Sudden, nervous perspiration is called "flop sweat" in the acting profession. But it's not a phenomenon experienced only on the stage. Any IT professional who has desperately tried to recover lost data has an intimate knowledge of flop sweat. They know that recovering lost or deleted data is rarely a sure thing, said Ben Winston, quality assurance engineer for Winternals Software Inc., an Austin, Tex.-based developer of advanced system tools for Windows NT/2000.
Data recovery is tough because there are so many ways data can be lost: disk defragmentation, destruction of the storage facility, mechanical failures, and so on. Fortunately, there are actions that you can take to increase the odds of successfully retrieving your lost data, said Winston. Here are the top five action items on his data recovery dos and don'ts list.
1. Don't write additional data to storage locations. Writing additional data to a partition where data has already been lost increases the risk of overwriting the very data that you need to recover.
2. Do prevent further writes performed by product installation, system startup/shutdown, network users writing to shares, etc. in order to reduce the chances of overwriting any lost data.
3. Don't defrag hard drives after data has been lost. Any defragmentation of a drive after data's been deleted can nullify the chances of recovering your data. Once defragmentation is performed, clusters containing lost data can be replaced in defrag operations and be permanently irretrievable.
4. Do stop all disk activity on your system without shutting down. This includes turning off scheduled defragmentation, closing all applications and, if removable media such as a floppy disk drive is available, disconnecting from the network. This will reduce the possibility of deleted files being overwritten.
5. Do restore data to a different storage location. When recovering data, it is important not to restore it to the same location from which it was deleted. This operation can actually overwrite data that is in line to be recovered in the same restoration job.