IPMC KUMASI
DEPARTMENT OF SYSTEM ENGINEERING
DATA CORRUPTION AND RECOVERY
BY
SARKODIE KANKAM MICHAEL
Research submitted to the school of physical sciences, IPMC Kumasi, in
partial fulfillment of the requirement of the certificate of system engineering.
March,2022
DEDICATION
I dedicate my research to my beloved parents Mr. & Mrs. Sarkodie, my teachers, and whoever
never left my side and encouraged, and supported me.
ACKNOWLEDGEMENT
First, I would like to thank the almighty God who has given me the capability to complete this
work. my sincere appreciation goes to my instructor Mr. DE-Graft, Mr. Ernest, Mr. Opoku, who
imparted this knowledge and academic sanctity into me. And not forgetting my fellow students
for their help offered in a way like this. I would once again express my gratitude to my parents
MR & MRS Sarkodie for their daily motivation that kept me going. I say, may the Almighty God
bless you all.
TABLE OF CONTENT
1.Introduction
to data corruption
2.Detected
vs undetected data corruption
3.Reasons
for data corruption
a. power failure
b. hard reset
c. networking device
d. hot swapping
e. faulty programs
4.How
to detect data corruption
a. monitor error messages and operating system
b. Run checksum
c. RAID and ZFS
5.Best
practices to prevent data corruption
6.How
to recover data
a. chkdsk command
b. restore previous version
c. deployment image servicing and management (DSIM)
d. use data recovery tools
7.Popular
data recovery tools
a. stellarinfo
b. tenoshare
c. recoverit
8.Conclusion
9.References
INTRODUCTION
Data corruption of is when data objects become inaccessible, unreadable, illegible or produce
unexpected results to a computer operating system or device. Users, applications and databases
will not be able to read, write, store or transmit the data object or files, resulting in a loss of data
integrity. In a real-world scenario, this might be a corrupt file system or missing documents and
folders on a file server. The impact of data corruption will vary from causing a nuisance to a
potential system-wide outage to business-critical production systems. Some applications may be
able to attempt to automatically repair the corruption, but whether this process will be successful
depends on the level of corruption depends on the level of corruption. As always, if you are
concerned about mission critical production data corruption, please ensure you send it to Gill
ware as soon as possible. Any unnecessary reads, writes or attempts to recover the data will
likely have a detrimental effect on the data objects integrity. In general, when data corruption
occurs, a file containing that data will produce unexpected results when accessed by the system
or the related application. Results could range from a minor loss of data to a system crash. For
example, if a document file is corrupted, when a person tries to open that file with a document
editor they may get an error message, thus the file might not be opened or might open with some
of the data corrupted (or in some cases, completely corrupted, leaving the document
unintelligible). The adjacent image is a corrupted image file in which most of the information has
been lost.
Some types of malwares may intentionally corrupt files as part of their payloads, usually by
overwriting them with inoperative or garbage code, while a non-malicious virus may also
unintentionally corrupt files when it accesses them. If a virus or trojan with this payload method
manages to alter files critical to the running of the computer's operating system software or
physical hardware, the entire system may be rendered unusable.
Some programs can give a suggestion to repair the file automatically (after the error), and some
programs cannot repair it. It depends on the level of corruption, and the built-in functionality of
the application to handle the error.
Recent Studies on Data Corruption Vulnerabilities
To understand whether modern mass-storage devices are better than older ones, businesses keep
surveying organizations that use mass-storage devices a lot. Several studies have revealed that
modern storage devices like SSDs and NVMe SSDs may show lower possibilities of data
corruption.
However, a tiny file corruption may cause severe damage to your business since modern storage
units store terabytes of data. Comparatively, old mass storage devices like HDDs are safer
because they store less data than modern devices.
Find below the trends of data corruption occurrences and severity in global businesses:



NetApp, the cloud data management solution, ran a test on 1.5 million HDDs for 41
months. The study found 400,000 data corruption events. Interestingly, the RAID
controller device could not detect 30,000 file corruption events.
The European Organization for Nuclear Research, CERN, tested 97 petabytes of data for
six months and found that 128 MB went through long-term corruption.
Greenplum, a big data technology provider by VMware, reported that their data centers
suffer data corruption-linked problems every 15 minutes.
The above studies suggest how severe the data corruption problem is for businesses and
organizations.
Detected Vs. Undetected Data Corruption
There are two types of data corruption processes. These are detected and undetected data
corruption. Find below a table that differentiates the two efficiently:
REASONS FOR DATA CORRUPTION
There are various causes behind data corruption at the business and individual user levels. Some
of the important and common causes are as mentioned below:
1. Power failure:
Computers, servers, and data center storage arrays must get uninterrupted power at a specific
voltage. If they do not, they may simply go offline unexpectedly. Such halts in data processes
cause damage to magnetic and chip-based data blocks
2.Hard reset: Hard restarts also cause damage to data blocks. When you intentionally
press the shutdown button for a long time, the CPU shuts down immediately. The
read/write head of HDDs often damages tiny data blocks during fast shutdowns.
