If you are reading this, then sadly a hard disk failure is on the horizon or you have accidentally erased some important data and you’re seeking a way to address either of these matters. And for this, do-it-yourself data recovery applications are the best way to get started. However, it's wise to understand the terminology that is used in the data recovery industry to better follow the documentation and blog entries that are posted by industry players. Below are some of the most common terms that you need to know before tackling data restoration.
Standing for annualized failure rate, AFR is a statistic used by hard disk vendors to represent the estimated probability of a device or component failure in a full year of use.
Specific to newer Apple computers, the Apple File System was introduced with macOS 10.13 High Sierra and replaced the decades-old HFS+ file system used on Macs. Additionally, with the release of iOS 10.3, all iDevices compatible with that mobile operating system have been migrated to APFS.
Advanced Technology Attachment is a physical interface for connecting storage devices within a computer. ATA is used to connect the CD-ROM and hard disks to the motherboard and perform basic input/output functions.
The bootable partition of the drive that contains the operating system. A drive can have only one active partition.
In the data storage industry an “address” is the location where the data can be found on a disk drive.
An acronym for Basic Input/Output System, this is the non-volatile firmware that serves the scope of performing hardware initialization during the computer’s power-on startup. This firmware is the first software that runs when the computer is switched on.
A copy of a file, folder or multiple files; the entire contents of a disk for purposes such as archiving or a safe copy in case the original file is damaged.
A block is a disk sector that is storing data. A bad block or bad sector is a disk section that is no longer capable of storing data because it has been damaged or corrupted. A sector represents a physical area on the disk while the term block is used to loosely refer to a small chunk of data.
The smallest logical amount of disk space that an operating system can allocate to a file is called a cluster. It represents a number of sectors that are read or written as a group.
The procedure used to recover lost data from a variety of media, disk drives, and operating systems.
Compared to a quick scan, a deep scan is a data recovery feature that scours the targeted drive for accessible file fragments based on information that the software has on what the file signature should look like and then combines them together. A deep scan is more successful for large files due to how the file system distributes file fragments across the storage medium.
A computer file that is a sector-by-sector copy of a disk volume or an entire storage disk, such as an HDD or SSD. It exactly matches the content and structure of the copied source medium.
An acronym for file allocation table, FAT represents a data table that is stored at the beginning of each partition on the disk. This is the table that the operating system checks to determine which sectors are allocated to which file and in what order.
A command-line utility available in the DOS and Windows operating systems to create disk partitions. In modern versions of Windows, Fdisk has been replaced by the more advanced diskpart utility.
The file system is one the fundamental aspects of all computational processes as it is in charge of how files and data are stored and retrieved. There are various file systems and each one has its own structure, logic, speed, security, and more. File systems are used on storage mediums such as hard drives, solid-state drives, pen drives, and optical discs. The file system organizes files and directories and keeps track of their physical addresses as well as which sectors are not used. As a file is created, the file system allocates space or clusters to it. When the file is deleted, the space is then considered available for use by other files and is eventually overwritten.
An acronym for GUID Partition Table, GPT first appeared in the tech scene as part of the Unified Extensible Firmware Interface (UEFI) initiative. GPT's advantage is that it comes with a more flexible mechanism for partitioning disks compared to the old MBR (master boot record).
This common acronym stands for hard disk drive. An HDD is a medium that uses electromagnetic storage to read and write digital information on rotating disks called platters using magnetic heads. The HDD was introduced by IBM in 1956.
The damage that can occur to the magnetic head of an HDD. This usually happens when the disk suffers a severe shock – such as with a dropped laptop – or from excess dust or fingerprints on the head or platters.
The term IDE (integrated drive electronics) represents a standard electronic interface between the motherboard data path and the storage medium. The industry term also refers to the fact that the drive controller is integrated into the storage drive.
The communication channel – hardware or software protocol – that handles the exchange of data between the computer and device.
A logical address is an abstraction of the physical address of the data where the active software can make requests to store the file a user creates at an address understood by the software and the file system. At this point, the software knows nothing about the physical properties of a storage medium to read or write data from or to it.
Logical Block Addressing
LBA (logical block addressing) is a method used to identify the sectors – blocks of data – that are residing on a disk. It replaces the CHS (cylinder, head, sector) method that exposes the physical address of the data on a storage device and allows the computer to map large hard drives.
