data recovery to take place. The companies also own
laboratories that are well equipped will all the required tools and
equipment needed for data recovery.
They charge fees for the services offered to their clients. Fees
charged depend on the extent of damage to the media and the
expected turnaround time by the client with cheaper services
taking up to two weeks. There are small data recovery companies
that deal with minor data loss issues and big companies that deal
with more serious issues that the smaller companies cannot handle.
Though not all data can be recovered, data recovery companies can
salvage quite a percentage of lost data.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 38
39. A good data recovery company must be licensed to
operate the business by relevant authorities and
accredited with Quality Assurance standards
ISO9001-2000 by the right standardized body as well
as certification to ISO BE EN 14644. The data
recovery company should also have relevant
experience in handling data losses.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 39
40. Turnaround Time
Turnaround time is the time between submission of a damaged
media and return of recovered data to a client. Data recovery
companies never guarantee a fast turnaround time hence it is
important to contact the company before the end of the
scheduled time to find out if everything is going on fine.
Pricing
Data recovery companies have been known to quote prices that
are extremely high. Unless it is promotion that is special, do not
accept offers from companies for flat rate fees as they might be
scams. A good company should evaluate a damaged disk before
quoting a price. A good company should provide a price range
and not flat rate fees.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 40
41. Partial Data Recoveries
Partial data recovery is when a full data recovery is
not successful and only a portion or part of the
original data is salvaged from the damaged media.
Some data recovery companies tend to get the cost of
money worth a full data recovery when they just
performed a partial recovery. You should agree with
the data recovery company that you will only pay for
recovered data and if no data is recovered no
payment will be made.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 41
42. There are so many scams and imposters in this industry thus
it is very important to choose the best data recovery
company that is genuine. There are things that you can look
for in your search for a reliable company to recover your
lost data and be very cautious and careful in your search.
Clean Environment for Recovery
Hard drives are storage devices that are very sensitive thus
should be handled and opened in very clean rooms without
dirt. If dirt gets in contact with hard disk platters, they can
be damaged so badly beyond repair. A good data recovery
company should therefore have clean rooms of class 100
with clean flow benches.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 42
43. 100 mean that there are 100 micro particles in every
cubic foot of air.
Previous Clients/Customers
Find data recovery companies that are highly rated by
their past clients and they should also have
testimonials from the clients who were happy with
their services. The more repeat customers they have
the better because that is a sign that they offer great
services. You can also look for customer reviews in
the data recovery company’s website to get to know
what past customers feel about the company.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 43
44. Safe Methods/Techniques
A good data recovery company is one that uses safe
methods or techniques that are not destructive to obtain lost
data in hard drives. Merely running recovery software on
the damaged storage media can lead to further loss of data
hence should be avoided. Hard drive companies will always
refer you to a reputable company that offers data recovery
services and has been investigated to prove so.
Cost
Depending on the extent of the problem with the damaged
media, the recovery process can cost between $800 and
$1500. You should not spend an amount that is either too
high or too low as compared to the price range.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 44
45. Most evaluation services used to determine causes of data
loss are offered free of charge by most of the data recovery
companies.
Flat fees
Flat fees should be charged on SD cards but not hard disk
drives as this can greatly lower the chances for a successful
data recovery. A company that offers flat fees on data
recovery services from hard disks could just be scams so be
wary of them. Most companies quote prices after an
evaluation of the damaged storage media. A good company
should not charge for data they have not been able to
recover. http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 45
46. Chance of a Successful Data Recovery
This is measured in terms of percentages and most companies have
a chance of recovery between 80% and 90%. Request for the
company’s rate of having successful recoveries and how they get to
that figure. It should be rated entirely based on complete recoveries
and not partial or unrecoverable hard drives.
Very few data recovery companies meet these criteria so ensure
that the one selected does meet them.
Speed of Service Levels
Service levels include RAID array, expedited, flash media, hard
drive, emergency and slow services. You should find out a data
recovery company’s turnaround time and pricing for all the
services levels.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 46
47. A good data recovery company is one that works at great
speeds yet still offers quality services. Compare the prices
from different companies to determine the best that suits
your needs and fits your budget.
Technology
Technology is always changing day in day out and so are
the software and hardware components in the market. It is
good to keep pace with technological changes. Choose a
company that implements the latest technology in their
recovery processes. All firmware repair tools must also be
the latest and up to date. http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 47
48. Experience
Look for a data recovery company that has several years of
experience in offering the services. The expert engineers
and technicians must have hands on experience in
recovering data from damaged storage media. A good data
recovery company with experience will not only guarantee
a good service but also increase the chances of a successful
recovery.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 48
50. Nothing can guarantee the prevention of data loss but a
good where to ensure maximum data loss prevention is by
putting in place a policy that combines protection of power
failures using backup batteries, generators and several
power circuits; RAID storage and journaling file system,
regular backup of data, network firewalls and antivirus
protection, up to date security fixes and system patches and
ultimately, education of the end users on data loss
prevention
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 50
51. Even when the recycle bin has been shredded, it should be
possible to recover deleted files.
