Translated from the French source manual. Technical commands, product names, standards, and many filesystem terms are intentionally kept close to their original form when needed for accuracy.
Recovery
data
Verified and sourced manual — May 2026 edition
Anatomy of media, professional methods, open and commercial tools,
prevention.
All numerical assertions are sourced or explicitly qualified as orders of
greatness. No case is invented: the incidents cited are public and referenced.
Revised edition
Reference document for technicians, forensic students and advanced individuals.
Data Recovery — Verified Manual May 2026 Edition
Warning and methodology
This book is the result of the critical revision of an initial educational corpus which presented numerous
inventions encrypted under the veneer of “professional sources”. This text puts the work back
on foot respecting three rules:
• Each percentage is sourced or explicitly labeled as an order of magnitude when
no public statistics justify it.
• No case is invented. Case studies are public incidents referenced
(NotPetya/Maersk 2017, Code Spaces 2014, etc.).
• Software versions and proprietary numbers are only mentioned when they are
verifiable with the publisher.
Who is this book for?
To IT technicians who must manage data loss incidents; for forensic students
digital who are looking for an educational overview; to advanced individuals who want
understand what is happening under the hood before taking action or entrusting their support to a laboratory;
to lawyers and judicial experts who need a technical view to assess admissibility
digital elements.
Who it is not for
To someone who has an active emergency and doesn't have time to read. In this case, the rule is simple:
unplug the support, do not write anything on it, and either consult chapter 5 (diagnosis) to find out
position, or contact a laboratory directly. This book is a manual for reflection, not
a survival guide.Legal notice
Recovery of data from media that does not belong to you, or that contains
data protected by professional secrecy or the GDPR, is regulated by law. The techniques
described here are for educational and professional use only. For any serious issue — data
medical, legal, intellectual property — go through a laboratory under contract
Confidentiality remains the only acceptable path.
—2—
Data Recovery — Verified Manual May 2026 Edition
Summary
Introduction
Data recovery in 2026
Part I — Physical Foundations
Chapter 1 — Anatomy of a Mechanical Hard Drive (HDD)
Chapter 2 — Anatomy of an SSD: NAND, controller, FTL
Chapter 3 — File Systems: The Treasure Map
Part II — Diagnosis
Chapter 4 — Causes of loss: figures 2025-2026
Chapter 5 — Diagnosis and triage
Part III — Methods
Chapter 6 — Secure Imaging: The Foundation of Everything
Chapter 7 — Logic Analysis and FS Repair
Chapter 8 — In-depth data carving
Chapter 9 — Physical intervention on HDD
Chapter 10 — Physical intervention on SSD
Chapter 11 — RAID and Advanced Storage
Part IV — Special cases
Chapter 12 — Encryption and Recovery
Chapter 13 — Mobile media (Android, iOS)
Chapter 14 — Forensic Forensics
Part V — Practical
Chapter 15 — Tools 2026: realistic panorama
Chapter 16 — Death Traps and Case Studies
Part VI — Prevention
Chapter 17 — Modern Backup Strategies
Chapter 18 — Current limits in 2026
Appendices
A. Reference orders
B. Glossary
C. Bibliography
—3—
Data Recovery — Verified Manual May 2026 Edition
INTRODUCTION
Chapter 0Data recovery in 2026
A discipline at the intersection of several professions
Data recovery is the set of techniques for finding information
made inaccessible on a storage medium. The discipline mobilizes four families of
skills: physics of materials (magnetism for hard drives, gate electronics
floating point for NAND memories), algorithmic file systems, reverse engineering of
proprietary controllers, and forensic procedural rigor.
It is carefully distinguished from backup restoration, which is prevention. The
Recovery occurs after the loss, on a medium that does not have a usable copy. It is, by
construction, an emergency discipline where we make do with what is left.
Two worlds, never to be confused
Logical recovery: the media is physically intact and detected by the machine. The problem
is in the software — corrupted file system, deleted partition, erased files, encryption
by ransomware. The raw data is almost always still there; you just have to know how to read them.
Physical recovery: hardware failure. The media is no longer detected, or emits noises
abnormal, or its controller no longer responds. The intervention requires a specialized environment:
clean room for mechanical hard drives, micro-soldering station for SSDs.
All recovery work begins with a diagnosis that decides between these two worlds. Se
fooling people costs data. Chapter 5 details this step.
Evolution since 1990
For three decades, recovery was done on magnetic hard drives. The principle was
stable: as long as the platters were not physically rewritten, the data remained in place.
Deletion, quick format, logical corruption: all this only affected the allocation table, not
the content. It was the golden age of consumer software like Norton Utilities or, later, TestDisk.The massive arrival of SSDs from 2010 turned the discipline on its head. The NAND memory does not
does not behave like a magnetic disk: you cannot rewrite it in place, and the controller must
continuously consolidate and erase entire blocks. With the TRIM command (appeared in
Windows 7, macOS 10.6.8 and Linux kernel 2.6.33), deleting a file triggers a deletion
physics of the cells involved, often in seconds to minutes. On modern SSD in
good health, the logical recovery window narrows dramatically.
At the same time, two other developments have reshaped the landscape: the generalization of encryption
hardware (SED, TCG Opal, BitLocker with TPM, FileVault) which makes the physical data unusable
without the key, and the explosion of ransomware attacks which now explicitly target
backups. The Verizon DBIR 2025 quantifies this latest trend: ransomware is involved
in 44% of documented data compromises in 2024, up 37% year-on-year.
—4—
Data Recovery — Verified Manual May 2026 Edition
On statistics — No public consolidated statistics give the overall success rate
data recovery. Professional laboratories sometimes publish figures in
their commercial supports, but these are non-verifiable and non-independent figures. This
manual talks about orders of magnitude when a precise figure would be dishonest.
How this book is organized
Six parts, eighteen chapters and three appendices. The progression is deliberate: we start with
understand what a storage medium physically is (part I), then how to diagnose
a breakdown (part II), then what methods to apply (part III), then how to manage cases
individuals (part IV), then which tools to choose in practice (part V), and finally how to make
all this useless with good prevention (part VI).
Three layout conventions:
• The blue boxes are educational notes.• Orange boxes are operational warnings — read before acting.
• The green boxes are public and sourced case studies.
—5—
Data Recovery — Verified Manual May 2026 Edition
Part I
Physical foundations
Before any method, it is necessary to physically understand how data is written, read and
deleted. Three chapters: a mechanical hard disk (HDD), a NAND memory (SSD, eMMC,
UFS, SD card), a file system (the logical layer that organizes the blocks into a tree structure).
Without this foundation, the methods in the following chapters are just magic.
—6—
Data Recovery — Verified Manual May 2026 Edition
PART I — PHYSICAL FOUNDATIONS
Chapter 1
Anatomy of a mechanical hard drive
1.1 Overview
A hard disk (HDD, Hard Disk Drive) is a miniaturized precision mechanism. Under its casing
hermetically sealed, we find: one or more rigid trays coated with a magnetic layer, a
spindle motor which makes them rotate at constant speed, read/write heads carried by a
actuator arm which scans the surface, and an external printed circuit (PCB) which contains the
controller, firmware ROM and SATA or SAS interface.
Typical orders of magnitude for a consumer 3.5" HDD in 2026:
Parameter Typical value
Rotation speed 5,400 or 7,200 rpm (consumer), up to 15,000 (enterprise SAS)
Capacity per tray 2 to 4 TB
Number of trays 1 to 10 depending on total capacity
Linear density > 1 million bits per inch of track
Flight of heads (fly height) A few nanometers above the plateau
Sequential throughput 150 to 300 MB/s
Random access latency 5 to 15 ms1.2 How data is written
The magnetic layer of the board is divided into billions of small magnetic domains. The head
writing, by generating a very strong and very brief local magnetic field, directs the polarization of a
domain in one direction (bit 1) or the other (bit 0). The transition between two opposite polarizations
does the read head then detect, by induction or more recently by tunnel effect
magnetoresistive (TMR).
As long as nothing rewrites the area, these magnetic polarizations are stable over decades.
This is the fundamental property that makes HDDs so recoverable: erasing a file at the
file system does not touch the magnetic domains themselves.
1.3 PMR, CMR, SMR, HAMR: writing technologies
Four technologies coexist or succeed one another:
• PMR (Perpendicular Magnetic Recording): since 2005, the magnetic domains have been oriented
perpendicular to the surface rather than parallel. It is the basis of all HDDs
modern.
• CMR (Conventional Magnetic Recording): modern term which designates “classic” PMR with
tracks written side by side without overlapping. Allows you to rewrite any track without
touch the neighbors.
—7—
Data Recovery — Verified Manual May 2026 Edition
• SMR (Shingled Magnetic Recording): since 2013, the tracks partially overlap like
roof tiles. We gain 20 to 25% in density, but each modification of a track requires
rewrite the entire strip of adjacent tracks. The firmware must manage a cache area and a
garbage collection comparable to that of an SSD.
• HAMR (Heat-Assisted Magnetic Recording): technology which occasionally heats the area
by laser during writing to reduce the size of stable domains. Marketed from
2024 on very high capacity enterprise drives (30 TB+).SMR and recovery — SMR is significantly more complex to recover from failure
firmware: the translation between logical addresses (LBA) and physical locations on the band
is managed by the controller, and corrupted firmware can make content unreadable even on
trays intact. Laboratories use specialized modules (PC-3000 has released modules
SMR from 2020) which must manage both the main translator and the translator cache. Source
: Rossmann Group, CMR vs SMR: How Recording Technology Affects Recovery, 2026.
1.4 Typical causes of mechanical failure
1. Head crash. A head comes into contact with the surface of the plate — shock, vibration, fault
fly height. The result is often a progressive scratch that physically destroys the layer
magnetic. Classic symptom: repeated clicking of the head which tries in vain to position itself.
2. Stiction. The heads remain stuck to the plate instead of parking properly when stopped. The
motor can no longer start rotation. Symptom: Short buzzing noise then silence.
3. HS spindle motor. The bearings wear out, the motor seizes. Symptom: platter no longer turns
at all, or runs in fits and starts.
4. Burnt out PCB. An overvoltage destroys components of the printed circuit, often the TVS (transistor
protection). The disk is no longer detected at all, sometimes it literally smokes.
5. Firmware corruption. The PCB ROM or a system area of the trays (service area)
becomes unreadable. The disc spins but doesn't mount, or mounts with an absurd capacity.
Caution — A crashing HDD should be turned off immediately. Each additional spin
plates when the heads touch the surface expands the scratched area — every second, we lose
data. It’s one of the few true emergencies in recovery.1.5 Why an HDD remains very recoverable
When a file system deletes a file, it only modifies its own internal tables
(MFT for NTFS, inodes for ext4, FAT table for FAT32/exFAT). The physical sectors that
contained the file are neither erased nor demagnetized. They will only be when a new
file will be written over it.
This is why on an HDD:
• A deleted file is recoverable as long as its sectors have not been reused.
• A quick format only resets the basic structures of the FS; the sectors remain
intact.
• A complete format (which rewrites everything) does destroy the data, but takes hours
and is almost never done by accident.
—8—
Data Recovery — Verified Manual May 2026 Edition
On an unoverwritten HDD, logical recovery tools (TestDisk, R-Studio, UFS Explorer,
PhotoRec as a last resort) find in practice the overwhelming majority of data.
1.6 The average reliability of an HDD in 2026
Backblaze, a cloud host, has been publishing breakdown statistics for its disk fleet since 2013
hard. The 2025 annual report (published in February 2026) has 344,196 disks spread over 30
models. Three key figures:
• Annual AFR 2025: 1.36% (down from 1.55% in 2024).
• AFR on the complete life of the disks (lifetime): 1.30%, stable from one quarter to the next.
• Q4 2025 showed a quarterly AFR of 1.13%, the lowest since 2022.
In other words: in a massive sample, approximately 1.4% of drives fail every
year. For an individual with a single drive, this doesn't mean much individually — your
personal disk will fail or not, it's binary. But this reminds us that in a park, the
failure is statistically certain.
Source: Backblaze, Drive Stats for 2025, annual report published February 12, 2026; official BusinessWire release.
—9—Data Recovery — Verified Manual May 2026 Edition
PART I — PHYSICAL FOUNDATIONS
Chapter 2
Anatomy of an SSD: NAND, controller, FTL
2.1 A paradigm shift
An SSD (Solid State Drive) has no mechanical parts. All the complexity is in
electronics. This seems like a simplification, but for retrieval, it's the opposite: memory
NAND imposes physical constraints that force the controller to actively erase data
deleted. On an HDD, deleting does not destroy anything; on a modern SSD, delete destroyed in the
minutes that follow.
2.2 NAND cells
The fundamental unit is the NAND cell: a floating-gate transistor (floating-gate MOSFET) or,
more recently, charge-trap flash. An electrical charge trapped in the
floating gate changes the threshold voltage of the transistor. By measuring this voltage, we read the value
stored.
Depending on the number of voltage levels that we distinguish in the same cell, we store more or
fewer bits. This is the heart of the density/endurance trade-off which structures the entire storage market
flash:
Type Bits/cell Levels Endurance (P/E cycles) Usage
SLC 1 2 50,000 to 100,000 Industrial, critical enterprise
MLC 2 4 3,000 to 10,000 Enterprise (endangered)
TLC 3 8 1,000 to 3,000 Consumer SSD current 2026
QLC 4 16 150 to 1000 Large capacity inexpensive
PLC 5 32 < 150 (estimate) In development, not widely marketed
Sources: Kingston Technology, Lexar Enterprise, TechTarget, OSCOO. Endurance orders of magnitude vary
according to precise sources and models; these values represent the high end of the typical range in 2024-2026.The more bits we store per cell, the narrower the margin between levels, the greater the read errors
are frequent, the more correction codes (ECC) the controller must apply, and the more the cell wears out
quickly with each write/erase cycle.
3D NAND — Modern SSDs almost all use 3D NAND architecture, where cells
are stacked vertically (commonly 96, 176, 232 layers in 2024-2026). This allows to
return to larger lithographies (therefore more robust cells) while increasing the
total density. A TLC 3D 2026 SSD often has better practical endurance than a 2D MLC
from the 2010s, despite its 3 bits per cell.
— 10 —
Data Recovery — Verified Manual May 2026 Edition
2.3 The fundamental constraint: write on the page, erase on the block
It’s the detail that explains everything else. NAND memory can be read and written at the
page (typically 4, 8 or 16 KB), but it can only be erased at block level (256 to 512
pages, typically 1 to 8 MB). You cannot rewrite in place: you must erase the entire block
first.
To remain efficient, the controller never does this operation naively. When we
modifies a file, it:
1. Writes the new version to a free page elsewhere on the NAND.
2. Updates its internal correspondence table (mapping) so that the logical LBA points
now to the new page.
3. Marks the old page as "invalid" but does not delete it immediately.
4. Later, in the background, the garbage collector consolidates the remaining valid pages from the blocks
partially used and applies erase voltage to empty blocks.2.4 Wear leveling and over-provisioning
As each cell has a limited endurance, the controller applies wear leveling: it distributes
writes to all available cells, so that none wears out faster than the others. A
over-provisioning zone (7% minimum, often 14% to 28% on enterprise SSDs) is invisible
for the user but usable by the controller for its reorganization operations and for
replace cells that eventually die.
