Emergency Recovery Tools: Raising Data from the Dead
By Bruce Schneier
June 21, 1993
Any user who has suffered a disk failure can attest to the importance of regular backups. No matter how vigilant a backup program you implement, however, a disk crash between backups can still destroy valuable data.
"You stress backups, but in most cases people don't do them," said Mark Goldenberg, senior development engineer at Hughes Aircraft Co. of Fullerton, Calif. "Or the file they destroyed or deleted is one they created that day." In situations such as this, emergency disk recovery tools can prove invaluable.
Several Macintosh utility bundles include tools that can resurrect lost data and take measures to keep catastrophic crashes at bay. Symantec Corp.'s Norton Utilities for Macintosh, Central Point Software Inc.'s MacTools Deluxe, Fifth Generation Systems Inc.'s Public Utilities and Datawatch Corp.'s 911 Utilities (sold in a package called SuperSet Utilities) all include tools to diagnose and repair crashed hard drives, recover deleted files, and optimize drive performance. The differences among the optimization and recovery tools in these packages are subtle, and each contains other utilities, so choosing among them can often be a matter of personal taste.
All these vendors offer site licenses or quantity licenses for their products. Additionally, a Macintosh manager may use a single copy of any of the file recovery products to diagnose problems on an unlimited number of machines - as long as the program is deleted from the machine afterward.
Proactive Vs. Reactive Repair
It's a sad fact that file undeletion and file recovery won't work all the time. In some cases, there just isn't enough information left on the drive to reconstruct a file.
"This is not a problem with the recovery products; this is just the way the Macintosh works," said Joel Black, head of Macintosh utilities technical support at Symantec.
One way to increase the odds is through proactive measures. All the packages mentioned above come with utilities that can scan a hard disk for indicators of potential problems that could lead to disk failure. "Disk problems often start out small and slowly get worse," said David Shayer, president of Sentient Software of San Carlos, Calif., and the lead programmer for Public Utilities. "The earlier you find it, the easier it is to fix."
Public Utilities and MacTools can automatically scan in the background for problems and perform unattended repairs. MacTools is the only one of the utilities that will let you undo any repairs it has made.
For some, the capability to perform unattended repairs is a plus. "[With Public Utilities] I get the added bonus of having my hard disks scanned automatically for problems instead of waiting for them to occur," said Mike Byrne, graduate student at the Georgia Institute of Technology in Atlanta.
For others, issues such as cost make proactive disk checks unrealistic because they would require a copy of the software for each machine or a very diligent systems administrator. "I would like to do proactive file recovery, but it's a cost issue," said Hughes' Goldenberg. "Putting the utility on 500 Macs is a pretty good hunk of change." Instead, he relies on an automatic backup program and disk recovery utilities that work after a problem arises.
For others, it's an issue of compatibility. "All the proactive tools I've tried run into conflicts with my other extensions," said Dick Barton, network manager at Northrop Corp. of Hawthorne, Calif. "It's easier to run without." Barton said he uses regular backups and reactive disk recovery utilities.
However, the consensus seems to be that preventive maintenance is important. "Regular use [of pre-emptive utilities] is like tuning your car; it runs better and crashes less frequently," said Thomas Jackson, assistant professor at the Medical College of Georgia in Augusta.
In addition to scanning disks for problems that could cause disk crashes, utility manufacturers recommend regularly defragmenting the files on your hard drive. Disk defragmentation reorganizes all files on a hard disk so that they can be accessed more quickly and more efficiently.
This improvement is most noticeable with applications that require extensive disk access. "QuickTime movies play back much more smoothly with a clean, organized hard drive," said Gary Goldberg, Mac user and Unix system administrator at the U.S. Census Bureau in Washington, D.C.
Many Macintosh owners don't defragment their hard drives. "I don't do it much because I have a 400-Mbyte drive and not much time," said Roger Pitcher, computer graphics specialist at Grey Advertising of New York.
Since optimizers continuously copy and delete files on the disk, some people fear that a hardware or software problem could result in a loss of data. "I wouldn't optimize without first doing a full backup. I'm a little nervous about where files are going," said Northrop's Barton.
