How data recovery software work

There are two operation steps

Search & Analysis:

This step involves the complete diagnosis and search operation. The Data Recovery software searches for the file system information from the beginning of the disk and reverse calculates the disks file structure. The various file system information comprises of partition tables, boot records, file allocation tables, directory structure etc. It also finds previously existing partitions. The analysis is done using different modes or levels.

Quick or Basic Mode:

First the basic mode is run which quickly analyses the disk and displays the files. Most of the cases are resolved in this mode itself. Cases like, deleted files, corrupted partition, boot records, one FAT is damaged. In this mode the data recovery software first searches and picks up information from partition table if it does not exist then picks up related information from the boot sector and so on. It then does a reverse calculation and fills up the blanks that have not been found. When all the parameters are calculated, the folder structure is searched and listed as a directory tree form. 100% data recovery is possible if one FAT table is present. Otherwise it simply saves all files contiguously. So if there are fragmented files, they will not be properly saved.

Advance or Exhaustive Mode:

For more complex cases like, disk format and partition change, lost folders or change in partition type the Data Recovery goes into an exhaustive search mode. This is an exhaustive method where all lost folders/files are excavated. Here if folders are found then they are linked to the existing file system format, if not linked then it again calculates the file system format for this folder and lists it in "lost" folder.

Raw recovery Mode:

If both the above modes fail, this mode retrieves pre-defined data file types. Each data file (like DOC, XLS, PDF etc) has a standard structure (Header, End of file marker). In this mode, these strings of headers and end-of-file markers are searched from start to end of the hard disk. As and when the data types are found, they are tagged and saved to the destination with a different file name.

Display & Save:

After the analysis, all files and folders are displayed. Select the folders/files that are be recovered and save them to a working drive, ZIP, Pen or floppies. Since from the directory structure we can find out the date, type, status of each file, the data recovery provides options to select only deleted files, or files that were created after a certain date etc.

Saving data is also to be done carefully. Do not save data on the crashed disk itself. Before saving, make sure that the destination disk has enough free space. Do not save data in the root of the destination directly, make a folder and then save data in it.