2.5 TRIM: the command that changes everything
Without TRIM, the controller has no idea which pages are still in use at the system level
of files. When the OS deletes a file, it modifies its own tables but does not tell the SSD.
Result: the controller considers these pages as containing valid data, and its garbage
collector wastes a lot of time moving them around unnecessarily.
TRIM (ATA DATA SET MANAGEMENT command with the Trim attribute, or its NVMe equivalent
DEALLOCATE) solves this problem by informing the controller of free LBAs on the OS side. The controller
can then:
• Update your mapping table immediately.
• Schedule these blocks for physical deletion in the next garbage collection cycle.
On most modern SSDs implementing DRAT (Deterministic Read After Trim) or DZAT
(Deterministic Zero After Trim), any subsequent reading of the trimmed LBAs returns respectively a
unspecified deterministic value or zeros. Logical recovery tools no longer see anything
useful.
2.6 The recovery window
How long before data is physically lost? The reference on the subject
— Rossmann Group — is clear: “Most modern SSDs process TRIM within seconds to minutes,
making any recovery window negligible”.
Concretely:
— 11 —
Data Recovery — Verified Manual May 2026 Edition
• On deleting a file on an internal SSD mounted in NTFS/APFS/ext4 under
Recent Windows/macOS/Linux: TRIM is sent immediately. The window is counted in
seconds.• The garbage collector can be activated from the next period of inactivity, therefore in a few
minutes at most.
• Once the block is physically erased, no chip-off recovers anything. The cells
are in their neutral state.
Caution — Practically: if you have deleted an important file on an SSD, unplug it
support immediately, do not plug it into the same machine again, and send it for analysis.
Every second under tension reduces the chances. And even if you act quickly, consider that the
loss is probable — not certain, but probable.
2.7 When TRIM does not work
SSD recovery remains possible in several configurations where TRIM is short-circuited,
documented in particular by Belkasoft (Recovering Evidence from SSD Drives, Forensic Focus).
Here are the main ones:
• Hardware RAID. Most RAID controllers do not pass TRIM to the underlying disks.
• External SSDs via old USB-SATA bridges. The old JMicron JMS539 and ASMedia ASM1051
do not pass TRIM. Recent UASP bridges (JMS578, ASM235CM, RTL9210B) pass it.
• SIN. Depending on the firmware and volume configuration, TRIM may be absent or delayed.
• Low-end pseudo-SSD. Some USB drives and SD cards marketed as SSDs
do not implement TRIM.
• Buggy firmware. Several models (notably Crucial M4, OCZ Vertex, Intel 320) have had
leaving the factory a broken TRIM. If the user never updated, the data may remain.
• Small files stored internally in the MFT NTFS. Files of approximately 700 bytes or
less are stored directly in the MFT entry (resident $DATA attribute) and are never
affected by TRIM, since they are never written to separate data sectors.
• Fragments in blocks still partially used. As long as a NAND block contains at least
minus one valid page, it cannot be erased in its entirety — so invalid pages of the same
block survive until the garbage collector moves them.2.8 How to check if TRIM is active
Windows: fsutil behavior query DisableDeleteNotify
(DisableDeleteNotify=0 -> TRIM enabled,
DisableDeleteNotify=1 -> TRIM disabled)
Linux: cat /sys/block/sdX/queue/discard_max_bytes
(0 = no TRIM support,
non-zero value = TRIM available)
To see if fstrim runs automatically:
systemctl status fstrim.timer
macOS: system_profiler SPSerialATADataType | grep -i 'TRIM Support'
(Yes / No)
— 12 —
Data Recovery — Verified Manual May 2026 Edition
PART I — PHYSICAL FOUNDATIONS
Chapter 3
File systems: the treasure map
3.1 Why the file system decides
The file system (FS) is the software layer that transforms a raw device block (a
succession of sectors) in a tree structure of named files and folders. To this end, he maintains
internal structures that link file name, metadata (size, dates, permissions) and
physical location of the data on the medium.
When you delete a file, the FS typically modifies two or three of these internal structures. The
Content of the file itself is not affected. It is this asymmetry that makes possible the
logical recovery: the raw data survives the deletion of its entry in the "
map”.
But each FS manages this “card” differently. Some keep a lot of traces (NTFS,
with its $LogFile log, is very talkative), others not much (ext4 frees inodes and extents quite
aggressively). This translates into significantly different chances of recovery.
3.2 FAT32 and exFAT: simplicity
These are the simplest FS still used massively, mainly on supports
removable devices (USB keys, SD cards, cameras, dashcams). FAT32 is limited to 4 GB per file;
exFAT (2006, Microsoft) removes this limit and has become the cross-platform standard for storage
mass.Structure: a boot sector at the beginning, one or two FAT tables which describe the chain of clusters
each file, and the rest of the volume in data area. Each file in a directory is
described by a 32-byte entry containing short name, attributes and first cluster.
On deletion:
• The first character of the directory entry is replaced with 0xE5, marking the entry as
deleted.
• Clusters in the FAT table are marked free (zeroed).
• The contents of the clusters themselves remain intact until rewritten.
Recovery is generally very effective on FAT/exFAT, especially for contiguous files (few
fragmentation, which is common on SD cards used in sequential mode). Main limit:
the first letter of the name is lost. Tools often put a wildcard (_) at the
place.
3.3 NTFS: forensic wealth
NTFS (New Technology File System, Microsoft, 1993) has been the standard Windows FS since
Windows NT. It is technically the most generous FS in residual metadata, which makes it
the most salvageable from a logical point of view.
Its central structure is the Master File Table ($MFT): a special file which contains an entry of 1
024 bytes per file and per volume directory. This entry includes:
— 13 —
Data Recovery — Verified Manual May 2026 Edition
• A header (first 42 bytes) with a flag indicating whether the entry is used or deleted.
• A $STANDARD_INFORMATION attribute with the four MACB timestamps (Modified,
Accessed, Created, Birth/MFT changes).
• A $FILE_NAME attribute with the name and a reference to the parent directory.
• A $DATA attribute which contains either the contents of the file directly (if it is less than ~700 bytes,
we speak of a resident attribute), or a list of runs pointing to data clusters.On deletion, NTFS simply toggles the header flag to "deleted" and
mark clusters as free in $Bitmap. The MFT entry itself remains, with all its
attributes. The $LogFile log often keeps track of the latest operations, and the log
$UsnJrnl (enabled by default on modern Windows) lists each creation, modification or
deletion with timestamp.
NTFS tools — For NTFS forensics, two tools dominate: MFTECmd from Eric Zimmerman
(parses the $MFT into CSV usable in Timeline Explorer) and dfir_ntfs by Maxim Suhanov. All
two know how to retrieve metadata from the MFT slack space — the unused areas at
inside MFT entries, which often contain fragments of old entries (article by
reference: Sygnia, The Forensic Value of MFT Slack Space, 2025).
3.4 ext4: Linux specificity
ext4 (2008) is the default FS for most Linux distributions. Three key structural elements:
• The superblock, which contains the global parameters of the FS (total number of inodes, size of
blocks, etc.).
• The inode table, which contains a structure per file/folder with its metadata.
• Extents: ext4 does not describe data blocks file by file (as ext3 did
with its indirect pointers), but by contiguous ranges (extents). More effective for large
files, but more destructive upon deletion.
When deleting a file on ext4:
1. The inode is marked free in the inodes bitmap.
2. The extents are released in the block bitmap.
3. In the inode itself, ext4 partially clears pointers to blocks (unlike
ext3 which retained them). This is what makes recovery more difficult on ext4 than on ext3.The reference tool is extundelete (open source, extundelete.sourceforge.net), which uses the
ext4 log to find old versions of inodes deleted before the log
he himself does not rewrite them. When this fails, debugfs (included in e2fsprogs) allows you to examine
manually the structure:
$ sudo debugfs /dev/sda1
debugfs: lsdel # list recently deleted inodes
debugfs: stat <12345> # inode details 12345
debugfs: dump <12345> /path/file.bin
— 14 —
Data Recovery — Verified Manual May 2026 Edition
Caution — On ext4, if you have just deleted something important, go back
immediately make the partition read-only before any other action: sudo mount -o remount,ro
/dev/sdXY. Any writing, even a simple system log, can reuse inodes or blocks
released.
3.5 APFS: copy-on-write and snapshots
APFS (Apple File System, 2017) replaced HFS+ on macOS, iOS and iPadOS. It's a modern FS
which is based on two principles:
• Copy-on-write. Any modification writes elsewhere and updates the pointers; the old ones
versions are never directly overwritten. This ensures consistency in the event of a break.
• Snapshots. APFS knows how to keep snapshots of the previous state of the volume, at cost
marginal almost zero (since copy-on-write already preserves the old blocks). Time Machine
on macOS relies heavily on this mechanism.
Consequence for recovery: on an unencrypted APFS, deleted files there are
weeks may be present in a local snapshot. Tools like R-Studio, UFS Explorer and
Disk Drill uses these snapshots.
The wall is FileVault. Enabled by default on modern Macs with Apple Silicon chip, FileVault
encrypts the entire volume with AES-256, and the key is protected by the user password and Secure
Enclave. Without the password, the physical data on the medium is only a pseudo-random flow.3.6 Btrfs and ZFS: maximum robustness
Btrfs (Oracle, integrated into the Linux kernel since 2009) and ZFS (Sun Microsystems, 2006, now
OpenZFS) are two FSs from the “copy-on-write + checksums + snapshots” family, designed for
large-scale resilience. They are mainly found on NAS (Synology, QNAP),
Linux servers and storage appliances (TrueNAS).
• Checksums. Each block is protected by a checksum. Silent detection of
corruption (bit rot) is integrated.
• Self-healing. On a mirrored or RAID-Z volume, ZFS can automatically rewrite a block
corrupted from a clean copy.
• Snapshots. Like APFS, at almost zero cost, and used by modern NAS to offer
users of one-time backups.
For recovery: these FS are in practice very little vulnerable to loss by logical corruption
simple; on the other hand, they are at extreme fragmentation (copy-on-write naturally fragments
content over the course of modifications) and the complexity of their internal structures, which makes the data
very inefficient classic carving. The most productive approach on these FS is almost always via
snapshots, not via carving.
— 15 —
Data Recovery — Verified Manual May 2026 Edition
3.7 Summary table
FS Platforms Deletion behavior Logical recovery quality
FAT32 USB, SD, legacy systems
Input marked 0xE5, FAT reset Very good (loss of first letter of name)
exFAT USB, SD, high capacity cards
Same as FAT32, extended capacity Very goodNTFS Windows MFT entry marked deleted, $LogFile and Excellent
$UsnJrnl retain
— the richest
the traces
in residual metadata
ext4 Linux Inode freed, extents cleared aggressively Average — extundelete + log helps in short window
APFS macOS, iOS Copy-on-write, snapshots retained according to policy
Excellent via snapshots; null if FileVault without key
Btrfs / ZFS NAS, Linux servers Copy-on-write, snapshots, checksums Excellent via snapshots; complex otherwise
Why no percentages — No specific percentage has a place in this table,
contrary to what we often read on the internet. Actual recovery depends on parameters
multiple: time elapsed since deletion, system activity in the meantime, fragmentation of
files, media type (HDD or SSD with TRIM), log status. Be wary of tables that
announce “87.3% recovery rate on NTFS”: no one knows how to measure this
rigorously.
— 16 —
Data Recovery — Verified Manual May 2026 Edition
Part II
Diagnosis
Before acting, understand. Two chapters: a quantified overview of the causes of data loss in
2025-2026, and a triage method to decide whether you are facing a logical or physical case, and
if you can intervene yourself or if sending to a laboratory is necessary.
— 17 —
Data Recovery — Verified Manual May 2026 Edition
PART II — DIAGNOSISChapter 4
Causes of loss: figures 2025-2026
4.1 Four families of causes
Losses are classified into four categories which call for very different responses:
• Human and logical: accidental deletion, formatting, mishandling, error
configuration. The support is healthy; the data is logically inaccessible but
physically present.
• Cyber: ransomware, destructive malware, wiper, malicious deletion. Ransomware
adds a layer of encryption; wipers (NotPetya for example) really destroy.
• Hardware: mechanical failure (HDD), electronic failure (burnt PCB), NAND wear (SSD).
• Environmental: fire, flood, power surge, theft, physical destruction.
4.2 Ransomware, the new normal
The Verizon DBIR 2025 Report is the statistical benchmark for data breaches. On the
period covered (November 2023 to October 2024), Verizon analyzed more than 22,000 incidents and 12
195 confirmed compromises. The main figures:
Indicator Value 2024 (DBIR 2025) Trend
Ransomware in breaches 44% +37% vs DBIR 2024
Ransomware in SME breaches 88% Worsening inequalities
Ransomware in large enterprise breaches
39% Stable
Stolen identifiers (initial vector) 22% Always #1
Vulnerabilities exploited (initial vector) 20% +34%
Involvement of a third party (supply chain) 30% Doubled vs DBIR 2024 (15%)
Median ransoms paid $115,000 Declining ($150k in 2023)
Refusal to pay the ransom 64% of victims vs. 50% two years earlier
Source: Verizon Business, 2025 Data Breach Investigations Report, released April 23, 2025.Two opposing readings of the same report. The pessimist: ransomware has become a trend
dominant operation, particularly devastating for SMEs which are victims in nine cases
out of ten. The optimist: the median of ransoms is falling, two out of three victims now refuse to
pay. Public policies (training, cyber requirements) are starting to bear fruit — modestly.
Methodological clarification — DBIR now groups ransomware with pure extortion
(“pure extortion”, without encryption, just exfiltration and threat of disclosure). This explains in
part of the increase — the two categories were counted separately before. The trend
remains strong even taking this grouping into account.
— 18 —
Data Recovery — Verified Manual May 2026 Edition
4.3 Human error, still the majority
The human element (in the broad sense: error, abuse of privilege, social engineering) remains involved in
a dominant part of the compromises. The DBIR 2025 puts this at 60% across all
breaches studied. Definitions vary from report to report — some reach 95% including
any human action before the incident — but the order of magnitude is constant.
For data recovery specifically (and not for compromises in the cyber sense),
The human causes most frequently encountered by laboratories are:
• Accidental deletion of files or directories (including emptying the Trash).
• Formatting by mistake (often when installing an OS).
• Overwriting of files by improper handling (copying a folder in the wrong direction, for example
example).
• Mass deletion by script or command (misplaced rm -rf, drop database, etc.).
• Loss of password or encryption key.
4.4 Average hardware reliability
For hardware failures on HDDs, Backblaze remains the public reference with its Drive report
Stats 2025 (December 2025 / February 2026). Some figures worthy of attention:• On 337,192 production disks at the end of 2025, overall annual AFR of 1.36%.
• Cumulative AFR over the life of the discs (lifetime): 1.30%.
• Zero failure models of the quarter: Some Seagate 8 TB drives (ST8000NM000A) did not have any
than one breakdown in five consecutive quarters.
