What is a damaged file? OfficeRecovery classifies and illustrates typical examples of corrupted files.
To understand what a damaged file is, consider first what is an intact file, i.e. holistic.
An integral file consists of blocks recorded on a data carrier. For simplicity, later in the article any media will be called a “disk”. It should be borne in mind that the fundamental principles of file storage are similar for disks, flash drives, CD / DVD and many other devices, therefore, speaking of the “disk” we are in fact talking about a wide class of devices.
The integral file lies on the disk in the form of blocks, as shown in Fig. 1. When reading a file, the blocks that make up the file are compiled in a certain sequence, and the result is an image of the file in memory, ready for processing by the program. This is how most of the files that we use every day are opened — Word documents, Excel spreadsheets, images, and everything else.
')
The attentive reader will notice that the blocks that make up the file are located in different places on the disk. This is an important factor that has a great influence on both damage and subsequent file recovery.
A damaged file is a file that has undergone an erroneous change in its internal structure and data. As a result of such changes, the file becomes unusable or unsatisfactory to use.
Damage can be both critical, when the user completely loses access to the data, and partial, when only part of the data is lost, but access to the rest of the information untouched by the damage remains.
An example of critical damage can be when a file cannot be opened / recognized by the original application in which it was created. If the application does not strictly handle such situations, the result may be a critical error (“crash”) of the application with which they tried to open the damaged file.
We list the main causes of file corruption:
Let us consider each of these factors separately and illustrate the most characteristic examples.
Did you encounter a situation when, after clearing the disk space, along with unnecessary information, something important was deleted?
In such cases, it is usually necessary to resort to the help of utilities for recovering deleted data. These applications work with the file system directly and, if the information about the file has not been completely cleared from the system, restore the file to a greater or lesser extent. But here are possible pitfalls.
First, new data could be written to the place of an unintentionally deleted file, if you were actively working with the disk after deleting files. The reason is that the system uses the space left after deleting files for new data.
Another common case is the inability to fully restore the sequence of blocks of a deleted file. In this case, the applications, using internal algorithms, try to select the expected blocks related to files, which does not always bring the expected result.
Summarizing possible damage during file recovery after deletion, the following typical problems can be identified:
Tips in case you need to recover deleted files:
There are often situations when problems arise in the work of the carrier itself. The disk is a set of blocks for storing data (in the article we use the abstract term “block” instead of the more specific “sector”, “cluster”, “track”, etc.). Over time, when using media, situations are possible when part of the blocks becomes unsuitable for further use and the data that was there before the failure becomes inaccessible.
It is especially unpleasant when data related to important files were stored in corrupted blocks. In this case, errors occur both when attempting to read and when attempting to write. It appears this way: let's say that part of your Word document is stored in a broken block. When trying to open a file, Microsoft Word tries to read the given piece from the disk, receives an error from the system about the impossibility of the operation, as a result, the word processor reports that it is impossible to open the file.
If the file is still able to be read from the disk, ignoring bad blocks, it will have damage, shown in Figure 3.
Tips for recovering files from a damaged disk:
Possible causes of data corruption can also be the effects of viruses and the erroneous operation of antiviruses.
A detailed description of viruses and their types is beyond the scope of this article. But It is worth noting that some types of viruses can deliberately wipe user files with garbage data in order to harm. Many viruses also do this in the process of their “reproduction”, recording parts of the files with their service distribution data on the user's computer and other machines, as well as for disguise purposes.
If we by definition do not expect anything good from a virus, then how does it happen that the source of damage is an antivirus? Generally speaking, the principle of the anti-virus is reduced to reading the contents of the file and searching in the sequence of bytes of strings (“signatures”) characteristic of the viruses known to him. There are situations where user data can be mistakenly interpreted as a virus chain and cut from a file for security. Although the antivirus algorithms have recently undergone significant improvements, such situations are periodically possible. In fig. 4 shows a generalized view of a file after being damaged by a virus.
Please note that virus / antivirus damage is not related to the disk. From the point of view of the location on the disk and reading it, everything is in order with the file. Damage zones do not coincide with the boundaries of the blocks on the disk, but can be both smaller and more blocks.
A common factor in the damage to user data is an application error, which is used to view and edit files. This factor can bring problems both independently and in conjunction with other factors (interruptions in electricity, the impact of the antivirus on the application, insufficient RAM). Almost always problems arise when saving changes to a file.
Here is a typical scenario: a three-dimensional image was edited in Photoshop, significant edits were made, then when trying to save changes, the application “falls” for one reason or another. The file is recorded partially, and thus damaged. When you try to open the saved image again, the application does not cope with this, since the internal structure is not integral.
This is just one example of the potential causes of application crashes. The “clinical picture” of damage in this case is close to what can be seen in case of damage by viruses / antiviruses. For an idea of ​​it, see fig. four.
Tips:
File corruption can also be caused by user actions. A vivid example is detaching a flash drive from a computer at the moment when all accumulated changes are not recorded on it. So get broken documents, spoiled photos.
