How do you recover data lost due to power failure while cut-copying?

Answer 1

When unsaved data is lost due to a power failure, there are few options for retrieving the data, and they are all highly advanced. Each involves a field of computing called FOREN, or computer forensics.

When anything is typed, copied, pasted, into a computer, it is all written to a series of 'slack space' on a computer. There are buffers that computers use to record what you type before it is actually processed or saved. If the lost data was the last thing you did, what you typed or cut may well still be in the keybaord buffers. These buffers are the target of keyloggers, for even if you are Surfing a secure and encrypted sight, your keyboard buffer is plain text.

The problem with recovering your data is complicated if you turn the computer on after the power failure. Sometimes just booting up will erase whatever those buffers and slack space held. If you just lost something really important, you should NOT turn the computer back on.

Just as PC Crime Labs would do, you would need to unplug the computer immediately. remove the hard drive, and mount it in an external device. Crime labs would use 'Write Blockers' which is a device that prevents data from being written across it, to ensure the act of mounting the drive did not write any information to the drive, invalidating the evidence collected. The write blocker can also ensure you that a virus laden device can't infect your FOREN or PC repair computer.

Now that you have securely and safetly mounted the drive to your FOREN computer, you either need a very expensive Computer forensic toolkit, which automates many of the complex operations, and can scan the slack space on your old drive and show you what was saved there. Chances are good, the last thing you copied was written to one of those slack files, and though you have spent a prettty penny to obtain the tools, the average advanced PC user could navigate the tool set.

There are other tools that let you mount and examine this drive availablle for free, but the price you pay is that no one has laid out the steps into a tidy set of commands. You'll have to use your witts and figure it out by yourself. That being said, something like KNOPPIX, a Linux based distribution can actually boot most PCs from the CD-ROM drive. Once you have successfully booted to KNOPPIX, you could mount the drive in question and use whatever tools contained on the KNOPPIX distribution you have.

You can even learn how to customize your KNOPPIX Cd to include disk sector editors, for example (though I am not saying that disk sector editors for KNOPPIX exist, the ability to customize a KNOPPIX intallation does!)

In any case, the task of recovering unsaved data after a power loss is quite a challenge. Access Data's FOREN suite is quite comprehensive, but quite expensive. Free tools require lots of user knowledge.