• Very high AFR models (outliers): a Toshiba MG09 drive in Q3 2025 showed 16.9%
of AFR, explained after investigation by a firmware deployment operation which distorted the
countdown.
For SSDs, no comparable public reporting exists on a large scale. Backblaze publishes some
statistics on its boot SSDs but the fleet is too small to be generalizable. Endurance
theoretical of modern SSDs (TBW guaranteed by manufacturers) normally covers 5 to 10 years
of consumer use; the actual failure is often due to a faulty controller or firmware
corrupted, not to wear and tear on the cells.
4.5 Summary
In 2025-2026, the data loss landscape is summarized as follows:
1. Human error remains the number one cause in volume, particularly among individuals and
SMEs.
2. Ransomware has exploded to become the number one cause in terms of financial impact — it is
now present in almost one in two business compromises.
3. Hardware failures are slowly decreasing on HDD (best quality, AFR below 1.5
%); on SSD, they are less frequent but often more catastrophic when they
occur.
4. Environmental incidents represent a few percent of cases, but their cost
can be colossal (datacenter destroyed, total loss).
— 19 —
Data Recovery — Verified Manual May 2026 Edition
PART II — DIAGNOSIS
Chapter 5Diagnosis and triage
5.1 Why diagnosis is the critical step
The diagnosis decides everything: the choice between software or physical intervention, the choice between
personal attempt or sending to a laboratory, the foreseeable cost and time, and often the result
himself. A bad diagnosis leads to inappropriate actions which worsen the situation.
Caution — Until the diagnosis is made, do not touch anything. Above all, do not launch any
recovery tool “to see”: many of them write to the source media as soon as we
installs them or from the first scan.
5.2 Five-step triage procedure
1. Observe. Is the media powered? Does it make noise? Which ? Is it hot? The BIOS/UEFI
does it detect? Does the OS display it in standard tools (Windows Disk Manager,
macOS Disk Utility, lsblk Linux)? Write everything down without changing anything.
2. Classify. Based on observations, classify into: physical (undetected, abnormal noises,
overheating), logical (detected but inaccessible, missing files, corrupted FS), or hybrid
(intermittent detection, partial reading).
3. Assess the issue. Is data irreplaceable? Do they have judicial value,
medical, professional? Do they exist elsewhere (backup, cloud)? Is the emergency real?
4. Decide on the path. Depending on the combination (type / issue / skills available), choose:
personal intervention, intervention by a general IT technician, or sending to a laboratory
specialized.
5. Document. If the issue could become legal, photograph the state of the support, note the
serial numbers, trace each manipulation. This is the custody chain (see chapter 14).
— 20 —
Data Recovery — Verified Manual May 2026 Edition
5.3 Typical symptoms and their meaning
Symptom observed Probable diagnosis Immediate actionRepeated clicks on HDD ('tick, tick, tick') Read heads broken — physical Turn off immediately, do not reconnect
HDD silent, not detected PCB or motor broken — physical Turn off, send to lab
HDD detected but very slow Bad sectors — scalable physics
Emergency imaging with ddrescue
SSD not detected at all Controller HS — physical Power off, send lab (JTAG/chip-off)
SSD detected, odd capacity (8 MB, 0 MB) Firmware corrupted — physical Send to lab
Partition missing, partition table corrupted
Logic Image ddrescue then TestDisk
Files deleted by mistake Logical — short window on SSD Unplug, don't write anything to it
RAW volume (corrupted NTFS/exFAT) Logic Image then R-Studio/UFS Explorer
Encrypted files with unknown extensions Ransomware See chapter 12
Password prompt on entire diskBitLocker/FileVault/LUKS Find recovery key
5.4 When to go to the laboratory
Three criteria, of which at least one is sufficient:
• The media is not detected, or emits abnormal noises → physical → lab.
• The data is irreplaceable and critical (medical, judicial, high-stakes professional) →
lab, even if the case seems simple.
• You have already tried something that made the situation worse → stop, and let a professional
assess what remains salvageable.
When to go to a lab, how to choose? Some criteria:
• ISO 5 certified clean room (request the ISO 14644-1 certificate).
• Free diagnosis and payment by results — market standard in 2026.
• Written confidentiality (NDA), especially for professional cases.• Verifiable reputation (independent reviews, technical publications, press mentions
specialized).
Questionable laboratory signs — If you are asked to pay in full before diagnosis, or
that you are promised a guaranteed success rate, go. No serious laboratory promises
recovery before opening the media.
— 21 —
Data Recovery — Verified Manual May 2026 Edition
Part III
Methods
Six chapters which constitute the operational heart of the book: how to image a support (the foundation
any other operation), how to analyze the logical layer, how to sculpt files from
raw data (carving), how to physically intervene on a hard drive and an SSD, and
how to manage RAID configurations.
— 22 —
Data Recovery — Verified Manual May 2026 Edition
PART III — METHODS
Chapter 6
Secure Imaging
6.1 The principle: never work on the original
Imaging is the step that separates amateur recovery from professional recovery. She
involves creating a bit-for-bit copy of the source media to an image file, then working
exclusively on this image. The original is put aside, safe.
Three reasons:
1. Save what can be saved. A media that breaks down often does more for
the following hours. Every minute counts; the first reading may be the last one that succeeds.
2. Work calmly. On the image, you can do as many tests as you want. If a tool
corrupts something, we create another copy of it.
3. Preserve the evidence. In forensics, the original is sealed with its reference hash; all work
is also done on a hashed copy. This is what makes the procedure admissible in court (standard
ISO 27037).6.2 ddrescue: the reference tool
GNU ddrescue (gddrescue package on Debian, Ubuntu, and most Linux distributions) is
the reference open source tool. Its superiority over classic dd is due to three elements:
• A map file which precisely records the areas already copied, to be copied, slow
or failed. It allows you to resume exactly where you left off, and to program
targeted passes.
• A reading strategy in several passes: fast first (we skip the slow zones to
recover the easy one), aggressive then (we return to the difficult areas).
• Fine management of error sectors, with configurable maximum number of attempts.
Typical workflow
Identify the device accurately before anything else. A letter error, and it's a
healthy disk that is overwritten.
$ lsblk -o NAME,SIZE,MODEL,SERIAL,TRAN
NAME SIZE MODEL SERIAL TRAN
sda 500G ST500LM030-2E717D WCC6Y0L1234 sata
bathroom 2T WDC_WD20EZRZ WD-WCC4M1234 usb
...
# The serial number allows you to confirm that you are targeting the correct disk.
First pass, quick: copy what is easy to read, skip the rest.
$ sudo ddrescue -f -n -d /dev/sdX /path/image.img /path/image.map
-f: authorizes output to a device
-n: 'no-scrape': does not linger on difficult areas
-d: direct access to the device (bypass OS cache)
— 23 —
Data Recovery — Verified Manual May 2026 Edition
Second pass, targeted on difficult areas with a few attempts:
$ sudo ddrescue -f -d -r3 /dev/sdX /path/image.img /path/image.map
-r3: up to 3 retries per sector in error
On a slamming disc (HS heads), we avoid going higher than -r3: each attempt
extra is one more opportunity to damage the surface. On a disk whose problem
is just electronic (partially faulty PCB, unstable USB), we can go up to -r10 without
additional physical risk.Useful option on certain particularly damaged cases: switches to reverse reading, which helps when
the order of presentation of the sectors plays a role (for example if the head is positioned incorrectly on certain
cylinders):
$ sudo ddrescue -f -d -R -r3 /dev/sdX /path/image.img /path/image.map
-R: 'reverse': reads from the end to the beginning
Once the image is obtained
Calculate a hash of the image. This is the reference of integrity to which we will compare later for
prove that nothing has been changed:
$ sha256sum /path/image.img > /path/image.img.sha256
To explore the image in read-only mode without risk, we mount it via a loop device:
$ sudo losetup --read-only --find --show /path/image.img
/dev/loop0
# On ext4: noload prevents log replay (which would write)
$ sudo mount -o ro,noload /dev/loop0 /mnt/recover
# On NTFS via ntfs-3g:
$ sudo mount -t ntfs-3g -o ro,norecover /dev/loop0 /mnt/recover
# Disassemble and release the loop when finished:
$ sudo umount /mnt/recover
$ sudo losetup -d /dev/loop0
Caution — Store the mapfile and image on media separate from the source. If the image is on the
same USB key as the broken media (case seen in the lab: the user only had that on hand),
and this key falls, we have lost everything. Always on a healthy, fast disk with enough space.
6.3 Alternatives to ddrescue
FTK Imager (AccessData/Exterro, free). Very popular Windows tool in forensics. Creates
images in E01 (EnCase) or raw DD format, calculates MD5/SHA1/SHA256 automatically, supports
hardware write blockers.
Guymager (Linux, GUI). Graphical interface for creating forensic images. More practical
than ddrescue for occasional users but less flexible on difficult cases.
dc3dd (DoD Cyber Crime Center). Variant of dd improved for forensics: hash on the fly,
logging, validation. Useful when ddrescue is not suitable (linear image of a healthy support
for proof).
— 24 —
Data Recovery — Verified Manual May 2026 EditionHardware tools: PC-3000 Disk Imager (ACE Lab), DeepSpar Disk Imager, Atola Insight Forensic.
These hardware solutions handle severely damaged media better than purely tools
software (direct control of the controller, fine management of resets, masking of HS heads on HDD).
Reserved for laboratories due to cost (several thousand to tens of thousands of euros).
6.4 Write blockers: maximum security
For forensic cases (evidence in court), we insert between the source support and the machine
analysis a hardware write blocker: a device that lets readings pass but blocks
physically any writing. This ensures that no software bugs can modify the source. The
reference brands: Tableau (Guidance Software/OpenText), WiebeTech (CRU).
For non-forensic but prudent use, the software write blocker available via the settings
BIOS/UEFI (“write protect”) or via tools like blockdev --setro under Linux is sufficient in practice.
— 25 —
Data Recovery — Verified Manual May 2026 Edition
PART III — METHODS
Chapter 7
Logic Analysis and FS Repair
7.1 The principle: rebuild the map before the content
Once the image is obtained, logical analysis seeks to repair or interpret the structures of the
file system present on the image, rather than directly searching for files in the
raw data. It is almost always more effective than carving: we not only recover the
content, but also names, dates, tree structure.
The standard logical order is:
1. Repair partition table (if missing or corrupt).
2. Repair of FS structures (MFT for NTFS, inodes for ext4, APFS snapshot, etc.).
3. Extraction of present files (users and deleted).
4. If the logic layer remains unusable, switch to carving (chapter 8).7.2 TestDisk: the partition table
TestDisk (Christophe Grenier, CGSecurity, free, open source) is the reference tool for
repair of MBR and GPT partition tables, and for recovery of deleted partitions. He
works on Windows, macOS and Linux, in text mode (ncurses).
Typical workflow on an image that has lost its table:
1. Run testdisk /path/image.img.
2. Choose “None” for log creation (on a read-only image).
3. Select the disk/image, then the table type (Intel/PC for MBR, EFI GPT for GPT
modern).
4. Launch “Analysis” then “Quick Search”. TestDisk scans the media and offers the partitions
found.
5. If Quick Search is not enough, launch “Deeper Search” (slow but exhaustive).
6. Check that the partitions found are the correct ones (size, type), then write the new table
(“Write”).
Write on the image — On a recovery image, you can write unscrupulously — the original
physical is not affected. This is all the more reason to always image first.
7.3 NTFS: MFT, $LogFile, $UsnJrnl
To analyze an NTFS volume, several additional tools:
• R-Studio and UFS Explorer (commercial) are the benchmarks for NTFS reconstruction — they
know how to repair a partially damaged MFT, go up the tree from the entries
deleted, use the log.
— 26 —
Data Recovery — Verified Manual May 2026 Edition
• MFTECmd (Eric Zimmerman, free) parses the $MFT file into a usable CSV. Allows you to list
all files and folders on the volume — including deleted ones whose MFT entry exists
again.
• LogFileParser and UsnJrnl2Csv (Eric Zimmerman) use logs to reconstruct the
chronology of recent operations.
• The Sleuth Kit (TSK, free, open source) and its Autopsy interface offer a complete framework
multi-FS forensic analysis, including NTFS. Exemple de chaîne d'analyse NTFS en ligne de commande sous Linux :
# Monter l'image en lecture seule
$ sudo losetup --read-only --find --show /chemin/image.img
$ sudo mount -t ntfs-3g -o ro,norecover /dev/loop0 /mnt/recup
# Avec The Sleuth Kit : lister tous les fichiers, y compris supprimés
$ fls -r -p /chemin/image.img > fichiers.txt
# Les fichiers supprimés sont marqués '*' au début de la ligne
# Récupérer un fichier supprimé par son inode
$ icat /chemin/image.img 12345 > fichier_recup.bin
7.4 ext4 : extundelete, debugfs, ext4magic
Trois outils principaux :
• extundelete exploite le journal ext4 pour retrouver les anciennes versions des inodes supprimés.
Restaure dans un répertoire dédié RECOVERED_FILES/.
• debugfs (inclus dans e2fsprogs) fournit un accès interactif aux structures internes. Permet le
diagnostic fin (lister les inodes récemment supprimés, dumper un inode précis).
• ext4magic combine les deux approches et offre une interface de plus haut niveau.
Exemple :
# Volume démonté ou monté en RO !
$ sudo umount /dev/sdb1 # si monté
# Restaurer un fichier précis dont on connaît le nom
$ sudo extundelete --restore-file 'home/user/important.pdf' /dev/sdb1
# Restaurer tout ce qui est récupérable
$ sudo extundelete --restore-all /dev/sdb1
# Avec debugfs, lister les inodes supprimés (Linux)
$ sudo debugfs /dev/sdb1
debugfs: lsdel
Inode Owner Mode Size Blocks Time deleted
1234 1000 100644 524288 128 Sun May 4 14:32:11 2026
debugfs: dump <1234> /tmp/recovered
debugfs: quit
7.5 APFS : exploiter les snapshots
Sur APFS non chiffré, la priorité absolue est de chercher les snapshots locaux. Time Machine en
crée régulièrement et les conserve un certain temps même quand on est éloigné du disque externe
Time Machine.
# Lister les snapshots APFS sur un Mac vivant
$ tmutil listlocalsnapshots /
— 27 —
Récupération de données — Manuel vérifié Édition mai 2026
# List snapshots on a volume mounted read-only
$ diskutil apfs listSnapshots /Volumes/data
R-Studio and UFS Explorer Professional know how to use APFS snapshots — including from
of a raw image. They are preferable to manually writing scripts for non-trivial cases.
On encrypted APFS (FileVault), no mystery: without the key (user password or security key
24-character recovery stored by Apple upon activation, or institutional key for Macs
company), no recovery possible. Check with user — many have their key
recovery in iCloud without knowing it.
