In information technology, a recovery plan consists of scenarios and procedures that should be applied whenever a failure is due to some inconsistency caused due to threats such as fires, floods, vandalism, sabotage or technology failures. A disaster recovery plan (DRP) is usually developed by asset managers, often through international regulatory requirements such as Sarbanes-Oxley, Bank 3380, ISO 27000.
The plan typically consists of three phases: crisis management; plan developed in conjunction with the definition of activities, people and physical data. Data recovery can be carried out from any computer storage media including CD, DVD, hard drives, flash memory, etc. The need for recovery may occur when the recording medium is damaged or where the data files were merely marked as deleted but remain stored before being overwritten.
Some common reasons for the need to restore the data include hardware and software errors in recording data, accidental deletion, degaussing, scratches or contamination of surfaces. NAND-Flash – due to improper removal of devices, unauthorized formatting, accidental deletion, destruction of contacts.
Currently, there are two basic ways to recover data. The method chosen depends on the nature of fault. The hardware and software method is used in cases where a programmatic way does not help. Programmatic techniques are employed to restore data without physical intervention into the drive, as well as in the functioning and structure of firmware modules.
This method is used in cases where for one reason or another access to the data is lost. This may be due to the formatting of logical drives, failure to change the logical drive geometry, removal of information, partial or complete destruction of file system. Often in these cases, it is possible to recover most of the information, but there are instances when it is impossible to restore the lost data. There are many programs that automate the recovery process, some of which are free.
If there is damage to the file system as a result of software failure or malfunction of media, data recovery software can retrieve information depending on the extent of damage. When data is removed, in fact, data is physically left in the storage location but the file system is no longer displayed, and the place where they are located marked as free and ready to record new information.
Such files can be easily read and recovered with all the attributes and location information still intact. If reconstruction of a file system is not possible for some reason, some files can still be recovered using signatures. In this type of recovery, drives are scanned for known file signatures. The basic principle of signature search algorithm is the same as that of earliest vendors.
Some files (eg, text and HTML files) do not have characteristic signatures, but can be determined by circumstantial evidence as they contain only ASCII characters. This type of recovery is used to retrieve photos from memory cards since data on the card is the same type, in general, strictly sequentially without fragmentation. Many types of file headers contain characteristic sequence of characters. For example, JPEG files contain a sequence of characters, JPEG, ZIP files begin with PK, and PDF documents begin with the characters PDF.