We are not inclined to blame users for damage, considering situations like the one described rather as an imperfection of computer systems.
Here are a couple of simple tips for users:
In conclusion, we will say a few words about how to restore the damaged data, and what criteria should be presented to the results of recovery.
The basis for recovering user data is to understand the internal structure of each type of file that needs correction. After analyzing the damaged file, the remaining intact / intact user data is reduced to a new complete file. Data that has been erased, alas, can not be recovered.
Applications for the recovery of damaged data work as follows:
What to expect from the results of file recovery? Each file damage is unique in its own way, and affects the amount of data that can be recovered. If the service data that is irrelevant for recovery is damaged in the file, you can often talk about a 100% recovery of user information. If a piece of important information is overwritten, then it is possible to recover only the data that remained intact during the damage process.
Often, users do not understand this fact and expect to restore their original file after recovery. Unfortunately, this is almost never the case.
When assessing the quality of recovery, it is recommended to focus on whether the data to be used were recovered from the file. If this is the case, then the restoration should be recognized as successful, since it has already saved time and effort when recreating the initial set of information.
OfficeRecovery utilities recover data from more than 50 different file types, from Word and Excel to Exchange and Oracle. If you encounter file corruption, use OfficeRecovery software and services. The company's specialists are also always ready to work on complex special projects for recovery of corporate data.
OfficeRecovery software:
www.officerecovery.com
Online service for recovering data from corrupted files:
online.officerecovery.com/ru
An integral file consists of blocks recorded on a data carrier. For simplicity, later in the article any media will be called a “disk”. It should be borne in mind that the fundamental principles of file storage are similar for disks, flash drives, CD / DVD and many other devices, therefore, speaking of the “disk” we are in fact talking about a wide class of devices.
The integral file lies on the disk in the form of blocks, as shown in Fig. 1. When reading a file, the blocks that make up the file are compiled in a certain sequence, and the result is an image of the file in memory, ready for processing by the program. This is how most of the files that we use every day are opened — Word documents, Excel spreadsheets, images, and everything else.
')
The attentive reader will notice that the blocks that make up the file are located in different places on the disk. This is an important factor that has a great influence on both damage and subsequent file recovery.
Fig. 1. Holistic file
Corrupted file
A damaged file is a file that has undergone an erroneous change in its internal structure and data. As a result of such changes, the file becomes unusable or unsatisfactory to use.
Damage can be both critical, when the user completely loses access to the data, and partial, when only part of the data is lost, but access to the rest of the information untouched by the damage remains.
An example of critical damage can be when a file cannot be opened / recognized by the original application in which it was created. If the application does not strictly handle such situations, the result may be a critical error (“crash”) of the application with which they tried to open the damaged file.
The main causes of file corruption
We list the main causes of file corruption:
- Recovering files after deleting from disk
- Disk failure
- Impact on the virus or antivirus file
- Application errors
- User action
Let us consider each of these factors separately and illustrate the most characteristic examples.
Recovering files after deleting from disk
Did you encounter a situation when, after clearing the disk space, along with unnecessary information, something important was deleted?
In such cases, it is usually necessary to resort to the help of utilities for recovering deleted data. These applications work with the file system directly and, if the information about the file has not been completely cleared from the system, restore the file to a greater or lesser extent. But here are possible pitfalls.
First, new data could be written to the place of an unintentionally deleted file, if you were actively working with the disk after deleting files. The reason is that the system uses the space left after deleting files for new data.
Another common case is the inability to fully restore the sequence of blocks of a deleted file. In this case, the applications, using internal algorithms, try to select the expected blocks related to files, which does not always bring the expected result.
Summarizing possible damage during file recovery after deletion, the following typical problems can be identified:
- Part of the file is overwritten with new data.
- It was possible to restore part of the original file, but at the same time, blocks that are not related to it were mistakenly assigned to the file. The illustration shows this file corruption situation.
Fig. 2. File recovered after deletion
Tips in case you need to recover deleted files:
- If you are not very competent, ask for help from specialists.
- Immediately stop any operations with the disk where the deleted files were located;
- Use the utility to recover deleted files.
- Be prepared for the fact that deleted files may need further “treatment”, OfficeRecovery programs and services will help you.
Disk failure
There are often situations when problems arise in the work of the carrier itself. The disk is a set of blocks for storing data (in the article we use the abstract term “block” instead of the more specific “sector”, “cluster”, “track”, etc.). Over time, when using media, situations are possible when part of the blocks becomes unsuitable for further use and the data that was there before the failure becomes inaccessible.
It is especially unpleasant when data related to important files were stored in corrupted blocks. In this case, errors occur both when attempting to read and when attempting to write. It appears this way: let's say that part of your Word document is stored in a broken block. When trying to open a file, Microsoft Word tries to read the given piece from the disk, receives an error from the system about the impossibility of the operation, as a result, the word processor reports that it is impossible to open the file.
If the file is still able to be read from the disk, ignoring bad blocks, it will have damage, shown in Figure 3.
Fig. 3. File from a damaged disk
Tips for recovering files from a damaged disk:
- If a disk is damaged fragmentary, some files can be counted without damage.