7.6 Btrfs and ZFS: snapshots and lists
On Btrfs, snapshots are managed at the subvolume level. For Synology NAS (which
use Btrfs with automatic snapshots), the DSM console allows you to return to a previous state
in just a few clicks. From the command line on the NAS or a Linux machine:
# List Btrfs snapshots
$ sudo btrfs subvolume list /volume1
# Restore a file from a snapshot
$ cp /volume1/.snapshots/123/file.pdf /volume1/file.pdf
On ZFS, it's even more direct:
# List ZFS snapshots
$ sudo zfs list -t snapshot
# Roll back to a specific snapshot (loss of subsequent changes!)
$ sudo zfs rollback pool/dataset@snapshot_name
# More careful: just read-only access to the snapshot
$ ls /pool/dataset/.zfs/snapshot/snapshot_name/
— 28 —
Data Recovery — Verified Manual May 2026 Edition
PART III — METHODS
Chapter 8
In-depth data carving
8.1 When to carve
Data carving (“sculpture of files”) is the operation which reconstitutes files by searching
their binary signatures in the raw data of the medium, without using the structures of the
file system. This is the operation of last resort when the logic layer is too
damaged to be interpreted.
Typical cases:
• Complete formatting (the entire FS structure has been rewritten, the file contents are still there).• Raw image from a chip-off (no FS at all, just re-assembled NAND).
• Reinstallation of OS which wrote its new system on the old one (the old structure is
partially crushed).
• Media so corrupted that logic tools find nothing.
8.2 Four levels of sophistication
Level 1 — Simple signature (header / footer)
The historical approach. We scan the support in search of a magic number characteristic of the
start of the file format, then read up to the end magic number (if it exists) or up to a size
maximum set. Some examples of classic signatures:
Format Header (hex) Footer / end
JPEG (JFIF) FF D8 FF E0 FF D9
JPEG (Exif) FF D8 FF E1 FF D9
PNG 89 50 4E 47 0D 0A 1A 0A 49 45 4E 44 AE 42 60 82
PDF 25 50 44 46 ("%PDF") 25 25 45 4F 46 ("%%EOF")
ZIP / DOCX / XLSX 50 4B 03 04 Variable (central directory)
MP4 / MOV (offset 4) 66 74 79 70 No fixed footer
RAR (v5+) 52 61 72 21 1A 07 01 00 Variable
SQLite 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00
—
Very effective on non-fragmented files of moderate size. Fails as soon as a file is
fragmented (the carver blindly follows contiguous blocks and ends up incorporating data from one
other file or zeros). Typical tools: PhotoRec, Foremost, Scalpel.
— 29 —
Data Recovery — Verified Manual May 2026 EditionLevel 2 — Semantic carving (structure-aware)
We exploit the internal structure of the format to validate and reassemble. For a PDF, this is the table of
cross-references (xref) which points to each object; for a ZIP, it's the central directory at the end
file. This makes it possible to reconstruct even fragmented files, provided that all of them are found.
the pieces.
Commercial forensic tools (Belkasoft X, X-Ways Forensics, Magnet AXIOM) integrate this
level for common formats. Open source tools (Bulk Extractor) are good on some
specific formats.
Level 3 — Entropy Analysis
We calculate the Shannon entropy per block to distinguish three regimes: highly ordered zones
(text, code, structures), moderately entropic areas (compressed images, archives), areas with
maximum entropy (encrypted or random data). This allows carving to be targeted on areas
interesting and avoid extracting fragments of encrypted data which would yield nothing.
Level 4 — Machine learning
Recent approaches (2023-2026) use neural networks to classify fragments
and try to reassemble them. Notable research projects: Carve-DL (University of Texas, 2023),
work of the Forensic Computing Research Group in Mannheim. Belkasoft X and Magnet AXIOM
have been announcing ML modules since 2024-2025. The results are promising on certain formats
(compressed images, Office documents) but remain limited in practice. Public literature does not
does not give comparable and reproducible success rates.
8.3 PhotoRec: the open source standard
PhotoRec (CGSecurity, included with TestDisk) is the most widely used open source carving tool.
Cross-platform, supports over 480 file signatures, and is designed to work on
images as on direct media.
# Launch PhotoRec on an image
$ sudo photorec /path/image.img
# Launch on a direct device (avoid when you have an image)
$ sudo photorec /dev/sdb
The interface is in text mode (ncurses). Steps:
1. Choose the support / image.2. Select the partition table type (Intel/PC generally).
3. Choose the partition (or “Whole disk” if the table is destroyed).
4. Choose the original file system (ext, NTFS, FAT) to optimize the algorithm — or “
Other” if unknown.
5. File Opt: select file types to search. Turn off what you don't have
need it, otherwise you'll get millions of junk files.
6. Choose the output directory (never on the source media).
7. Let it run. PhotoRec is slow: allow several hours for 1 TB.
— 30 —
Data Recovery — Verified Manual May 2026 Edition
Warning — PhotoRec never recovers the original file names — it renames them to
f0000001.jpg, f0000002.pdf, etc. Manual or scripted sorting must be planned after extraction. For a
serious forensic use, prefer an FS-aware approach (chapter 7) when possible.
8.4 Scalpel and Foremost
Foremost (created by the Air Force Office of Special Investigations) and Scalpel (fork of Foremost with
performance improvements) are two command-line carving tools that rely on
a configuration file listing the signatures to search for.
# Foremost - fast carving with default config
$ sudo foremost -i image.img -o output/
# With specific types
$ sudo foremost -t jpg,pdf,doc -i image.img -o output/
# Scalpel - uses scalpel.conf which we edit before
$ sudo scalpel -c /etc/scalpel/scalpel.conf -o output/ image.img
8.5 Hard carving limits
• Fragmentation. On very fragmented FS (ext4 used for a long time, ZFS/Btrfs in
copy-on-write), the files are split into pieces. Simple signature carving recovers the
first fragment then noise. Semantic carving helps but is no miracle.
• Encryption. Encrypted content has maximum entropy and is unlike any other format.
known file. Without the key, carving achieves nothing.• Compression. A ZIP, MP3 or JPEG file that has lost its first blocks is generally
irrecoverable even if the rest is intact — compression is by construction “all or nothing”.
• False positives. Many random sequences look like signatures. On 1 TB of
Raw NAND from chip-off, carving can produce millions of files, 99% of which are
noise.
— 31 —
Data Recovery — Verified Manual May 2026 Edition
PART III — METHODS
Chapter 9
Physical intervention on HDD
9.1 The clean room
Opening a hard drive outside of a clean room is the most costly mistake possible. The layer
magnetic platens are only a few nanometers thick, and the heads fly at
a few nanometers above. An ambient dust particle (5 to 50 microns typically)
stuck under a head acts like a stone under a train: the magnetic layer is torn off on the
trajectory of the head.
The international standard that defines clean room classes is ISO 14644-1. She expresses the
particle concentration limits per cubic meter based on particle size. The
relevant classes for data recovery:
ISO class Particles ≥0.5 micron / m<super>3</super>
Typical usage
ISO 3 ≤ 35 Semiconductor manufacturing
ISO 4 ≤ 352 High-end recovery (Secure Data Recovery)
ISO 5 (Class 100) ≤ 3,520 Standard HDD recovery (DriveSavers, SalvageData, Gillware, ACE Data R
ISO 6 (Class 1000) ≤ 35,200 Too lax for HDD
ISO 7 (Class 10,000) ≤ 352,000 Preparation area, airlock
Typical ambient air ~10,000,000+ Absolutely avoidSources: ISO 14644-1:2015; certification pages DriveSavers, SalvageData, Gillware, Secure Data Recovery
(accessed 2026).
An ISO 5 cleanroom uses laminar (unidirectional) HEPA or ULPA filtered airflow. The air is
renewed several hundred times per hour. Technicians wear full body suits
(gloves, cap, overshoes), and the equipment is cleaned with isopropanol and passed under flow
laminar before entry.
Cost and certification — A clean room is not a closet with an air purifier. It's a
technical installation with entrance airlock, continuous monitoring of particle concentration,
humidity and temperature monitoring, annual certifications. The cost of installation and
maintenance is one of the reasons why professional physical recovery is
billed several hundred to several thousand euros.
9.2 The queen technique: the head swap
When one or more read heads fail (the most common case in HDD recovery),
the solution is to transplant the head/arm assembly from an identical donor disc. This is the
head swap.
Clean room steps:
1. Accurate identification of the model, firmware revision and manufacturing batch of the patient disk.
— 32 —
Data Recovery — Verified Manual May 2026 Edition
2. Sourcing a strictly identical donor disk. Laboratories keep a stock of
hundreds of models, or buy them from specialized wholesalers.
3. Opening the two discs under laminar flow, dismantling the head/arm assemblies using
dedicated tools (specific keys, head separators to prevent them from touching when they
are off the disk).
4. Transfer of the head/arm assembly from the donor to the patient.
5. Close the patient, re-energize.
6. Immediate imaging with a hardware imager (PC-3000, DeepSpar), before the new
combination does not wear out in turn.The donor must be identical up to the firmware revision. A model giver apparently
identical but from another firmware revision can result in a disk that spins but reads nothing: the
head/firmware calibration is fixed at the manufacturer.
9.3 PCB swap and ROM reprogramming
If the fault is on the external printed circuit (overvoltage, blown TVS), the PCB can be replaced with
that of a donor. But be careful: on most modern disks, settings of
calibration specific to the physical medium (bad sector map, head parameters, etc.)
are stored in a ROM on the PCB. Without transferring this ROM (by desoldering and
resoldering, or via PC-3000), the patient disk with a donor PCB will at best produce
unreadable data.
PC-3000 also allows you to directly reprogram the ROM via a COM/UART connection to
PCB test points. It's fast and non-destructive.
9.4 Special cases
9.4.1 SMR disks
SMR drives (see 1.3) pose specific challenges. When the firmware or zone
translation is corrupted, we cannot simply read the plates: we must reconstruct the mapping
LBA → physical location taking into account cache and tapes. PC-3000 has released
dedicated SMR modules from 2020. The success rate remains lower than that of CMRs
equivalents.
9.4.2 Section
When the heads remain stuck to the plate at startup, you can try to “take off”
manually in the clean room by rotating the trays by hand while applying
briefly the power supply. Very delicate — there is a risk of tearing off the magnetic layer under the heads.
9.4.3 Striped trays
If the scratch is superficial and localized, we can often recover what is outside the area
scratched (with lost sectors). If the scratch is deep or extensive, it is terminal — the layer
magnetic under the scratch is torn off, the data that was there is no longer there.Some extremely specialized laboratories practice platter swap: transfer of platters
from a patient disc to a donor mechanical box. It is technically the most delicate
(moving a plate without desynchronizing its position relative to the heads is almost impossible) and the
success rate is low. To be reserved for extreme cases with very high stakes.
— 33 —
Data Recovery — Verified Manual May 2026 Edition
9.5 Why not try at home
The calculation is simple: typical atmospheric dust contains particles of 5 to 50 microns,
a thousand times more than the space between the head and the plate. A single particle that slides onto a
tray when you open the case on your desk, and the first rotation after reassembly will scratch
irreparably the surface.
We regularly see messages in recovery forums from users who “wanted to
try » to open their hard drive. The laboratories which receive these cases subsequently
almost always see irreversible damage. On this type of failure, there is no “see what
what happens” — either we have a clean room, or we don’t open.
— 34 —
Data Recovery — Verified Manual May 2026 Edition
PART III — METHODS
Chapter 10
Physical intervention on SSD
10.1 Why it is harder than HDD
On an HDD, data is magnetic and persistent. If we manage to rotate the trays and
read (by head swap, PCB swap, etc.), we have access to the bits as they were written.
On an SSD, the data is:
• Electric (charge trapped in cells), therefore potentially volatile over time if it
is not refreshed.
• Scrambled by the controller to balance the electrical loads — you need to know
untangle.• Coded by an ECC specific to the controller — you must know how to decode.
• Logically mapped by a Flash Translation Layer (FTL) that only the original controller
knows perfectly.
• Often hardware encrypted (SED, TCG Opal) by a key that only the original controller can
unlock.
Three intervention techniques, in order of preference (the least destructive first):
10.2 JTAG / ISP: non-destructive
Modern SSD controllers often expose test points corresponding to a protocol of
internal debugging: JTAG (Joint Test Action Group) or ISP (In-System Programming). By welding
temporarily thin wires on these points, and by connecting to a dedicated programmer, we can:
• Read controller firmware.
• Inject a recovery loader which bypasses the dead firmware and directly accesses the
NAND via controller capabilities.
• On certain configurations, make the controller speak as if it were functioning normally, and
image via SATA or NVMe.
Advantages: NAND is read by its original controller, so descrambling and ECC are managed
automatically, and the hardware encryption remains decrypted if the key is present. The support
physical is not destroyed.
Disadvantages: requires specialized tools (PC-3000 Flash with JTAG adapters, or solutions
third parties like RTPro, Medusa Pro), good skills in precision micro-welding, and the
knowledge of test points for each family of controllers. PC-3000 maintains a base of
schematics per controller, accessible to contract labs.
10.3 Chip-off: the technique of last resort
If JTAG fails or is not applicable (controller dead, test points missing), unsolder
physically the NAND chips to read them independently of the controller.
— 35 —
Data Recovery — Verified Manual May 2026 EditionStep 1 — Desoldering
NAND chips are almost always in a BGA (Ball Grid Array) package — hundreds of balls
solder under the component, invisible from above. Desoldering requires a desoldering station
hot air (or infrared) rework with a precise thermal profile: progressive preheating of the PCB,
rise towards the melting temperatures of the solder (typically 220 to 250 °C depending on the alloy),
short hold, and extraction with forceps. A poorly calibrated profile damages the chip before desoldering.
A simple soldering iron is never enough — it concentrates heat on one point and cracks the chip.
Step 2 — Reading the Bullets
Solder balls are cleaned (laboratories often use re-balling to
replace properly). The chip is then placed on a socket adapted to its exact format
(BGA152, BGA132, BGA100, etc., or TSOP for older models). The socket is plugged into
a NAND programmer: PC-3000 Flash (ACE Lab), Flash Extractor (Soft-Center), DeepSpar NAND
Reader, or niche solutions.
The programmer reads the raw pages — typically 4, 8 or 16 KB of user data per page,
plus an OOB (Out-Of-Band) zone of a few hundred bytes which contains the metadata and
the ECC.
Modern NAND cells (TLC and QLC) have a narrow voltage level margin. A
Single reading can produce random errors (bit flips). Laboratories often perform 3 to
10 successive readings and merge the results by majority vote before moving on to the next step
following.
Step 3 — Logical reconstruction
This is the most complex step. The chip does contain data, but it is not in a
usable order:
• The controller applied a scrambler which xor-ed the data with a sequence
pseudo-random, to balance the loads. We must find and disapply this algorithm.
• ECC protected every page. You need to know which one (BCH, Reed-Solomon, LDPC depending on
models), with what parameters, and decode it to correct residual bit-flips.• FTL (Flash Translation Layer) mapped logical LBAs to physical pages, with wear
leveling. The same physical page can contain several successive versions of the same LBA
— you need to know which one is valid.
• On multi-chip SSDs, LBAs were striped between chips. The sequence must be reconstructed.
