Manual appendix · open access
Data recovery glossary
45 technical terms, simply defined. From the head stack to the 3-2-1-1-0 backup: each definition is short and self-contained, to grasp at a glance the vocabulary used in the Guide and the Manual.
Terms45
Categories6
Levelreference
Accessopen
01 — Hard drive
Mechanics & firmware
- Platter
- A rigid disk (glass or aluminum) coated with a magnetic layer where data is written. A hard drive often stacks several, read on both faces.
- Head Stack Assembly HSA
- The arms, read/write heads and voice coil. In operation, the heads fly 3-5 nm above the platters without touching them.
- Head transplant
- Replacing the failed head stack with one from a strictly compatible donor drive (same model, same firmware revision), in a cleanroom.
- Service Area
- A reserved area on the platters holding the drive firmware (Translator, defect lists, logs). Invisible to the user; its corruption makes data unaddressable.
- Translator
- The firmware table converting logical addresses (LBA) requested by the computer into real physical addresses (cylinder, head, sector).
- PCB & ROM
- The circuit board under the drive. Its ROM holds unique parameters (factory defect map, calibration): a board swap requires transferring this ROM.
- SMR / PMR
- Magnetic write technologies. PMR writes parallel tracks; SMR overlaps them like shingles for higher density, at the cost of trickier recovery.
- Head crash
- Contact between a head and a spinning platter. Tears off the magnetic layer and throws debris that scratches other zones on every rotation — hence the immediate shutdown required.
- Stiction
- Seizing of a hard drive's motor, often after a drop: the heads stick to the platter or the spindle jams. The drive no longer spins.
- S.M.A.R.T.
- A drive's self-monitoring system (reallocated sectors, temperature, power-on hours). Useful for diagnosis, but doesn't predict every failure.
02 — SSD & flash memory
NAND & controller
- NAND SLC · MLC · TLC · QLC
- Flash memory storing data as charges. The number of bits per cell (1 to 4) raises density but lowers endurance and read reliability.
- 3D NAND
- Vertical stacking of NAND cells (over 200 layers today) to increase capacity without shrinking the process node.
- Controller
- An SSD's processor that orchestrates writes, wear and error correction, and hides NAND complexity from the operating system.
- FTL Flash Translation Layer
- A table mapping each logical address to the real physical location in NAND. Volatile and constantly rewritten; its corruption makes the SSD invisible or zero-capacity.
- Reverse FTL
- Software reconstruction of an SSD's translation table from residual metadata, without the original firmware.
- Wear leveling
- Spreading writes across all cells of an SSD to wear them evenly and extend its life.
- Garbage collection
- A background process reclaiming obsolete pages of an SSD to free whole rewritable blocks.
- TRIM
- An OS command marking free blocks to the SSD, which then physically erases them. Often makes SSD deletion permanent within minutes.
- ECC / LDPC
- Error-correcting codes embedded in each NAND page. LDPC, more powerful, fixes the bit errors that cell wear multiplies.
- Read Retry
- Re-reading NAND cells by dynamically shifting the voltage thresholds, to recover data despite wear.
- Chip-off
- Desoldering memory chips (NAND, eMMC) to read their raw content off-device, followed by software reconstruction.
- Bit Rot
- Slow degradation of stored data: cell charges drift until they cause read errors that ECC can no longer fix.
03 — RAID & NAS
Arrays & file systems
- RAID 0 · 1 · 5 · 6 · 10 · 50 · 60
- Grouping several disks for performance, capacity or fault tolerance. Each level has a different safety margin.
- Striping
- Spreading data in stripes across several disks to speed up access.
- Parity & XOR
- RAID 5/6 redundancy data, computed via an XOR operation. Lets the missing block of a disk be rebuilt from the others.
- De-striping
- Logical reconstruction of a RAID volume by identifying stripe size, disk order, parity rotation and initial offset.
- Offset
- The shift of the real data start on a member disk relative to its physical start. A key parameter for a successful RAID reconstruction.
- SHR / X-RAID
- Proprietary RAIDs (Synology, Netgear) stacking LVM and mdadm to mix disks of different sizes.
- Btrfs / ZFS
- Modern NAS file systems with verified integrity and snapshots. Often allow rolling back to a state before an attack.
- Snapshot
- A read-only point-in-time copy of a volume. Often ignored by ransomware, it's invaluable for restoring without paying a ransom.
04 — Mobile
Smartphones & encryption
- Secure Enclave
- Apple's security coprocessor that encrypts data and binds it to the processor. Decryption requires a working device and the user's passcode.
- DFU Device Firmware Update
- A low-level mode of Apple devices allowing, via a hardware interface, the read of a soldered SSD after board repair.
- eMMC / UFS
- Smartphone flash memory types. UFS, newer and faster, equips high-end models; both can be read by chip-off.
- CPU swap
- Transplanting the processor (and its bound memory) onto an identical donor board, when the original board is unrecoverable.
- Micro-soldering
- Precision repair of a board's traces and components under a stereo microscope, to bring it to a readable state.
- Desoxidation
- Cleaning a water-oxidized board in an ultrasonic bath with solvents, followed by replacing the corroded components.
05 — Methods & forensics
Imaging & chain of custody
- Forensic imaging
- A sector-by-sector copy of a device to a file, never modifying the original. The foundation of any serious recovery.
- Write blocker
- A hardware device ensuring no write reaches the source device while it's being read.
- ddrescue · PC-3000 · DeepSpar · Atola
- Professional imaging and repair tools, able to read healthy zones first and bypass defective sectors.
- SHA-256
- A cryptographic hash sealing a disk image: it proves the copy is identical to the original and hasn't been altered.
- ISO/IEC 27037
- An international standard governing the identification, collection and preservation of digital evidence, ensuring its admissibility in court.
- ISO 5 cleanroom
- An ultra-filtered air environment (fewer than 3,520 particles ≥ 0.5 µm per m³) required to open a hard drive without contaminating the platters.
- LBA Logical Block Addressing
- The logical addressing of a device's sectors, as seen by the operating system, as opposed to the real physical address.
- Data carving
- Recovering files by recognizing their binary signatures, when the file system metadata is gone.
- VeriFiles
- A Dafotec service providing the full list of recoverable files, for the client to approve before any payment.
06 — Prevention
Backup & resilience
- 3-2-1-1-0 backup
- Modern strategy: 3 copies of the data, on 2 different media, with 1 off-site, 1 offline (air gap), and 0 errors after verifying restores.
- Air gap
- Physical isolation of a backup, disconnected from the network, to protect it from ransomware and accidental deletion.
- Secure erase
- A controller-level secure wipe of an SSD. Irreversible: once launched, the data is nearly impossible to recover.
- RPO / RTO
- Continuity objectives: RPO measures tolerable data loss (age of the last backup), RTO the acceptable time to restore service.
Dig deeper
From word to method.
Every term in this glossary is used in context in the Guide and the Manual. Follow them to see how these concepts fit together in practice.
The Guide — practitioner level
The method device by device
How these terms apply in practice: diagnosis, intervention, success rates, mistakes to avoid.
Open the Guide →The Manual — technical reference
The science of recovery
73 pages unfolding device anatomy, methods and prevention. Every figure sourced.
Open the Manual →
A term that concerns you?
A failing device? Let's talk.
If one of these terms describes your situation, the free 24h diagnosis gives a precise prognosis. No data – no fee.