Even after a malicious attack, files should be unrecoverable.
Files should be recovered from a failed and reformatted
hard disks or even a crashed system.
All file types should be recovered.
Data from all kinds of storage media should be recovered.
Files should be recovered not just easily but also
successfully.
Data backup must be created of file systems that are critical
to the business.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 51
52. Prevention is always better than cure. Backup is making
copies of data or information and keeping in different
storage media in a different location from the original file. It
is stored so that it can be used in case the original file is lost
when data loss occurs due to one of the several reasons that
cause it.
Data backup is performed mainly for two reasons: for later
computer system restoration after a fatal disaster and for
data recovery. Backup is the most important way of dealing
with data loss hence the more important stored data is the
greater the necessity to backup it up. This means that the
importance of data is directly proportional to the importance
of backup. When the data importance increases so does the
http://www.sk.com.sg/
backup necessity increases. A Leading Private Detective
Singapore & Worldwide 52
53. The company or business size is also directly proportional
to backup necessity. Backup will enhance a fast and
successful data recovery to get the business up and running
as it was previously before the disaster occurred.
Having a disaster recovery plan in place and regular backup
of data can be of great importance in case of data losses or
when a disaster strikes. The created backups must be stored
in a separate location from where the systems and should be
tested for functionality and ability to restore damaged
systems to back to normal working conditions. End users
can schedule regular data backup operations in their
computers without seeking professional help. Computer
restoration can help retrieve minor data losses and system
changes by restoring it to an earlier date.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 53
54. Backup systems should be reliable to guarantee data recovery in
case of disasters and damages to hard drives. The hard drives
should also be kept away from extreme temperatures that can
damage them thus causing data loss. It should also be protected
from damages that can occur from the surrounding environment.
You can also use surge protectors to protect your computers
from electricity fluctuations that usually cause short circuiting.
For backups done on the same computer, they should be stored
in drives that are different from the one the system’s operating
system is running on.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 54
55. Full backup
This involves backing up of all selected files. The file
archive attributes are deleted and later set when the file is
changed to show that back up is needed. It is also known as
normal backup.
Differential backup
It creates copies of files that have been modified since the
last full backup and backs them up. Files with archive
attributes need backup but the attribute is not changed to
allow for other backup types in the future.
Copy backup
Despite the state of the archive attribute all selected files are
backed up. Files with archive attributes are backed up but
not changed to allow for other backup types in the future.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 55
56. Daily backup
The file’s modification date is used for backup. Changes to
files and their backup takes place on the same day. File
archive attributes are not modified.
Incremental backup
Backs up only the latest changes to files since the last full or
incremental backup. Files with archive attributes are backed
up and the attribute deleted afterwards. The attribute is set
when files are modified to show that back up is needed.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 56
57. Should be reliable to perform when needed.
Should have a high capacity to store more data.
Should be very extensible.
Should be of high backup and recovery speed
The cost should fit into your established budget.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 57
58. The types of backup solutions available in the market
are removable disks, DAT (Digital audio tapes)
drives, Tape drives, Magnetic optical drives, Disk
drives, Tape juke boxes and Auto-loader tape
systems.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 58
60. Tips#1 Data Backup Plan
Think of the place where your data backup is kept.
Do not keep backups in basements if you live in an area that
flood.
In case of a natural disaster like earthquake, is it possible to get
your data? An online or offsite backup could just work for you.
To protect against theft, fire and other disasters, store a full data
backup in a separate location.
Quarterly and yearly backups are essential for critical data.
Tip#2 Start a Backup Routine
Schedule daily data backups
Do backups yourself
Backup your critical data
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 60
61. Tip#3 Customize data backup strategy to meet your
needs
Determine the frequency of your data change in order to
determine a backup schedule. Data that changes every hour
should be scheduled for a several backups in a day whereas
those that change every week require daily backups.
Have at least three separate data backups.
Supplement full data backups with incremental backups
which are quicker and also only backs up changed files
since a full backup was last done.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 61
62. Tip#4 Test Backup Regularly
In order to ensure that backups will work well in case of a
disaster or data loss, it needs to be tested periodically. You
can also attempt restoration of backup to a different location
to test whether it works and can protect you. You will be
able to determine any corrupt data or any flaws and fix them
in time. You can also use backup reports and logs to
determine any files that have been skipped, errors or any
problems that might have occurred.