None of these steps are documented by the controller manufacturers (Phison, Silicon Motion,
Samsung, Marvell, Micron). The laboratories use profile databases per controller and firmware,
built by reverse engineering and maintained at great expense. PC-3000 Flash is the platform
dominant for this work; it includes thousands of profiles updated with each update
software. Without access to these profiles, chip-off is possible but the result is almost always
unusable.
10.4 The wall of hardware encryption
If the SSD uses an SED (Self-Encrypting Drive, TCG Opal 2.0 standard), all the contents of the NAND
is encrypted on the fly by the controller, with an AES key stored in the controller and unlocked
at each startup with the ATA password or pre-boot authentication. The chip-off gives
encrypted content; without the master key, it's definitely unusable.
— 36 —
Data Recovery — Verified Manual May 2026 Edition
Special case: BitLocker on Windows uses AES software by default except on TCG compatible SSD
Opal where, since Windows 10 1903, BitLocker relies on hardware encryption by default (the option
“eDrive”). It's a security debate — several SSDs have had buggy Opal implementations
which made encryption trivial to circumvent, prompting Microsoft to propose reverting to
default software. But for recovery, the effect is the same: without the key, no chance.Caution — If you have an encrypted SSD and you no longer have the key (password
forgotten, TPM reset, machine destroyed), no laboratory in the world will recover your
data. Properly implemented AES-256 is mathematically indecipherable with
current means. This lack of option is a security feature, not a bug.
Practical consequence: if your data is truly critical, store your recovery keys
off the machine — in a password manager, on paper in a safe.
10.5 eMMC and UFS cases
Embedded media for smartphones and tablets (eMMC, UFS) are variants of NAND
with controller integrated in the same housing (monolithic architecture). Desoldering is still
more difficult: the chip is smaller, and all the control electronics are inside — there is no
Separate NAND to read independently.
Laboratories often use ISP (In-System Programming) on these media, which consists of
Temporarily solder to a phone's test points without desoldering the chip. This allows to
read content via controller capabilities — handy on iPhone and Android when encryption
is not activated or the key is known.
On recent iPhones (from A7/A8) and on most post-2018 Androids, encryption of
eMMC/UFS is activated by default, with a key linked to the user passcode and a Secure Enclave.
The chip-off doesn't give anything usable. See chapter 13 for mobile specific options.
— 37 —
Data Recovery — Verified Manual May 2026 Edition
PART III — METHODS
Chapter 11
RAID and advanced storage
11.1 Reminder of RAID levels
For the record:
Level Principle Fault tolerance Recovery if faultRAID 0 Pure striping, data spread across NNone
disks— any failure losesReconstruction
all the necessary stripes
RAID 1 Mirror: each disk is a copy of
N-1
the other
disks (on N) Trivial: recover from the healthy mirror
RAID 5 Striping + distributed parity on N disks
1 disk Reconstruction possible with parity; a 2nd failure = disaster
RAID 6 Striping + dual parity 2 drives Wider tolerance, but slow rebuild
RAID 10 Mirroring + striping (RAID 1+0) 1 disk per mirror Trivial as long as one mirror remains
RAID-Z (ZFS) RAID 5/6 variant with checksums 1 to 3 disks according to Z1/Z2/Z3
Self-healing if tolerance respected
11.2 Why RAID complicates recovery
A RAID array is not a simple concatenation of disks: it is a logical layer which distributes
the blocks according to parameters (stripe size, order of disks, parity offset) that are necessary
know precisely to reconstruct the array.
When the array rotates, the controller (hardware or software) does this work. When the array falls —
failed controller, too many failed drives, corrupted RAID metadata, manual recombination
failed — you have to reconstruct the logic of the array by hand, by analyzing the raw content of the disks.
The tools that do this work (R-Studio Network, UFS Explorer RAID, Reclaime) perform
typically like this:
1. We image each member disk individually.
2. We analyze the first megabytes to detect RAID signatures (mdadm headers on
Linux, proprietary structures on hardware controllers).3. If the metadata is missing or corrupted, an automatic detection of the metadata is attempted.
parameters by looking for recognizable FS structures (NTFS header, ext4 superblock) and
by testing different hypotheses on the stripe size, the order of the disks, the direction of rotation of
parity.
4. Once the parameters are found, the array is virtually reconstructed in the tool (not
physically) and presented as a volume on which the normal FS analysis is launched.
11.3 The golden rule: image first, reconstruct later
The most common error: trying to rebuild the array in place, by putting the disks back into the
original controller and requesting a rebuild. If the array is degraded or the metadata is
inconsistent, the rebuild writes to the remaining disks and can destroy stripes still
recoverable.
The professional procedure is invariable:
— 38 —
Data Recovery — Verified Manual May 2026 Edition
1. Physically label each member disk (position, serial number, observed state).
2. Remove the discs from the array and the machine.
3. Image each disk individually with ddrescue or a hardware imager.
4. Work exclusively on images, never on the original discs.
5. Reconstruct the array virtually in the tool.
11.4 The special case of degraded RAID 5
RAID 5 tolerates disk failure. The danger: if a disk is broken and during the rebuild a
second disk falls, the array is lost. And statistically, that's exactly what's happening more
more often on modern arrays:• Disk capacities increase (10, 14, 20, 26 TB) but read error rates
unrecoverable (URE) remain of the same order (~10^-14 bits on consumer disks). On a
rebuild of 20 TB, there is a significant probability of encountering a read error somewhere
leaves.
• The rebuild heavily stresses the remaining disks (intensive readings over several hours at
days). This is precisely the situation where a marginal disc will fail.
Consequence: for modern arrays larger than a few TB, RAID 5 is no longer considered
as sufficient by storage architects. RAID 6 (double parity), RAID 10 or RAID-Z2/Z3 are
current recommendations.
11.5 Hardware vs Software RAID
Hardware RAID: a dedicated controller (PERC Dell, MegaRAID Broadcom/LSI, SmartArray HPE) manages
the array. RAID metadata is stored on disks in the controller's proprietary format.
More complex recovery if the controller falls: you have to find a compatible controller (even
model, same firmware ideally) or rebuild the array by hand.
Software RAID: managed by the OS. On Linux, mdadm stores metadata in mdraid format
standard, documented and recoverable. On Windows, Storage Spaces uses a clean format but
well analyzed. On macOS, AppleRAID (limited to RAID 0 and 1) is simple.
For a new infrastructure, software RAID is often preferable today: recovery more
easy, hardware independence, no dependence on a controller that we may no longer find
in five years.
11.6 NAS and proprietary arrays
Consumer NAS (Synology, QNAP, Asustor) implement their own variants:
• Synology Hybrid RAID (SHR): variant of RAID 5/6 which allows you to mix disk sizes
different. Relies on mdadm + LVM + Btrfs or ext4.
• QNAP RAID: standard mdadm + ext4 or ZFS on certain models.
• TrueNAS: Native ZFS, with RAID-Z1/Z2/Z3 depending on configuration.Good news: these formats are all well supported by R-Studio Technician, UFS Explorer
Professional/RAID Recovery, and Reclaime. Recovery from an HS NAS follows the same logic:
extract disks, image, mount on a Linux machine or in the recovery tool.
— 39 —
Data Recovery — Verified Manual May 2026 Edition
Check Snapshots First — On Synology and QNAP NAS, most configurations
Modern ones include automatic Btrfs snapshots. Before any recovery operation
complex, checking if a snapshot does not already contain what we are looking for: it is almost always
faster.
— 40 —
Data Recovery — Verified Manual May 2026 Edition
Part IV
Special cases
Three areas where the general techniques of previous chapters fit or clash
specific constraints: encryption (which can transform a trivial case into impossible),
mobile media (smartphones, tablets), and the judicial context (where the procedure counts as much
than the technique).
— 41 —
Data Recovery — Verified Manual May 2026 Edition
PART IV — SPECIAL CASES
Chapter 12
Encryption and recovery
12.1 A paradigm shift
When a medium is not encrypted, the data is readable by anyone accessing the storage
physical. When a medium is encrypted, the data is no longer information; it's a sequence of bits
indistinguishable from random noise. Recovery becomes a cryptanalysis problem, which means
say in practice: impossible without the key.
This is a good thing for security; it is an impassable wall for recovery. All the
question becomes: can we find the key?12.2 BitLocker (Windows)
BitLocker encrypts Windows volumes with AES-128 or AES-256. The master key (FVEK, Full Volume
Encryption Key) is protected by one or more protectors:
• TPM (Trusted Platform Module): the key is stored in the secure module of the motherboard, and
released at startup if the system status is compliant.
• User password.
• 48-digit recovery key (saved in Microsoft / Azure AD account of
user, or printed on paper).
• USB key.
• Smart card.
To recover a BitLocker volume, you need at least one of these protectors. Good track
systematic: the recovery key saved in the Microsoft account. To be collected via
account.microsoft.com (personal account) or via AD/Azure administrator (enterprise).
Without any protectors, properly implemented AES-128 or AES-256 resists all attacks
known. Give up.
12.3 FileVault (macOS)
FileVault 2 encrypts the entire APFS volume with AES-XTS. On Macs with Apple Silicon chip
(M1, M2, M3, M4) encryption is enabled by default, managed by the Secure Enclave, and inherent to
hardware architecture — it doesn't really turn off.
Possible recovery routes:
• User password (unlocks it at login).
• 24-character recovery key (generated when FileVault is activated and the user has
normally noted or stored in iCloud).
• For corporate Macs, institutional key configured by IT department before
deployment.
— 42 —
Data Recovery — Verified Manual May 2026 Edition
Without any of these channels, the chip-off has no interest: even if the chips are read perfectly
NAND, we only get encrypted data.
12.4 LUKS (Linux)
LUKS (Linux Unified Key Setup) is the volume encryption standard in Linux. Implemented
by cryptsetup. The LUKS volume contains a LUKS header with up to 8 storage slots.
passphrase, and a master key encrypted by each passphrase.
Recovery :• If the user knows the passphrase of a slot, everything is fine: cryptsetup open /dev/sdaX name.
• If the header is corrupted but we have a backup (made with cryptsetup
luksHeaderBackup), it can be restored.
• Without anything: the master key is protected by Argon2 or PBKDF2 with a high cost factor. The
Brute force on modern passphrase (12+ characters mixed) is impractical.
Prevention advice — For LUKS users: save your LUKS header as soon as possible
start and keep it off the disk! A simple corruption of the header (a few sectors at
start of the device) makes the volume permanently unreadable if you don't have the backup.
12.5 Self-Encrypting Drives (SED, TCG Opal)
Hardware encryption built into the SSD controller is increasingly the norm. He is:
• Always active (the data is encrypted even when no password is defined — the
controller “decrypts” with a default key).
• Activable on the user side via BIOS/UEFI (ATA password) or TCG Opal Manager software.
• Instantly erasable by generating a new master key — this is the famous crypto function
erase which makes SSD disposal safe in seconds.
For recovery: without a password (if it has been defined), nothing is possible. With password, we
unlocks via ATA security feature set or Opal command. Several SSDs have had
Failed Opal implementations in the past (Crucial MX100/MX200, Samsung 840 EVO/850
EVO before firmware EMT02B6Q) which allowed to bypass - but counting on that is
play the lottery.
12.6 Ransomware: what is really possible
When a workstation or server is hit by ransomware, user files are encrypted
with a key (typically AES) itself encrypted by the attacker's public key. Without the key
corresponding private data — held by the attacker — decryption is mathematically
impossible.
Ways to systematically examine before giving in to despair:1. Is there a public decryptor? The No More Ransom project (nomoreransom.org), led by
Europol, publishes free tools for variants whose keys have been seized or vulnerabilities
cryptographic discoveries. More than 200 tools available in 2026.
2. Is the machine still on? If the attack is recent and the machine has not been
restarted, the clear AES key may still be in RAM. A RAM analysis (dumpit,
— 43 —
Data Recovery — Verified Manual May 2026 Edition
Volatility) can recover it.
3. Is there a Shadow Copy? On Windows, vssadmin may reveal Volume Shadow
Copies that the ransomware failed to delete.
4. Are the backups intact? Primal question. Modern ransomware seeks
and actively deletes backups. If they are immutable or air-gapped (see chapter
17), we are saved.
5. Do you have to pay? Complex question and not recommended by the authorities, but to which 36% of
victims in 2024 still answered yes. This does not offer any guarantee of decryption.
Caution — Keep files encrypted even if they cannot be decrypted today. The
historical ransomware keys are regularly seized by law enforcement (LockBit, Hive,
REvil, etc.) and published months or years after the attack. Store encrypted files on a
offline disk; one day you might be able to decipher them.
12.7 Case study — Maersk and NotPetya (June 2017)
■ Maersk / NotPetya: the backup saved by a power outageOn June 27, 2017, the shipping giant Maersk was hit by NotPetya, destructive malware in disguise
in ransomware, spread via a tricked update of Ukrainian accounting software M.E.Doc. In 7
minutes, the malware spreads throughout the entire Maersk network: 45,000 to 49,000 stations, 4,000
servers destroyed, including all ~150 Active Directory domain controllers. NotPetya
is not reversible (decryption is impossible by construction): the machines are dead.
Maersk has backups of individual servers (between 3 and 7 days old depending on the case), but
no backup of domain controllers — the architecture assumed that all 150 controllers
backed up each other by replication. But they were all destroyed simultaneously. Without
AD, nothing can be restored.
Salvation: A domain controller in Ghana was offline at the time of the attack, due to
of a local power outage. He had survived. Maersk had it physically transported (the network
being destroyed) in London where the recovery center had been set up. This controller served as a basis
to rebuild the entire infrastructure.
Results: 10 days of total paralysis, estimated loss of 250-300 million dollars for Maersk
(internal estimate, considered conservative). Overall, NotPetya cost around 10 billion
dollars through Merck, FedEx/TNT, Mondelez, Saint-Gobain and others. Sources: testimonials
CISO Maersk at Gartner Risk Summit 2019; Wired, The Untold Story of NotPetya, 2018; Control
Engineering, Throwback Attack, 2025.
Lesson: online and synchronous backups do not protect against an attack
which destroys them all at once. Survival came by chance (a power outage that
disconnected a server just in time). An air-gapped or immutable backup would have avoided the
chance.
— 44 —
Data Recovery — Verified Manual May 2026 Edition
PART IV — SPECIAL CASES
Chapter 13Mobile supports (Android, iOS)
13.1 Context
A modern smartphone typically contains more personal data than a desktop computer.
desktop: photos, messages, location history, contacts, professional applications,
synchronized accounts. But it is also one of the most difficult supports to recover, for three
reasons:
• Default encryption enabled on all recent devices (iPhone since iPhone 3GS in 2010
; Android since Android 6 Marshmallow in 2015 in practice).
• eMMC or UFS type storage, monolithic (NAND and controller in the same chip), very
difficult to unsolder and read independently.
• Strong link between the device and a cloud account (Apple ID, Google account) which makes all
complex post-mortem handling.
13.2 iPhone and iOS
Key architecture: the Secure Enclave (present since the iPhone 5s, 2013), a coprocessor
separate cryptographic that stores keys and enforces a strict policy on decryption.
All user data on NAND storage is encrypted by a key linked to both the passcode
user and a hardware UID registered in the Secure Enclave.
