Thursday, 5 January 2012

Intricacies and challenges of the prospective data recovery market

According to Sobey et al. [1] the worldwide data recovery market in 2005 is about US$100 million. Most probably, in 2011, the market has doubled or tripled to about US$300million.

The figure could be higher due to the ever increasing amount of digital data from year to year. Netizens are relying on digital media for saving their important data.

To the business minded people, this could be translated into monetary or more appropriately termed as “profitable venture”. Presumably, the production and usage of hard disk have increased every each year. Therefore, the business opportunity to recover failed or damaged hard disk is inevitable.

On average the cost for a data recovery is US$500. The fees can go higher depending on the file systems (raid, server and etc) or other symptoms such as mechanical rattling noise.

This is reasonable because data recovery is difficult before, now and in the future. The dependency on hard disk for storing vast amount of digital data has made its technology to be complicated. Worse still, the technical specification is unavailable.

One of the complexities is the hyper-tuned hard disk to increase its density. The said technology has made a data recovery specialist life misery albeit its business and research prospects. At the same time, digital forensics also suffers the same fate. Sometimes, the case digital evidence is irrecoverable.

Research literature on data recovery is scarce and this further aggravates the situation. Data recovery expertise is always considered a trade secret. This predicament can only be improved through research effort and the cost can be quite high.

In 2008, CyberSecurity Malaysia has established a data recovery facility to expedite the digital forensics case analysis. It is proven with data recovery facility and expertise both logical and physical error can be corrected.

But, this achievement must be managed properly. As indicated above, the hard disk technology is getting intricate and this will pose new challenge. The logical recovery of complicated file system such as NTFS, EXT2/3 or proprietary is only the second hurdle.

First, a data recovery analyst must be successful in performing physical recovery which consists of electrical and mechanical parts. The handling must be steady when doing component transplant e.g. head stack in a clean environment.

Firmware and system area corruptions are other obstacles to overcome. Now, the conventional way of getting a donor from a duplicate drive is no longer workable. The servo, preamp and read channel parameters of hyper tuned hard disks for optimization are indeed complicated and different.

This is the reason Sobey is proposing drive independent data recovery. It covers the system area algorithm development and drive electronics replacement. With this, only the media of the original hard disk is required without relying on other components. The signal processing and analysis are indeed very technical but practical.

To date, this is the only good reference that I could find on data recovery and it is encouraged more research to be pursued in this area.

[1] C.H.Sobey, L.Orto and G.Sakaguchi. “Drive-Independent Data Recovery: The Current State-of-the-Art.” The IEEE Transactions on Magnetics, 2007.