The Digital Forensics Unit (DFU) can assist in recovering data from digital media. Data loss can occur on devices for a number of reasons including electrical, logical or mechanical failures.
The most common data loss encountered is simply the accidental deletion of files. Deleted data may well be recoverable, and the less time there is between the data deletion and the media coming in to the DFU, the greater the chance of success of recovery. Larger files, such as video files are often harder to recover than smaller ones.
Another reason for data loss could be either data corruption or the accidental reformatting of a drive. The recovery of data in such instances might be harder than in simple accidental data deletion as the storage drive may well be damaged. Even though files may often be recoverable, information about the files may not, such as dates and times of the files, file names, file path etc. Forensic software can be used to search for common file types and recover data.
If partitions or logical volumes have been lost, it is also possible for the DFU to recover these by scanning the media for common partition headers. If such partition information can be found, it may be possible to recover logical volumes rather than having to recover individual files.
More complex data recovery cases experienced by the DFU come from failures of more complex hardware. When large data volumes are required, it is common for RAIDs (Random Array of Independent Disks) to be used. This is basically a way of increasing the capacity, and often the data integrity, of hard drives by grouping them together to form larger volumes. Often RAID controllers are used to manage these data arrays, so it is possible that failures could be encountered on either the hard drives, the software controlling the RAID or the RAID controller itself. The DFU is capable, in some instances, to recover data from failed RAIDs either by rebuilding them with a 'virtual' drive or by calculating the RAID configuration if the RAID controller has failed. In these instances it is possible to recover all of the data that was stored on the drives.