Consequences:
• The chip-off of a modern iPhone gives uninterpretable encryption. The Secure Enclave does not give its
personal key without the passcode.
• Professional iPhone forensic tools (Cellebrite UFED, GrayKey from Grayshift, Magnet
GrayKey) exploit non-public vulnerabilities in certain versions of iOS to bypass the
Secure Enclave. They only work on vulnerable models and versions, and
windows close with each update.
• For individuals: the options are iTunes/Finder backup (on a trusted Mac) or
iCloud backup. No recovery from the iPhone itself without the passcode.
13.3 Android
More heterogeneous: Android runs on hundreds of models, with implementations
variable hardware and software. Overall:
• Default encryption since Android 6, based on the passcode and a hardware keystore (TEE,
Trusted Execution Environment).• Android 10+ uses file-based encryption which allows certain
functions (alarms, accessibility) to operate before unlocking, while encrypting the data
user.
Mobile Recovery Tools:
— 45 —
Data Recovery — Verified Manual May 2026 Edition
• Cellebrite UFED, MSAB XRY, Oxygen Forensic Detective, Magnet AXIOM: sequels
professional for law enforcement and businesses (high costs, controlled licenses).
• ADB (Android Debug Bridge): to recover from a live and unlocked phone, with the
USB debugging enabled. Allows you to copy accessible data on the user side.
• Download / EDL mode on certain Qualcomm chips: allows laboratories access
low-level, but the EDL is now signed by the manufacturer and therefore restricted.
For a locked Android that has been lost, the most feasible route is Google backup:
photos on Google Photos, contacts/calendar/Drive on the account. If synchronization was enabled,
a lot of data is recoverable without access to the phone.
13.4 The role of cloud backups
For mobile media, this is almost always the most productive route. Recover from:
• iCloud: Photos, contacts, email, iCloud Drive documents, full iOS backups (if
activated).
• Google: Photos, contacts, calendar, Drive, Android backups (Google One).
• Third-party accounts: WhatsApp (Google Drive / iCloud backups), Telegram (cloud native), Signal
(local export), etc.
Tell the user that these backups exist and how to access them. The majority of
Individuals experiencing mobile data loss ignore what they have backed up automatically.
— 46 —
Data Recovery — Verified Manual May 2026 Edition
PART IV — SPECIAL CASES
Chapter 14Forensic forensics
14.1 The fundamental difference
Classic data recovery has a simple goal: to recover what can be recovered. The
Judicial forensics adds a second: producing a result admissible in court. The
procedure becomes as important as the technical result.
Concretely, this implies:
• Continuous documentation of each manipulation (chain of custody).
• Integrity verification by hash at each step.
• Use of write blockers to ensure that the original media has not been modified.
• Reproducibility: another expert must be able to repeat the same analysis and obtain the same
results.
• Recognized and validated tools (scientifically validated, used by peers, documented).
14.2 ISO 27037: the reference standard
The ISO/IEC 27037:2012 standard (“Guidelines for the identification, collection, acquisition and
preservation of digital evidence) defines the international framework. It distinguishes four phases:
1. Identification: locate and recognize potentially evidence-bearing media.
2. Collection: take physical possession in a documented manner.
3. Acquisition: create a forensic copy with integrity verification.
4. Preservation: maintain integrity over time, with documented chain of custody.
In France, the judicial computer expert operates within the framework of the Code of Criminal Procedure
(articles 60, 156 et seq. for expert opinions) and must be registered on the list of experts after
court of appeal. In criminal matters, it is often the PJ (sub-directorate for the fight against cybercrime) which
carries out the seizures, with the support of experts.
14.3 Reference forensic tools
Professional forensic suites cover the entire acquisition + analysis + reporting chain.
International references in 2026:
• EnCase Forensic (OpenText): historical suite (since Guidance Software, 1997), widely used
by US law enforcement.
• FTK (AccessData / Exterro): direct competitor to EnCase, FTK Imager alone is free.• X-Ways Forensics (X-Ways Software, Germany): European reference, lighter and more
faster than EnCase/FTK.
• Magnet AXIOM: focus on cloud, mobile and browser artifacts.
• Belkasoft X: very good for mobile and messaging applications.
— 47 —
Data Recovery — Verified Manual May 2026 Edition
• The Sleuth Kit + Autopsy: the free, open source suite. More than enough for many
case studies, and used in academic forensic training.
14.4 Typical forensic workflow
1. Document the initial condition of the media (photos, serial numbers, physical condition). Manual scoring
or seal management software.
2. Connect the support to the analysis station via a hardware write blocker (Tableau, WiebeTech).
3. Create a forensic image (E01 or raw DD) with automatic hash calculation (MD5 + SHA-1
or SHA-256).
4. Check that the hash of the image corresponds to a hash calculated directly on the source. Seal it
source.
5. Work on the image. Any analysis, any export (recovered files, timeline, artifacts) is
recorded in the report.
6. The final report includes: description of the support, acquisition procedure, hashes, tools used with
versions, analysis methodology, conclusions, list of artifacts produced.
14.5 Artifacts to analyze on Windows
Beyond user files, a Windows system contains dozens of valuable artifacts for
reconstruct the activity:
• Registry (NTUSER.DAT, SOFTWARE, SYSTEM, SAM, SECURITY): configuration, accounts,
USB connected, programs executed (UserAssist, ShellBags, MUICache).
• Prefetch: trace of recently executed programs, with counter.
• ShellBags: folders viewed in Explorer.
• RecycleBin: files deleted via recycle bin (with original metadata).
• $LogFile and $UsnJrnl (chapter 7): NTFS modification log.
• Event Logs (.evtx): system events, security, applications.• Browsers: history, cookies, cache, downloads (Chrome in
%LocalAppData%\Google\Chrome\User Data\, Firefox in
%AppData%\Mozilla\Firefox\Profiles\).
14.6 Precautions and common errors
Caution — Never boot the target machine on its original OS. Any startup modifies
hundreds of files (timestamps, logs, register), which may be enough to invalidate the proof.
Always remove the disk or boot to a read-only live forensics.
Other common errors:
• Forgetting to calculate the hash before analysis — makes it impossible to prove that the image was not
modified.
• Work on the source media instead of the image — any non-read-only analysis modifies
potentially the proof.
— 48 —
Data Recovery — Verified Manual May 2026 Edition
• Use undocumented or homemade tools without validating their operation through tests
reproducible.
• Failing to trace a process step in the report — an incomplete trace may result in
taken by the defense to call into question the entire analysis.
— 49 —
Data Recovery — Verified Manual May 2026 Edition
Part V
Practical
Two chapters to move from theory to concrete choices: which tools to use in which
situation, and what mistakes to avoid, illustrated by real public incidents.
— 50 —
Data Recovery — Verified Manual May 2026 Edition
PART V — PRACTICE
Chapter 15
Tools 2026: realistic panorama
15.1 Method of presentation
This chapter lists the recovery tools without giving a “rating out of 5” or “recovery rate”.
recovery » encrypted. These rankings that we see on the internet are almost always:
• From affiliated sites of the publishers concerned.
• Based on tests that are not reproducible.
• Often obsolete or copied and pasted from year to year.The following is a functional description and honest positioning, at the expense of the reader
to try the free/demo version of the tools that seem suitable for your case.
15.2 Open source tools
ddrescue (GNU)
The essential tool for imaging. Cross-platform via WSL/Linux/Mac. See chapter 6 for
detailed workflow.
TestDisk (CGSecurity)
Partition table repair, deleted partition recovery. Works on Windows,
macOS and Linux. Austere but effective ncurses interface. For many common logical cases,
that's all we need.
PhotoRec (CGSecurity)
Signature-based carving. More than 480 recognized formats. Multiplatform. For carving without
semantic claim, it is the open source reference.
The Sleuth Kit + Autopsy
Complete forensic suite. TSK provides command line tools (fls, icat, blkls,
tsk_recover...), Autopsy a web interface for analysis. Widely used in training and in certain
police units.
extundelete, ext4magic, debugfs
The Linux triad for ext4. extundelete and ext4magic exploit the log; debugfs gives access
interactive at the FS.
Eric Zimmerman's tools
Suite of free forensic utilities for Windows: MFTECmd (parse $MFT), RECmd (registry),
LECmd (LNK), JLECmd (Jump Lists), PECmd (Prefetch), Timeline Explorer... Become references
of the Windows DFIR. Downloadable from ericzimmerman.github.io.
— 51 —
Data Recovery — Verified Manual May 2026 Edition
15.3 Commercial tools for individuals and SMEs
Disk Drill (CleverFiles)
Windows and macOS. Very accessible interface for non-technical people. Several algorithms
scan, support for many formats. Free version limited to 500 MB recovery (Windows).
EaseUS Data Recovery Wizard
Very clean interface, multi-FS support, free version up to 2 GB. Widely used in large
public.
Recuva (CCleaner)
Free, simple. Suitable for recent accidental deletions on Windows. Limited in the face of cases
complex.Stellar Data Recovery
Complete range, from the general public to the laboratory. Good reputation on file recovery
Office and multimedia. Expensive pro version.
15.4 Professional tools
R-Studio (R-Tools Technology)
Reference for IT technicians and small laboratories. Very good on NTFS, ext4, APFS, RAID. Includes
a hex editor and a complete RAID module. Available in several editions (consumer, technician,
network).
UFS Explorer (SysDev Laboratories)
Excellent on advanced formats (APFS, ZFS, Btrfs, Synology/QNAP NAS, complex RAID).
The Professional edition is one of the most complete on the market. Widely used in laboratories
Europeans.
ReclaiMe and ReclaiMe Pro
Specialized in RAID reconstruction and analysis of proprietary configurations (Synology Hybrid
RAID, ZFS, Microsoft Storage Spaces). Pro edition very lab oriented.
15.5 Forensic forensic tools
Professional suites presented in chapter 14: EnCase, FTK, X-Ways, Magnet AXIOM,
Belkasoft X, Cellebrite UFED, Oxygen Forensic. Reserved for institutions and businesses
specialized (5-figure annual licensing costs for complete units).
15.6 Laboratory hardware platforms
For professional physical recovery, two platforms dominate:
• PC-3000 (ACE Lab): de facto standard, modules for HDD, SSD, Flash, RAID, mobile. Basis
of knowledge per controller and firmware kept up to date. Under contract with annual commitment.
• DeepSpar / Atola: more targeted alternatives (imager hardware, head bypass). coexist with
PC-3000 in many laboratories.
— 52 —
Data Recovery — Verified Manual May 2026 Edition
The cost of complete equipment of a laboratory (PC-3000 HDD + Flash + Express + adapters +
micro-welding tools + clean room) amounts to tens of thousands of euros. This is the reason
main for which physical recovery is billed at a minimum of several hundred euros.15.7 Decision matrix
Situation Tools to try first
Recent accidental deletion on HDD TestDisk + PhotoRec (free) or Disk Drill / EaseUS
Deletion on SSD (but TRIM-mable) Try Recuva / EaseUS without much hope; SSD unplugged → lab
Volume become RAW (corrupted NTFS/exFAT) TestDisk for the partition, R-Studio or UFS Explorer for the FS
NAS Synology/QNAP HS Take out disks, UFS Explorer Professional or ReclaiMe Pro
RAID 5 Degraded Image first, then R-Studio Network or UFS Explorer RAID
Mac under FileVault, known key Start in target disk mode, copy; or R-Studio for Mac
Mac running FileVault, unknown key Check iCloud (recovery key); otherwise give up
HDD clicking Turn off immediately → lab (never yourself)
SSD not detected Lab (JTAG / chip-off)
Legal case (evidence to be produced) FTK Imager (free) + Autopsy, or pro suite (X-Ways, EnCase, AXIOM)
Locked Android Phone Google Backup; for forensics: Cellebrite, MSAB
Locked iPhone iCloud Backup; for forensics: GrayKey (vulnerable models)
— 53 —
Data Recovery — Verified Manual May 2026 Edition
PART V — PRACTICE
Chapter 16
Deadly traps and case studies
16.1 The seven mistakes that kill data
1. Install recovery software on the source media. The installation physically writes
on the support, often in strategic locations (recently deallocated free zone —
i.e. exactly where your deleted files are).
2. Recover files from source media. Variant of the previous one, and just as
catastrophic.3. Leave an SSD powered on after the incident. TRIM and garbage collection continue
work. On modern SSD, every minute counts.
4. Accept Windows Automatic Repair. chkdsk /f, autorepair, repeated boot on
a corrupt FS: Windows actively writes, moves, deletes structures to “repair”.
On an FS that we want to recover, it's the opposite of what we want.
5. Open an HDD outside the clean room. See chapter 9.
6. Attempt to desolder a NAND chip with a soldering iron. Without rework station and profile
calibrated thermal, the chip is destroyed before being read.
7. Keep backups in the same environment as production. Case Code
Spaces (below). Modern ransomware explicitly targets accessible backups.
— 54 —
Data Recovery — Verified Manual May 2026 Edition
16.2 Case study — Code Spaces (June 2014)
■ Code Spaces: 12 hours from company to disappearance
Code Spaces was a code hosting platform (Subversion and Git) with around 7 years
of history, based in Coventry in the United Kingdom, entirely hosted on AWS.
On June 17, 2014, the company first suffered a DDoS attack, which it said was “common” and
usually resolved easily. This time, the attack is accompanied by a message extorting a
payment, left directly in the AWS EC2 console. The attacker gained access to the panel
of Amazon control — by a means never publicly identified (probably compromise
credentials, without MFA activated).
Code Spaces refuses to pay and tries to regain control by changing passwords
EC2. But the attacker had already created several login accounts in the background. Realizing
that Code Spaces was trying to regain control, it launched a methodical deletion: EBS
snapshots, S3 buckets, AMIs, EC2 instances, storage instances.The critical point: the Code Spaces backups were in the same AWS account as the
production. Once access to the panel was obtained, the attacker was able to simultaneously delete the
production and all backup copies.
June 18, 2014 — 12 hours after the attack began — Code Spaces issues a statement
announcing the definitive cessation of activity: “Code Spaces will not be able to operate beyond this
point. » Customers are invited to export what they have left before the final closure.
Sources: Threatpost (June 2014); eSecurity Planet (2014); InfoWorld Murder in the Amazon cloud
(2014); Wiz breaches.cloud analysis (2023).
Lessons: (1) never store backups in the same account/domain as production;
(2) MFA required on any cloud management account; (3) principle of least privilege — only one
account should never be able to erase everything; (4) have a tested incident response plan, not just
written.
16.3 When to know when to stop
For individuals and IT technicians, knowing when not to push is essential. Four signs:
• The support is physically damaged (noise, non-detection, overheating). No intervention
domestic.
• You have already tried several tools without success — each additional attempt risks
to worsen.
• Data has a value greater than the cost of professional intervention. For a few
hundreds of euros, we sometimes avoid permanent loss.
• There is a legal issue — any amateur manipulation risks invalidating the evidence.
16.4 How to choose a laboratory
Beyond the criteria of chapter 5 (ISO 5 clean room, free diagnosis, payment by result),
some additional checks:
— 55 —
Data Recovery — Verified Manual May 2026 Edition
• Request a tour or verifiable photos of the clean room.