This is an abstraction of the available storage space on a physical disk. When a user creates a region on a hard drive or other storage medium, it allows the operating system to manage information on allocated regions separately. These regions, called partitions, are then mapped in a partition table that is read by the operating system so the partitions then appear as distinct logical disks. In Windows the letter ‘C’ is assigned to the primary or boot partition. In macOS and Unix-based operating systems, it is possible to format each partition with a file system or as a swap partition.
Master Boot Record
At the beginning of a partitioned storage device is a special type of boot sector called the master boot record (MBR), which contains information about how the logical partitions containing file systems are organized on that specific device. The MBR is common to all PCs, Apple computers support the Apple Partition Map (APM), while Intel-based Macs can boot only from GPT (GUID Partition Table) drives.
The New Technology File System (NTFS) was developed by Microsoft for the Windows operating system and has been the default file system since Windows NT 3.1. It supersedes both the file allocation table (FAT) and the high-performance file system (HPFS). NTFS has support from other desktop operating systems such as Linux and BSD via an NFTS driver, while macOS includes read-only support. To write to an NTFS-formatted partition or external drive, macOS users need a third-party driver such as Paragon NTFS or Tuxera NTFS for Mac.
On-Premise Data Recovery
The terms on-premise or on-premises data recovery is used to denote a service that requires the provider to visit the company or individual's physical office for the data recovery process to take place. This can be compared to cloud data recovery services, which don't require the physical presence of the service provider representative.
A contiguous space allocated on a storage disk that functions as if it were a physically separate disk. Both the system firmware and the installed operating system have to ‘see’ the partitions but access is controlled by the system firmware at startup. After that, the operating system takes over and controls access to the partitions.
The partition table is a data structure providing basic information about a computer's operating system and the division of an HDD into primary partitions. The partition table is located at the first sector (cylinder 0, head 0 and sector 1, MBR) of each hard disk and holds the data that details the sizes and locations of partitions. The partition table is limited to four entries.
Partition Format Types
The user must format a partition before use. Different operating systems offer or require different format types, and therefore its associated partition table is different. DOS and older versions of Windows (9x/ME) use the FAT format while newer versions of Windows (starting with NT or later) use the NTFS format. macOS computers older than 10.12 require the HFS+ format while macOS 10.13 or later require with APFS format for SSDs.
This is a quick preview feature developed by Apple and introduced in OS X 10.5 Leopard. Quick Look allows users to preview the content of a file in full or near-full size without the need to actually launch the software associated with the file just by simply pressing a button.
Most data recovery apps offer two basic scan methods: quick and deep scan. As its name suggests, a quick scan is a very fast method of scouring the targeted drive for deleted files, which it does by looking for their metadata and names. However, a quick scan can recover only recently deleted files; if it has been a while since the file was lost or removed, a deep scan is required.
An acronym for redundant array of independent disks (originally redundant array of inexpensive disks), RAID is a term describing data virtualization technology that combines multiple physical hard disks into one or more logical units, which results in more robust data redundancy and/or performance.
The process of repairing a failed file system using data recovery software or a built-in system utility. In the case of mechanical damage such as a head crash, disk repair also includes hard disk disassembly to help locate the problem and fix or replace the faulty magnetic head.
Short for Self-Monitoring, Analysis and Reporting Technology, S.M.A.R.T. is a monitoring system incorporated into computer hard disks that detects and reports on various reliability indicators. Its purpose is to predict or anticipate hard disk failures to help warn the user to take the necessary steps to protect the data saved on the targeted HDD or SSD. S.M.A.R.T. measures various aspects of a hard disk such as spin counts, bad-sector counts, number of hours in use, and much more.
The minimum storage unit of a hard drive. A sector traditionally stores a fixed amount of data accessible by the user, which is 512 bytes for HDDs while newer HDDs use 4 KiB sectors (4096 byte).
An acronym for solid-state drive or sometimes called solid-state disk, it’s a storage medium that doesn’t have moving parts. As of 2017, most SSDs use 3D TLC NAND-based flash memory.
A portion of a storage medium (SSD or HDD) that appears as a physically separate disk.