- Files that are not lucky enough to be written to bad blocks need to be extracted using special utilities, and they will almost certainly require further treatment.
The impact of the virus or antivirus
Possible causes of data corruption can also be the effects of viruses and the erroneous operation of antiviruses.
A detailed description of viruses and their types is beyond the scope of this article. But It is worth noting that some types of viruses can deliberately wipe user files with garbage data in order to harm. Many viruses also do this in the process of their “reproduction”, recording parts of the files with their service distribution data on the user's computer and other machines, as well as for disguise purposes.
If we by definition do not expect anything good from a virus, then how does it happen that the source of damage is an antivirus? Generally speaking, the principle of the anti-virus is reduced to reading the contents of the file and searching in the sequence of bytes of strings (“signatures”) characteristic of the viruses known to him. There are situations where user data can be mistakenly interpreted as a virus chain and cut from a file for security. Although the antivirus algorithms have recently undergone significant improvements, such situations are periodically possible. In fig. 4 shows a generalized view of a file after being damaged by a virus.
Please note that virus / antivirus damage is not related to the disk. From the point of view of the location on the disk and reading it, everything is in order with the file. Damage zones do not coincide with the boundaries of the blocks on the disk, but can be both smaller and more blocks.
Fig. 4. Damage to the file as a result of the activity of a virus, antivirus or program error
Application errors
A common factor in the damage to user data is an application error, which is used to view and edit files. This factor can bring problems both independently and in conjunction with other factors (interruptions in electricity, the impact of the antivirus on the application, insufficient RAM). Almost always problems arise when saving changes to a file.
Here is a typical scenario: a three-dimensional image was edited in Photoshop, significant edits were made, then when trying to save changes, the application “falls” for one reason or another. The file is recorded partially, and thus damaged. When you try to open the saved image again, the application does not cope with this, since the internal structure is not integral.
This is just one example of the potential causes of application crashes. The “clinical picture” of damage in this case is close to what can be seen in case of damage by viruses / antiviruses. For an idea of ​​it, see fig. four.
Tips:
- If a single case of damage, then it is almost impossible to get to the cause of the failure. Too many factors and their combinations can lead to an error. As a preventive measure, make an extraordinary backup of your data.
- If the damage happens regularly, then it is worth thinking about the circumstances under which they occur. To get rid of the problem, you have to look in several directions. Enter the error messages that you receive to the search engine - often, along with a description of the error, you will also find its solution. Update the program that corrupts the files. Install the operating system updates.
- Damaged files can be recovered using special utilities.
User action
File corruption can also be caused by user actions. A vivid example is detaching a flash drive from a computer at the moment when all accumulated changes are not recorded on it. So get broken documents, spoiled photos.
We are not inclined to blame users for damage, considering situations like the one described rather as an imperfection of computer systems.
Here are a couple of simple tips for users:
- If possible, never edit files placed on media that can be easily disconnected from the computer (flash drives, external drives, etc.). Use these devices only to transport data, and before editing, copy files to a fixed disk on your computer.
- Use the “Safely Remove” OS feature if it is available for pluggable media. This will allow the system to write to the media data that are in the system write buffer.
- Do not click “Yes”, “OK”, etc., without understanding that the program or the system is asking you. This may be a request to delete your important information.
How to recover damaged files
In conclusion, we will say a few words about how to restore the damaged data, and what criteria should be presented to the results of recovery.
The basis for recovering user data is to understand the internal structure of each type of file that needs correction. After analyzing the damaged file, the remaining intact / intact user data is reduced to a new complete file. Data that has been erased, alas, can not be recovered.
Applications for the recovery of damaged data work as follows:
- The damaged file is analyzed based on the knowledge of the data format.
- If possible, the corrupted service data is adjusted to allow access to the maximum amount of user data.
- If the file storage structure allows, then heuristic algorithms for searching for lost data are launched. Lost data refers to information to which links in the file were lost as a result of damage to service data.
- The extracted user data is added to the recreated file of the original or adjacent formats.
What to expect from the results of file recovery? Each file damage is unique in its own way, and affects the amount of data that can be recovered. If the service data that is irrelevant for recovery is damaged in the file, you can often talk about a 100% recovery of user information. If a piece of important information is overwritten, then it is possible to recover only the data that remained intact during the damage process.
Often, users do not understand this fact and expect to restore their original file after recovery. Unfortunately, this is almost never the case.
When assessing the quality of recovery, it is recommended to focus on whether the data to be used were recovered from the file. If this is the case, then the restoration should be recognized as successful, since it has already saved time and effort when recreating the initial set of information.
OfficeRecovery utilities recover data from more than 50 different file types, from Word and Excel to Exchange and Oracle. If you encounter file corruption, use OfficeRecovery software and services. The company's specialists are also always ready to work on complex special projects for recovery of corporate data.
OfficeRecovery software:
www.officerecovery.com
Online service for recovering data from corrupted files:
online.officerecovery.com/ru
Source: https://habr.com/ru/post/149640/
All Articles