• Ask for the list of technicians and their experience (these are not trainees who must
touching a disk with 10,000 euros worth of data).• Check public notices — but with caution: many are false in both directions.
Prefer detailed and old reviews.
• Ask to see a standard report to assess the seriousness of the deliverable.
• Written contractual confidentiality (NDA) before any delivery of the support.
• Policy for destruction of intermediate copies after submission of data and acceptance of the
customer.
— 56 —
Data Recovery — Verified Manual May 2026 Edition
Part VI
Prevention
The best recovery is the one you never have to do. Two chapters to close the circle: the
modern backup strategies, and an honest take on what's definitely left out
to achieve recovery in 2026.
— 57 —
Data Recovery — Verified Manual May 2026 Edition
PART VI — PREVENTION
Chapter 17
Modern backup strategies
17.1 The 3-2-1 rule and its extension
The 3-2-1 rule was formulated in 2005 by photographer Peter Krogh in The DAM Book: Digital
Asset Management for Photographers. It boils down to:
• 3 copies of each data (original + two backups).
• 2 different media (for example: internal disk + external disk; or disk + cloud).
• 1 off-site copy (proof against fire, theft, local flooding).
Twenty years later, the omnipresence of ransomware pushed Veeam to offer an extension
3-2-1-1-0:
• +1: an additional copy that is immutable or air-gapped — that an attacker having
Compromised accounts cannot delete.
• +0: zero errors during restoration, verified by regular tests.
On the origin — The 3-2-1-1-0 rule is Veeam marketing, not an ANSSI or NIST standard. This does not
takes nothing away from it in substance: immutability and air-gap have become essential in the face of
modern ransomware. The principles are widely adopted by other actors (Object First,
Wasabi, Backblaze B2 with Object Lock, Azure Blob immutability, Synology SnapLock).17.2 Implement immutability
Several ways, from the simplest to the most sophisticated:
• Object Lock S3 (AWS, Backblaze B2, Wasabi, MinIO). Compliance or governance mode. A
Once the data is written, it cannot be modified or deleted before the retention expires —
even by the bucket owner.
• Azure Blob immutability and Google Cloud Storage retention policies. Same principles as S3
Object Lock.
• Hardened Linux Repository (Veeam, but generalizable principle): a Linux server with
chattr +i attribute on backup files, and disabled SSH for root. Doable at home with
rsync and a cron.
• WORM (Write Once Read Many) on optical tapes or disks. Historic solution, again
relevant for long-term archives.
• Immutable NAS snapshots: Synology SnapLock, QNAP WORM. On condition of protecting the
NAS itself (strong administrator password, MFA, no joined domain access).
17.3 The air gap
An air-gapped medium is physically disconnected from the network the majority of the time.
Variants:
— 58 —
Data Recovery — Verified Manual May 2026 Edition
• LTO tape taken out of the robot and stored in a box. The historic solution, still relevant
for large volumes in the long term.
• USB disk that is connected only for backup, then stored in a drawer
locked.
• Rotation of several external disks (for example 4 disks, one per week of the month) with
rotating off-site storage.
Air-gap guarantees one simple thing: if the attacker takes control of the system on Tuesday at 2 p.m., he will not
cannot delete the previous Tuesday's backup which is sleeping in a turned off drawer.
17.4 Restoration verification
The 0 of 3-2-1-1-0 is undoubtedly the most neglected. Many organizations have backups that
have never been tested. The typical result: At the time of the crash, the restore fails.
Common causes:• Silent corruption of backup files (rot bit not detected).
• Incremental backups with a broken chain at any point (a single file
missing invalidates everything that follows).
• Backups that silently stopped months ago — agent crashed, no one
didn't see.
• Application that cannot start correctly from backup (dependency not
saved, bad version, database in inconsistent state).
Best practice: minimum quarterly restoration test, on an isolated system. For systems
reviews, monthly. Document each test (date, pass/fail, measured recovery time).
This is the only way to know that your saves are worth anything.
17.5 For the individual
A pragmatic and affordable strategy:
1. External drive for 50-100 euros, connected once a week for Time Machine (macOS),
File History (Windows) or rsync (Linux).
2. Personal Cloud: iCloud, Google One, Dropbox, OneDrive, or Backblaze Personal Backup
(~80 euros/year, backup any external drive included).
3. For truly irreplaceable files (photos, scanned administrative documents,
manuscripts): a third copy on a USB key stored with a loved one.
4. Annual test: try to restore a random file from each of three copies. If
one fails, it must be replaced or reconfigured.
17.6 For SMEs
Minimum recommended level of protection in 2026:
• Automatic daily backup of servers and critical workstations (Veeam, Acronis, Datto,
Synology Active Backup, Rubrik...).
• At least one immutable cloud copy (S3 Object Lock or equivalent).
• At least one air-gapped copy weekly (tape or disk rotation).
— 59 —
Data Recovery — Verified Manual May 2026 Edition
• Mandatory MFA on all cloud and backup admin accounts.
• Formally documented monthly restoration testing.• Written recovery plan: who does what in the event of an incident, in what order, with what contacts.
• Annual exercise: trigger a fictitious incident, see if the plan sticks.
— 60 —
Data Recovery — Verified Manual May 2026 Edition
PART VI — PREVENTION
Chapter 18
Current limits in 2026
18.1 What is definitely lost
To avoid any illusions, here is what no laboratory in the world will recover in 2026:
1. SSD with TRIM passed and garbage collection performed. NAND cells received voltage
erasure and returned to their neutral state. Reading the NAND gives zeros. None
known technique does not recover.
2. Data encrypted by AES-256 without the key. Brute force decryption is
mathematically infeasible with current classical computers. The quantum computer of
tomorrow could theoretically break AES-128 by Grover, but not AES-256; and these
computers do not exist on a useful scale in 2026.
3. HDD trays with the magnetic layer torn off. The information was in the metal. A
Once removed, there is nothing left to read.
4. Files encrypted by modern ransomware without the key and without implementation errors.
Same reasons as (2).
5. RAID 5 with more than one failed disk, RAID 6 with more than two. Parity is no longer enough to
rebuild. Except individual recovery disk by disk (each of these disks can
contain usable stripes if we image them, but we will never have the complete content).
6. Data overwritten by complete rewrite. The myth of “magnetic remanence”
(idea that crushed bits would leave a trace readable by an atomic force microscope) is
technically denied for modern discs. A single zero pass on an HDD
modern makes the original data irrecoverable.18.2 What is becoming difficult
• Mobile recovery: iPhone Secure Enclave, Android TEE, default encryption
activated everywhere, gradually close the doors. Forensic tools (Cellebrite, GrayKey)
exploit vulnerabilities that close with each update.
• Classic SSD recovery: TRIM implementations have become reliable, encryption
default hardware becomes widespread. Favorable cases (broken TRIM, old firmware, USB bridges
non-UASP) are becoming rarer.
• Cloud recovery: retention and deletion policies on the provider side are increasingly
more rigid. A permanent deletion on a cloud service remains final.
18.3 Trends 2026-2030
Some probable developments:
• Diffusion of QLC and PLC on consumer SSD: higher density, lower endurance,
narrower margin between voltage levels. Chip-off reading even more difficult.
• Generalization of HAMR on high capacity HDDs beyond 30 TB. More storage density
high, but no fundamental change for recovery.
— 61 —
Data Recovery — Verified Manual May 2026 Edition
• AI in carving and classification of forensic artifacts. Probably useful on cases
specific (reassembly of image fragments, identification of artifacts in logs
massive), not a global miracle.
• Cryptographic tensions: if the post-quantum era requires the replacement of AES by
younger algorithms, implementation errors can temporarily reopen
recovery windows.
• Regulation: GDPR/NIS2 requirements require media to be better protected and traced. This
helps prevention more than recovery, but helps avoid many cases.18.4 The final message
If you have arrived here, you have understood the main thing: data recovery is a discipline
real, technically complex, which has made enormous progress but faces physical limits
and increasingly tight mathematics. The methods in Chapters 6 through 11 work in a
majority of cases, but almost always depend on the time that elapses between the incident and the
first good decision.
The best strategy remains, unsurprisingly, not having to recover: prevention, backup
real (tested), operational discipline when something goes wrong. Chapter 17 is, in
practical, the most useful in the book.
Happy reading, and good backups.
— 62 —
Data Recovery — Verified Manual May 2026 Edition
Appendices
Quick reference
Three appendices: reference commands for the most useful command line tools,
glossary of technical terms, and complete bibliography of public sources consulted for the
writing this manual.
— 63 —
Data Recovery — Verified Manual May 2026 Edition
APPENDICES
Chapter A
Reference commands
A.1 Support identification
# Linux: list disks with model and serial number
$ lsblk -o NAME,SIZE,MODEL,SERIAL,TRAN
$ sudo hdparm -I /dev/sdX
$ sudo smartctl -a /dev/sdX
# macOS: detailed information
$ diskutil list
$ diskutil info /dev/diskN
$system_profiler SPSerialATADataType
# Windows (PowerShell)
PS>Get-PhysicalDisk
PS> Get-Disk | Format-List
A.2 Imaging with ddrescue
# First pass: copy what is easy to read (without retry)
$ sudo ddrescue -f -n -d /dev/sdX image.img image.map
# Second pass: retry on difficult areas
$ sudo ddrescue -f -d -r3 /dev/sdX image.img image.map
# Third pass: reverse reading for severe cases
$ sudo ddrescue -f -d -R -r3 /dev/sdX image.img image.map # Voir l'avancement (depuis un autre terminal)
$ cat image.map | head
$ ddrescuelog -t image.map # statistiques
A.3 Monter une image en lecture seule
# Linux : créer un loop device et monter
$ sudo losetup --read-only --find --show image.img
/dev/loop0
$ sudo blkid /dev/loop0 # voir le type de FS
# Si l'image contient une table de partition :
$ sudo partx --show /dev/loop0 # voir les partitions
$ sudo partx --add /dev/loop0 # créer /dev/loop0p1, p2...
# Monter en lecture seule selon le FS
$ sudo mount -o ro,noload /dev/loop0p1 /mnt/recup # ext4
$ sudo mount -t ntfs-3g -o ro,norecover /dev/loop0p1 /mnt/recup # NTFS
$ sudo mount -o ro /dev/loop0p1 /mnt/recup # FAT/exFAT
# Démontage et libération
$ sudo umount /mnt/recup
$ sudo partx --delete /dev/loop0
$ sudo losetup -d /dev/loop0
— 64 —
Récupération de données — Manuel vérifié Édition mai 2026
A.4 Hash d'intégrité
# Calcul
$ sha256sum image.img > image.img.sha256
$ md5sum image.img > image.img.md5
# Vérification ultérieure
$ sha256sum -c image.img.sha256
# Sur de très gros fichiers, calcul parallèle avec b3sum (BLAKE3)
$ b3sum image.img
A.5 Analyse NTFS
# Avec The Sleuth Kit
$ fls -r -p image.img # arborescence complète (deleted = *)
$ fls -r -p -d image.img # uniquement les fichiers supprimés
$ icat image.img 12345 > out.bin # récupérer par numéro d'inode/MFT
$ istat image.img 12345 # détails d'une entrée MFT
# Avec les outils Zimmerman (Windows)
PS> MFTECmd.exe -f C:\Image\$MFT --csv.\out --csvf mft.csv
PS> LogFileParser.exe -f C:\Image\$LogFile -o logfile.csv
PS> UsnJrnl2Csv.exe -f C:\Image\$J -o usnjrnl.csv
A.6 Analyse ext4
# extundelete
$ sudo extundelete --restore-file 'chemin/relatif' /dev/sdb1
$ sudo extundelete --restore-all /dev/sdb1
$ sudo extundelete --restore-inode 12345 /dev/sdb1
# debugfs (e2fsprogs)
$ sudo debugfs /dev/sdb1
debugfs: lsdel # inodes récemment supprimés
debugfs: stat <12345> # détails d'un inode
debugfs: dump <12345> /tmp/out # extraire ses blocs
debugfs: cat <12345> # afficher (text)
# ext4magic
$ ext4magic /dev/sdb1 -M -d /recovery
A.7 TestDisk et PhotoRec
# Lancer TestDisk en mode interactif sur une image
$ sudo testdisk image.img
# Lancer PhotoRec (carving) sur une image
$ sudo photorec image.img
# PhotoRec en mode non-interactif (avancé)
$ sudo photorec /d /recovery/output /cmd image.img \
partition_none,fileopt,everything,enable,search
— 65 —
Récupération de données — Manuel vérifié Édition mai 2026
A.8 Vérification TRIM
# Windows
C:\> fsutil behavior query DisableDeleteNotify
DisableDeleteNotify (NTFS) = 0 <-- TRIM activé
# Linux
$ cat /sys/block/sdX/queue/discard_max_bytes
$ sudo fstrim -av # déclencher trim manuel
$ systemctl status fstrim.timer # voir si l'auto-trim tourne
# macOS
$ system_profiler SPSerialATADataType | grep -i 'TRIM Support'
A.9 RAID Linux (mdadm)
# Inspecter les disques
$ sudo mdadm --examine /dev/sd[a-d]1
# Assembler manuellement
$ sudo mdadm --assemble /dev/md0 /dev/sd[a-d]1
# Assembler en mode dégradé (utile en récupération)
$ sudo mdadm --assemble --force --run /dev/md0 /dev/sd[a-d]1
# Voir les détails
$ sudo mdadm --detail /dev/md0
$ cat /proc/mdstat
A.10 Memory et processus (forensique live)
# Capture de RAM Windows (DumpIt par MoonSols)
C:\> DumpIt.exe
# Capture RAM Linux
$ sudo dd if=/dev/mem of=memory.dump bs=1M
# (kernel récent : utiliser LiME ou AVML)
# Analyse avec Volatility 3
$ vol -f memory.dump windows.info
$ vol -f memory.dump windows.pslist
$ vol -f memory.dump windows.netscan
$ vol -f memory.dump windows.cmdline
— 66 —
Récupération de données — Manuel vérifié Édition mai 2026
ANNEXES
Chapitre B
Glossary
AES—Advanced Encryption Standard. NIST standardized symmetric encryption algorithm
2001. AES-128, AES-192 and AES-256 are considered resistant to all attacks
known with current conventional means.
AFR — Annualized Failure Rate. Annualized failure rate of a disk fleet. Calculated in
projecting the number of failures observed over a short window to a full year.
APFS—Apple File System. Apple's file system introduced in 2017, copy-on-write, with
snapshots and native encryption support (FileVault).
Air-gap — Physical isolation of a system or network support. A stored backup tape
in a trunk is air-gapped; a server connected via VPN is not.
BGA—Ball Grid Array. Integrated circuit package with an array of solder balls under the
component, common for NAND chips and SSD controllers.
Btrfs — B-tree file system. Linux copy-on-write file system with snapshots and checksums,
integrated into the kernel since 2009.
Carving (data carving) — Reconstruction of files from binary signatures in
raw data, without using file system structures. See chapter 8.