However, all manufacturers stress the safety of their optimization software, and people who regularly optimize do not report problems. "In the three years I've been using Norton Speed Disk, I've never lost a single byte of data - even when the power cut off in the middle of a run last year," said Steve Godun, graphics designer at AJ Images of Piscataway, N.J.
And for those who claim no time for optimization, there is a solution. ALSoft Inc.'s DiskExpress II can be set to automatically defragment drives every night. It checks and verifies each drive, and if it finds a problem, it will not continue without user consent. DiskExpress II also can automatically defragment at a prespecified day of the week.
"All our server drives are error-checked and defragmented every evening," said Roy Roper, assistant director for the School of Life Sciences at the University of Illinois in Urbana-Champaign.
Edgar Knapp, professor of computer science at Purdue University in West Lafayette, Ind., uses DiskExpress II to automatically defragment his drive and Public Utilities to automatically scan his drive for problems. "These programs work without my intervention, and that's what I need," he said.
The Media Is Corrupt
Many factors can affect a drive to the point of failure, and often it's impossible to discover what caused a problem after it happens. "It's very difficult to diagnose a problem after you've recovered from it," said Symantec's Black.
Black listed several common causes of disk failure, including viruses, problems with the lubricants on magnetic disks, and power failures and brownouts. Many errors stem from the SCSI port, he said, including SCSI ID conflicts, improper termination, excessive cabling length and bad SCSI cables. Often, directory data can be corrupted by system crashes, system extension conflicts or applications.
After a disk failure, however, most users don't care what happened -only whether the situation can be rectified.
Ken Flaton, postdoctoral student at the Institute for Neurocomputing at Ruhr University in Bochum, Germany, almost lost three years of Ph.D. research, including his dissertation, in a disk crash one week before his thesis defense. "[Symantec's] Norton Utilities saved my life," he said.
Keith Sproul, microcomputer manager at Union Carbide Corp. of Bound Brook, N.J., keeps an array of utilities to recover data from the 500 Macs he supports. "I've recovered crucial files from several hard disk crashes," he said. Most people don't make regular backups, Sproul said, and without disk recovery software these files would have been lost.
The utilities are much better at recovering text files than complex files, such as graphics, or more-complex database files. "I've never seen these things work successfully with heavily formatted files," said Howard Klein, member of technical staff at GTE Telephone Operations in Irving, Texas.
Apple's Disk First Aid, which comes free with every Mac, is perhaps the simplest diagnostic tool for floppies and hard drives. Its file recovery capabilities are limited compared with commercial packages. According to users, Disk First Aid is a good first bet if you are having disk problems, and it can find and fix disk problems about two-thirds of the time.
When it comes to choosing one disk recovery product over another, no clear winner emerges. All the commercial recovery utilities can outperform Disk First Aid, but it is often hit-or-miss on which package can fix a particular problem (see MacWEEK Reviews, Aug. 10, 1992).
"It's a question of which battles you're fighting. Different programs solve different problems in different ways," said Paul Smethers, Macintosh section manager at Central Point Software.
For this reason, many Macintosh owners use more than one utility. "All of our support people are encouraged to have two or three of the packages," said Union Carbide's Sproul. "1st Aid Kit (predecessor to Datawatch's 911 Utilities) is the best there is for recovering floppies. MacTools seems to be the most thorough for doing tests."
University of Illinois' Roper said: "If you have a problem, run them all. They'll all find different things."
Often, a choice can be based on more-subtle reasons. "We use Norton Utilities [instead of MacTools Deluxe] because it seems less intimidating to the secretarial staff," said Medical College of Georgia's Jackson.
"I used to use Norton Utilities and MacTools; now I use Public Utilities," said Purdue's Knapp. "It seems to be more thorough than the others, and it works unobtrusively in the background."
The Backup Alternative
Even with the entire arsenal of disk recovery tools, however, sometimes nothing will bring back lost data. The best insurance against loss is a regular backup schedule.
"I had a drive fail with 160 Mbytes of data and was only able to recover 400 Kbytes of miscellaneous stuff," said Hughes' Goldenberg. Restoring all the applications and data files from backup copies took eight hours, he said.
"The best recovery strategy is routine backup," Roper said. "Our success rate is higher by going to a backup from the day before."
Photo of Bruce Schneier by Per Ervland.
Schneier on Security is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..