Data recovery involves the process of restoring data which has been lost, corrupted, accidentally deleted or made inaccessible.

In enterprise IT, data recovery is used to define the process of restoring data to PCs, server or external storage system from data backup systems.

Causes of data loss

According to statistics released in 2016, most data loss is caused by human error. In fact, human error accounts for almost two-thirds of all reported incidents. Other common causes include power outages, equipment failures, natural disasters, software crashes, firmware corruption and accidental formatting of hard drives amongst others.

How data recovery works

Data recovery processes usually vary, and this depends on the circumstances which led to the data loss, the recovery software used to create the backup and the backup target media. For example, many PC backup software programs allow users to recover and restore lost files themselves.

On the other hand, restoring a corrupt database from a tape is a complicated and technical process, which requires specialized handling. Files which were not backed up, but have been accidentally deleted and remain on the hard disk in fragments can be recovered.

What makes data recovery possible is the fact that files and the information about the files are stored in different locations. For example, Windows operating system tracks the files stored on the hard drive and their location using the file allocation table. This table resembles a book’s table of contents, and the actual files on the hard drive are like the pages in the book.

Most data recoveries happen when the file allocation table fails to work properly. The actual file to be recovered can be found on the hard drive still in perfect condition. The file can be recovered if it still exists, and is not damaged or encrypted. There are other ways of recovering damaged, missing or encrypted files. Physically damaged files require being reconstructed first.

Many applications usually put uniform headers at the beginning of files to designate that the files belong to that particular application. The file headers can be reconstructed manually using some utilities, and this helps to recover some of the lost or damaged files.

Most data recovery processes combine diverse technologies, and the organizations are not required to recover the data by tape solely. There are also risks involved with transporting the tapes.

Besides, not all data requires to be recovered; therefore, it is wise to identify what can be left behind and what needs to be recovered.

Data recovery techniques

Instant recovery, also known as recovery in place, redirects user workloads to the backup server by eliminating the recovery window. A snapshot is usually created to help the backup remain in a perfect condition, and all user write operations are relayed to that snapshot.

Users can then work off the backup virtual machine, and recovery process takes place in the background. The user might not have an idea that the recovery process is taking place, but once the recovery is complete, the user can switch back to the original VM.

A simple way of avoiding time-consuming and expensive data recovery process is to prevent the data loss from ever happening in the first place. Companies can use data loss prevention (DLP) products which assist in identifying and stopping data leaks. These products come in two versions, that is, integrated and stand-alone.

  • Integrated DLP products can be found on parameter security gateways. They are very useful in detecting sensitive data at rest and in motion.
  • Stand-alone DLP products can be found on specialized appliances or are sold as a software program.

Integrated DLP products usually do not share the same policy management engines, data storage or management consoles.