Chain of custody — Chain of custody. Ongoing documentation of care and
each manipulation of digital evidence, essential in forensic forensics.
Chip-off — Physically unsoldering a NAND chip to read it on a dedicated programmer,
regardless of its original controller.
CMR — Conventional Magnetic Recording. HDD writing mode with non-overlapping tracks.
Allows you to rewrite any track without affecting neighboring ones.
Copy-on-write — Write strategy where any modification writes elsewhere and updates pointers,
without crushing in place. Allows snapshots at zero marginal cost. Used by APFS, Btrfs, ZFS.
DBIR—Data Breach Investigations Report. Annual report published by Verizon since 2008,
statistical reference on data compromises.
ddrescue — GNU ddrescue. Error-tolerant bitwise imaging tool with mapfile handling
for rebounds and targeted passes.DRAT / DZAT — Deterministic Read After Trim / Deterministic Zero After Trim. SSD guarantees that
Reading a trimmed LBA returns a deterministic value or zeros respectively.
eMMC — embedded MultiMediaCard. Flash memory with integrated controller, common compact format
in low/mid-range smartphones and tablets.
ECC — Error-Correcting Code. Error correcting codes applied by SSD controllers to
each NAND page to correct residual bit-flips.
ext4 — Fourth extended file system. Default Linux file system since 2008,
journaled, with support for extents for efficient management of large files.
— 67 —
Data Recovery — Verified Manual May 2026 Edition
FileVault — macOS volume encryption since Mac OS X 10.3 (FileVault 1) then FileVault 2
since 10.7. Managed by the Secure Enclave on Apple Silicon Macs.
FTL—Flash Translation Layer. Software layer in the SSD controller that maps LBAs
logic to physical NAND pages, manages wear leveling and garbage collection.
Garbage collection (GC) — Background process of the SSD controller that consolidates pages
valid and applies the physical erase voltage to the blocks marked free.
HAMR—Heat-Assisted Magnetic Recording. HDD technology which occasionally heats the
magnetic layer by laser during writing to reduce the size of stable domains.
Marketed since 2024 on very large discs.
Head swap — Transplantation of the head/arm assembly of a faulty HDD to an identical case
in a clean room. Most common intervention in physical HDD recovery.
HDD—Hard Disk Drive. Mechanical magnetic hard drive.
Imaging — Creating a bit-by-bit copy of media to an image file. Step prior to any
serious analysis or recovery.
ISO 14644-1 — International standard which defines clean room classes by concentration of
particles per m3 of air.ISO 27037 — International reference standard for the identification, collection, acquisition and
preservation of digital evidence.
JTAG—Joint Test Action Group. Debug protocol built into most circuits
modern, used in SSD recovery to access the controller without unsoldering it.
LBA—Logical Block Address. Logical address of a sector on a medium, exposed by the interface
SATA/NVMe. The SSD controller translates LBAs to physical locations via FTL.
LUKS — Linux Unified Key Setup. Linux volume encryption standard, implemented by
cryptsetup.
Mapfile — Map file used by ddrescue to record the exact state of each area
(copied, to be copied, slow, failed). Allows recovery and targeted passes.
MFT—Master File Table. Core structure of NTFS, a file that contains an entry of 1024
bytes per volume file and folder.
NAND flash — Floating gate memory, technology under all SSDs, eMMC, UFS, microSD, sticks
USB.
NTFS—New Technology File System. Windows file system from NT, journaled, with
ACL attributes, compression, built-in encryption and $LogFile / $UsnJrnl logs.
Over-provisioning (OP) — NAND space reserved by the SSD controller, invisible to the user,
used for wear leveling and garbage collection. Typically 7% consumer, 14-28% business.
PCB—Printed Circuit Board. External printed circuit of an HDD or SSD, contains the controller and
interface components.
PC-3000 — Hardware and software platform from ACE Lab (Russia), de facto standard for
professional HDD and SSD recovery.
PMR — Perpendicular Magnetic Recording. HDD writing mode generalized since 2005, domains
magnetic oriented perpendicular to the surface.
— 68 —
Data Recovery — Verified Manual May 2026 Edition
RAID — Redundant Array of Independent Disks. Combining multiple discs for
performance, resilience or both. Common levels: 0, 1, 5, 6, 10.Ransomware — Malware that encrypts the victim's files and demands a ransom for
decryption key.
Clean room / Cleanroom — Controlled atmosphere room defined by ISO 14644-1. For the
HDD recovery: ISO Class 5 (3,520 particles ≥0.5 micron/m3).
SED—Self-Encrypting Drive. SSD which automatically encrypts all data via its
controller, generally according to the TCG Opal standard.
SMR—Shingled Magnetic Recording. HDD write mode with partially overlapping tracks,
gains ~25% density at the cost of increased firmware complexity.
Snapshot — Snapshot image of a volume at a given time, at zero marginal cost on FS
copy-on-write (APFS, Btrfs, ZFS).
TCG Opal — Trusted Computing Group standard for SSD hardware encryption (Opal 1.0,
Opal 2.0, Opalite, Pyrite).
TestDisk — Reference open source tool for partition table repair and
recovery of deleted partitions.
TPM—Trusted Platform Module. Security coprocessor soldered on motherboard, stores keys
cryptographic (BitLocker, integrity measurement).
TRIM — ATA (DATA SET MANAGEMENT) or NVMe (DEALLOCATE) command that informs the
SSD controller of the LBAs released on the OS side, allowing their physical erasure.
UFS—Universal Flash Storage. Successor to eMMC for smartphones, faster and with
full-duplex architecture.
Wear leveling — SSD controller strategy that distributes writes across all NAND cells
so that none wear out prematurely.
WORM — Write Once Read Many. Immutable storage used for protected backups
against deletion and modification.
Write blocker — A hardware or software device that blocks all writing to media, ensuring
forensic integrity.
ZFS — Sun Microsystems File System (2006), now OpenZFS. Copy-on-write,
snapshots, checksums, self-healing on redundant volumes.
— 69 —
Data Recovery — Verified Manual May 2026 Edition
APPENDICES
Chapter CBibliography
Public sources actually consulted for the writing of this manual, May 2026. URLs
simplified (https:// prefix and www. prefix omitted).
Industry Reports
Verizon Business 2025 Data Breach Investigations Report. Published on verizon.com/about/news/2025-data-breac
April 23, 2025. h-investigations-report
Verizon Business 2025 DBIR Executive Summary (PDF). verizon.com/business/resources/reports
/2025-dbir-executive-summary.pdf
Backblaze Drive Stats for 2025 (annual report, February 12 backblaze.com/blog/backblaze-drive-sta
2026). ts-for-2025/
Backblaze Drive Stats Q1, Q2, Q3, Q4 2025. backblaze.com/cloud-storage/resources/
hard-drive-test-data
IBM Security Cost of a Data Breach Report 2024. ibm.com/reports/data-breach
ANOZR WAY Data leaks 2025: +2.6 billion from anozrway.com/fr/blog/fuites-de-donnees
data compromised. January 2026. -en-2025/
Norms and standards
ISO ISO 14644-1:2015 — Cleanrooms and associated iso.org/standard/53394.html
controlled environments — Part 1: Classification of
air cleanliness by particle concentration.
ISO ISO/IEC 27037:2012 — Guidelines for iso.org/standard/44381.html
identification, collection, acquisition and
preservation of digital evidence.
Trusted TCG Storage Architecture Core Specification, Opal trustedcomputinggroup.org/resource/sto
Computing Group 2.0. rage-work-group-storage-security-subsy
stem-class-opal/Cleanroom and HDD recovery
DriveSavers Certified ISO Class 5 Cleanroom. drivesaversdatarecovery.com/why-us/cer
tified-iso-class-5-cleanroom/
SalvageData ISO 5 Cleanroom — Certified Data Recovery. salvagedata.com/about/certified-data-r
overcover/cleanroom
Gillware Clean Room Data Recovery. gillware.com/hard-drive-data-recovery/
data-recovery-clean-room/
Secure Data Class 10 ISO 4 Cleanroom. securedatarecovery.com/certifications/
Recovery cleanroom
Rossmann Group CMR vs SMR: How Recording Technology Affects rossmanngroup.com/technical-reference/
Recovery. 2026. cmr-vs-smr-hard-drives
HackMag Unmasking Shingled Magnetic Recording in hackmag.com/security/hdd-smr
Western Digital and Seagate HDDs. 2025.
— 70 —
Data Recovery — Verified Manual May 2026 Edition
Wikipedia Shingled magnetic recording. en.wikipedia.org/wiki/Shingled_magneti
c_recording
SSD, NAND, TRIM
Rossmann Group What TRIM Does and Why It Destroys Data. rossmanngroup.com/technical-reference/
what-trim-does-and-why-it-destroys-dat
has
Rossmann Group TRIM & Garbage Collection: When SSD Data Is rossmanngroup.com/services/ssd-data-reGone. covery/trim-garbage-collection
DataCare Labs SSD TRIM, Garbage Collection, and Write datacarelabs.com/blog/ssd-trim-garbage
Amplification. 2025. -collection-deleted-files/
Seagate What Are SSD TRIM and Garbage Collection? seagate.com/blog/what-are-ssd-trim-and
-garbage-collection/
Kingston The Importance of Garbage Collection and TRIM. kingston.com/en/blog/pc-performance/ss
d-garbage-collection-trim-explained
Lexar Enterprise Comparing NAND Flash Technology: SLC, MLC, lexarenterprise.com/comparing-nand-fla
TLC, and QLC. 2026. sh-slc-mlc-tlc-qlc-industrial-applicat
ion/
TechTarget Explore benefits, tradeoffs with SLC vs MLC vs techtarget.com/searchstorage/tip/The-t
TLC. ruth-about-SLC-vs-MLC
Belkasoft / Recovering Evidence from SSD Drives: forensicfocus.com/articles/recovering-
Forensic Focus Understanding TRIM, Garbage Collection and evidence-from-ssd-drives-in-2014/
Exclusions.
DiskGenius SSD Data Recovery Explained. 2025. diskgenius.com/resource/ssd-data-recov
ery-explained.html
File systems
Sygnia The Forensic Value of MFT Slack Space in Modern sygnia.co/blog/the-forensic-value-of-m
Windows Systems. 2025. ft-slack-space/
Mahmoud Shaker Master File Table (MFT), NTFS, $LogFile, and mahmoud-shaker.gitbook.io/dfir-notes// DFIR-Notes $UsnJrnl: Forensics. 2025.
ScienceDirect Master File Table - an overview (chapter from File sciencedirect.com/topics/computer-scie
System Forensic Analysis, Brian Carrier). nce/master-file-table
Number Analytics Unlocking Ext4: A Forensic Guide. 2025. numberanalytics.com/blog/ultimate-guid
e-ext4-digital-forensics
Botmonster Tech Linux File Recovery: extundelete, PhotoRec, Btrfs botmonster.com/posts/linux-file-recove
snapshots. 2026. ry-undelete-ext4-btrfs/
extundelete extundelete: An ext3 and ext4 file undeletion utility. extundelete.sourceforge.net/
project
Tools
GNU project GNU ddrescue manual and source code. gnu.org/software/ddrescue/
CGSecurity TestDisk & PhotoRec. cgsecurity.org/wiki/TestDisk
Sleuth Kit The Sleuth Kit and Autopsy. sleuthkit.org/
Eric Zimmerman Tools (MFTEC®, REC®, etc.). ericzimmerman.github.io/
— 71 —
Data Recovery — Verified Manual May 2026 Edition
Maxim Suhanov dfir_ntfs. github.com/msuhanov/dfir_ntfs
Safeguarding and prevention
Veeam 3-2-1 Backup Rule Explained. 2025. veeam.com/blog/321-backup-rule.html
Veeam The 3-2-1-1-0 Rule in Practice. 2026. community.veeam.com/blogs-and-podcasts
Community -57/the-3-2-1-1-0-rule-in-practice
Object First 3-2-1-1-0 Backup Rule: How Object First and objectfirst.com/blog/how-object-first-
Veeam Implement It. 2025. and-veeam-bring-3-2-1-1-0-to-life/Opti9 Tech The 3-2-1-1-0 Backup Strategy Explained. 2025. opti9tech.com/blog/the-3-2-1-1-0-backu
p-strategy-explained/
Case studies
Control Throwback Attack: How NotPetya Ransomware controleng.com/throwback-attack-how-no
Engineering Take Down Maersk. Updated August 2025. tpetya-accidentally-took-down-global-s
hipping-giant-maersk/
CSO Online Rebuilding after NotPetya: How Maersk moved csoonline.com/article/567845/rebuildin
forward. 2019. g-after-notpetya-how-maersk-moved-forw
ard.html
Redmondmag Inside a Domain Controller Nightmare (Maersk). redmondmag.com/blogs/scott-bekker/2018
/08/domain-controller-nightmare.aspx
Red Goat Cyber Maersk incident response. red-goat.com/why-you-should-test-your-
Security incident-response-a-review-of-the-maer
sk-incident/
Threatpost Hacker Puts Hosting Service Code Spaces Out of threatpost.com/hacker-puts-hosting-ser
Business. June 2014. vice-code-spaces-out-of-business/10676
1/
eSecurity Planet Code Spaces Destroyed by Cyber Attack. 2014. esecurityplanet.com/networks/code-spac
es-destroyed-by-cyber-attack/InfoWorld Murder in the Amazon cloud (Code Spaces). 2014. infoworld.com/article/2179073/murder-i
n-the-amazon-cloud.html
breaches.cloud / Codespaces (2014) - Public Cloud Security breaches.cloud/incidents/codespaces/
Wiz Breaches.
The Hacker News Cyber Attack On Code Spaces Puts Hosting thehackernews.com/2014/06/cyber-attack
Service Out of Business. 2014. -on-code-spaces-puts.html
Additional DBIR sources
Halcyon Verizon DBIR Shows Ransomware Involved in halcyon.ai/blog/verizon-dbir-shows-ran
44% of Data Breaches. 2025. somware-involved-in-44-of-data-breache
s
SpyCloud Breaking Down the 2025 Verizon Data Breach spycloud.com/blog/verizon-2025-data-br
Investigations Report. each-report-insights/
Keepnet Labs 2025 Verizon DBIR: Key Facts, Trends & Statistics. keepnetlabs.com/blog/2025-verizon-data
Updated March 2026. -breach-investigations-report
Rhymetec The Verizon Data Breach Report 2025: Key rhymetec.com/the-verizon-data-breach-r
Takeaways & Statistics. eport-2025-key-takeaways-statistics/
— 72 —
Data Recovery — Verified Manual May 2026 Edition
Sources that previous corpora have cited without being
verifiable
For transparency, the following references are regularly cited in mainstream literature
about data recovery, but I have not been able to verify them independently and they do not have
served as the source for this manual:• Quantified comparative studies of recovery software published on the publishers' sites or
of their affiliates.
• “Internal laboratory reports” with rates of
digital successes by technique.
• Precise PC-3000 version numbers (versions exist, but ACE Lab does not publish
public roadmap detailed by version).
• Academic studies mentioned without DOI or verifiable bibliographic reference.
End of the manual. May 2026.
— 73 —