Tip#5 Two Separate Backup Locations
For total protection of your data, you should have three
copies of your data: the original copy, a backup that is easy
to access and another protected backup. An online data
backup service can be used to keep the protected backup
copy. http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 62
63. Preparation
Preparing in advance for a disaster can facilitate data
recovery process in case of one. The use of computers
increase daily hence the risk associated with storage system
failure and data loss. A disaster recovery policy should
incorporate data losses such as malicious or accidental
deletion of data, power failure, corruption of data, fire
outbreaks, theft, viruses, failure of hard disk and natural
disasters such as earthquakes and floods among others. A
disaster contingency plan should incorporate business
processes that are critical to the organization.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 63
64. You should also consider general disaster risk assessment
to involve customer, monetary, regulatory and legal
exposures and dependencies interdepartmental level. For a
full-scale backup restore operation that ensures the
objectives of recovery time, a disaster recovery plan should
also incorporate data freshness window and recovery.
I/O and network topology technology does not keep pace
with set data sizes and CPU performances technology that
doubles every eighteen months. The main objective of
disaster recovery implementation architecture is to decrease
the capacity of data to be transmitted while the overall data
rate is improved. http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 64
65. Need determination
Depending on your system architecture and the operating
system running on your systems, consider the following
questions.
What failure scenarios are likely to occur?
What data should I consider critical?
How frequent should backup be scheduled to take place?
When should a full, incremental or differential backup be
scheduled to take place?
Will backup be scheduled to take place automatically or
manually?
How is a successful backup verified?
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 65
66. How are useful backups determined?
How long will the backup be saved before the medium is
reused?
How long will last backup restoration take?
Where will the backup storage media be kept?
Will authorized personnel be allowed to access backup
storage media for restorations?
In the absence of the system administrator, what will be the
source of backup procedures and system password
acquisition and in case performing restoration is necessary?
Is there a disaster recovery policy in place that can
incorporate the above?
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 66
67. Practices That are Recommended
When developing a disaster recovery plan, you should
consider the following:
Backup and restoration procedures should be developed
using the appropriate personnel and resources.
To ensure that data can be recovered in a timely manner,
you need to test the procedures.
To avoid catastrophic failures, you need to back up the
whole system volume.
To prevent security information and user accounting from
loss, backup the active directory.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 67
68. For faster granular file restorations, all available logs should
be backed up.
Keep three backup copies in storage media with one kept in
an environment that is controlled at an off-site location.
Verify if backups are proper and successful by performing
trial restorations periodically.
Put precautions in place to ensure that nobody else restores
data to the wrong servers.
Detailed system component descriptions should be
maintained to help in case of hardware failures that are very
severe that calls for system replacement or rebuild.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 68
69. The descriptions should contain system components like
tape drive, drives, IRQ, Network card configuration,
memory, CPU, Video mode settings, SCSI configuration,
DMA and I/O among other components.
A list of current patches that are installed on every system
environment should be maintained and OEM specific
drivers, patches, Net Vault and O/S media used for
distribution should be readily available.
Maintain each system configuration profile that is up to date
and should include machine names, network settings
(TCP/IP configurations), account and domain information,
layouts of disk partitions, sizes of partitions, disk
configurations, installed O/S patches and partition system
file format type.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 69
70. System Crash Restoration
You should first determine the cause of data loss in case of
system failure and repair it before restoration takes place. In
case of a disaster, system rebuilds or repair is done.
Restoration of a repaired system that was damaged should
include the following steps:
The O/S is re-installed.
OEM drivers are installed.
O/S patches are installed.
Net Vault Client is installed.
Net vault patches are installed.
Data is restored.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 70
71. Restoration of Net Vault Server
The O/S is re-installed.
OEM drivers are installed.
O/S patches are installed.
Net Vault Server is installed.
Net Vault patches are installed.
Net Vault devices are configured.
Net Vault database is scanned in the tape that contains it.
Net vault database restoration.
Data restoration.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 71
72. A data recovery plan should be created by the whole
organization or company and not just an IT department or
data centre to make it a corporate-wide plan. It is a long
term project that should include logbooks, operating
procedures that are standardized, a scheduled tape backup
rotation that is reliable, problem isolation procedures and
data flow diagrams. It will facilitate the isolation of
application bugs, lessen support personnel and
requirements, lessen mistakes made during operations as
well as a general system and application that are easier to
maintain. Net Vault software for network backup and
restore provides a data insurance policy that is the simplest
and fastest.
Data recovery can be done either manually or scheduled to
take place at a designated time and day.
http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 72
73. The Author of this eBook is a prominent and a leading
private Investigator Singapore and worldwide. He has
worked in this industry for so many years and earned
himself a lot of respect, experience and a good reputation.
Though he is knowledgeable in investigative cases, he also
has skills and knowledge in data recovery. He took his time
to write this eBook because data loss is something that
occurs on a daily basis without giving warning signs hence
inevitable. Individuals and companies lose millions of
dollars everyday due to data losses hence it is important to
invest in a backup and data recovery procedure and
management plan. Many people are looking for information
from someone with hands on experience in data recovery.
The eBook basically covers everything one might want to
know about data loss, data recovery and preventive
measures to avoid data loss. http://www.sk.com.sg/
A Leading Private Detective
Singapore & Worldwide 73