Data Recovery Guide

• Data recovery plan overview
• Mechanical vs. software problems
• Common data recovery scenarios
• Types of data recovery
• Hardware and disk space
• Performing a data recovery
• Using boot CDs
• Various aspects

Various aspects of the data recovery

Understanding CHKDSK error messages

Although generally reliable, CHKDSK may produce spurious error messages when used incorrectly.

Do not rely on CHKDSK error messages when checking the volume which is in use. If you run CHKDSK to check the volume on which Windows is installed, or on which there are active database files, it may report false errors when in fact there is no problem. Most likely you will get a warning about Volume Bitmap, or a series of warnings about index inconsistency. This happens because if Windows makes a change to the volume during the test, CHKDSK sees one part of the volume as it was before the change, and the other part as it is after the change, and these two states are almost always inconsistent. If you run the CHKDSK again, it would most likely report the different set of similar errors.

Also, if you see the message "CHKDSK detected minor inconsistencies on the drive", just ignore it per official Microsoft recommendation. You can still run CHKDSK /F against that volume if you want perfection, but that is really not necessary.

Recovery time

The amount of time required to perform a recovery lengthened gradually over the last decade because hard disk capacity increased faster than throughput and processing power. Although significant improvements in recovery techniques were achieved, one still needs to read the entire disk to make sure nothing is missed.

Recovery of a single file (e.g. if the file was accidentally deleted) does not require the entire disk to be processed and can be typically performed in under five minutes.

In more complex cases, like an accidentally formatted drive, the recovery time depends upon the disk size and the read speed. One can reasonably expect the analysis to last three-five hours on a typical hard drive.

Any sort of a physical damage involving bad sectors increases the recovery time dramatically. Run times of several days are not an unusual occurrence.

Using Safe Mode to perform a recovery

Safe Mode is a special startup mode in Windows. When starting in Safe Mode, Windows tries to load the minimum useable configuration. The system may revert to Safe Mode automatically if normal startup fails for some reason.

It is generally OK to run the recovery while the system is in Safe Mode. However, you need to consider the following:

• Why do you have to revert to Safe Mode? Obviously something does not allow the system to start normally.
• Maybe this is due to a virus/malware? You need the system cleaned, then.
• Maybe there is some hardware issue? As long as the issue is not with the drive you are recovering data from, you better have it fixed before attempting the recovery.

Safe Mode imposes some limitations.

• Certain devices may be unavailable in Safe Mode, notably including network connections.
• Certain drivers may sacrifice performance for stability when in Safe Mode. This may affect the disk performance, albeit unlikely with standard ATA/SATA hard drives and standard Microsoft drivers.