Data Recovery of Fragmented Files
Read this article to find out how to prevent file fragmentation, and how signature search works when recovering a fragmented disk. Recovering files from fragmented disks can be more difficult than restoring files that are stored on the disk in a single continuous chunk. In fact, the primary goal of the file system is to store information about the order of sectors on the drive containing files.
There are several simple steps you can take to keep disk fragmentation to absolute minimum.
Ensure enough free disk space. Fragmentation rarely occurs on disks with plenty of disk space. What’s “plenty”? To be on a safe side, let’s say you have plenty of disk space if you are using less than a half of its storage capacity. This stands true even in the case of huge, multi-terabyte volumes, as those volumes tend to contain many more files than the smaller disks. However, don’t take these words as carved in the stone. You can use as much disk space as you want if you take proactive measures to reduce fragmentation.
Schedule a disk defragmenter. Such manufacturers of data storage devices as DataTraveler, Hitachi, JetFlash and Seagate offer file defragmentation tools. If you’re not using a disk defragmenter, get used to using one. Since Windows Vista, a free defragmentation utility comes bundled with Windows. Run it in interactive mode first to see how fragmented your disk is. Defragment the disk. After that, schedule the defragmentation tool to run automatically on a daily (or weekly or semi-weekly) basis. Don’t rely on your memory, let the computer performs tidy-up itself! When scheduling defragmentation, make sure that your computer is actually on during the planned defragmentation hours.
Don’t like how Windows defragmentation tool works? There are several commercial and a few freeware tools available that can replace the Windows tool.
Recovering files that are fragmented may or may not be more difficult compared to recovering continuously stored files. Information about which exact sectors on the disk are occupied by a certain file is stored in the file system, FAT or NTFS. If a record about the file is still available in the file system, the file can be undeleted no matter whether it’s fragmented or not. Of course, the probability of some part of a file being overwritten with other data before you use a proper recovery tool will be higher on disks with little or no available disk space, so keeping enough free space is still important.
Things get more difficult if the file system contains no record about a fragmented file, or if the file system is completely unavailable (e.g. after a disk format operation). If this is the case, many advanced data recovery tools will use one or another variation of signature search, a technology that reads all sectors on the disk in an attempt to detect known types of files. These algorithms typically rely on the presence of a file header having a certain structure and possibly a fixed signature. By analyzing the file header, these algorithms can detect the beginning and calculate the length of a file.
Can you see a problem here? When calculating the file length, data recovery algorithms will assume the file is stored in a single continuous chunk. This may or may not be the case. If a file is fragmented, even the best signature search algorithm will be unable to correctly restore the file unless it can find a corresponding record in the file system.
The only effective technique that can be used to recover fragmented files is called “file carving”. Tools implementing this technique are very few, very specialized, and very expensive, work extremely slowly and are based on probabilistic algorithms (basically, a variation of the “hit or miss” principle). As such, these tools are only used in an attempt to recover vital pieces of information – such as those used as evidence during criminal investigations. In fact, all such tools are made exclusively for forensic purposes. Their work reminds the assembling of a puzzle: the file carving algorithm will try fitting different parts of the disk together in an attempt to reconstruct a functional file.
As always, it’s easier to prevent disk fragmentation than to deal with its consequences. If you’re low on disk space, get yourself another one. If you’re not using a disk defragmenter, use one, and make sure to create an automated schedule. Finally, if you’re still living without a backup, create one!