Faulty graphics cards, motherboards, RAMs, LAN cards, etc., may also cause unexpected
shutdowns or blue screen of death, damaging data blocks.
3.Networking devices: Faulty and substandard networking devices like switches, routers,
hubs, etc., can also create bad sectors on HDDs and SSDs.
4.Hot swapping: Today’s motherboards come with a plug-and-play option or hot swapping for
SSDs, HDDs, NVMes, etc. Though it seems convenient to plug in a storage device, copy data,
and unplug it, constant usage in such a direction damages the device exponentially.
5.Faulty programs:
Bad programming codes can prevent mass storage devices from appropriately creating and
saving magnetic memory blocks. You might see that you have created a document, but the file
gets deleted after the program shuts down.
6.Malware and Ransomware: These days, a big headache for digital businesses
is ransomware and malware. Hackers can access your data center storage arrays and encrypt the
stored data. If you do not have the encryption key, you may consider data is lost forever.
7.Wear and tear: All electronic devices suffer from normal wear and tear. This means the
storage devices will stop functioning properly in a few years.
HOW TO DETECT DATA CORRUPTION.
1. Monitor error messages from the operating system: Major OSs like Windows, Mac, and
Linux have storage device health reporting tools. They continuously gather data and show
reports with warning signs. However, such notifications are useless if data corruption has already
happened.
2.Run checksum: Your IT team can run Checksum regularly when transporting or moving data
from one drive to another. When you run a Checksum script, you get to see the current state of
the storage drive and any future issues in the command line interface (CLI).
3.RAID and ZFS: For operating systems like Linux, Ubuntu, Debian, RAID, and ZFS software.
You can configure an automated data scrubbing schedule weekly or monthly.
BEST PRACTICES TO PREVENT DATA CORRUPTION.
Whether it is a business or personal need, always back up the valuable data you produce.
Businesses can create a data backup team that will frequently audit data and back it up in another
storage device for a rainy day. When data corruption behaves as a Poisson process, where
each bit of data has an independently low probability of being changed, data corruption can
generally be detected by the use of checksums, and can often be corrected by the use of error
correcting codes (ECC).
If an uncorrectable data corruption is detected, procedures such as automatic retransmission or
restoration from backups can be applied. Certain levels of RAID disk arrays have the ability to
store and evaluate parity bits for data across a set of hard disks and can reconstruct corrupted
data upon the failure of a single or multiple disks, depending on the level of RAID implemented.
Some CPU architectures employ various transparent checks to detect and mitigate data
corruption in CPU caches, CPU buffers and instruction pipelines; an example is Intel Instruction
Replay technology, which is available on Intel Itanium processors.
Many errors are detected and corrected by the hard disk drives using the ECC codes which are
stored on disk for each sector. If the disk drive detects multiple read errors on a sector, it may
make a copy of the failing sector on another part of the disk, by remapping the failed sector of
the disk to a spare sector without the involvement of the operating system (though this may be
delayed until the next write to the sector). This "silent correction" can be monitored
using S.M.A.R.T. and tools available for most operating systems to automatically check the disk
drive for impending failures by watching for deteriorating SMART parameters.
Some file systems, such as Btrfs, HAMMER, ReFS, and ZFS, use internal data
and metadata check summing to detect silent data corruption. In addition, if a corruption is
detected and the file system uses integrated RAID mechanisms that provide data redundancy,
such file systems can also reconstruct corrupted data in a transparent way This approach allows
improved data integrity protection covering the entire data paths, which is usually known as endto-end data protection, compared with other data integrity approaches that do not span different
layers in the storage stack and allow data corruption to occur while the data passes boundaries
between the different layers.
Data scrubbing is another method to reduce the likelihood of data corruption, as disk errors are
caught and recovered from before multiple errors accumulate and overwhelm the number of
parity bits. Instead of parity being checked on each read, the parity is checked during a regular
scan of the disk, often done as a low priority background process. Note that the "data scrubbing"
operation activates a parity check. If a user simply runs a normal program that reads data from
the disk, then the parity would not be checked unless parity-check-on-read was both supported
and enabled on the disk subsystem.
If appropriate mechanisms are employed to detect and remedy data corruption, data integrity can
be maintained. This is particularly important in commercial applications (e.g. banking), where an
undetected error could either corrupt a database index or change data to drastically affect an
account balance, and in the use of encrypted or compressed data, where a small error can make
an extensive dataset unusable.[
Other best practices that you can follow are as below:








Use 75% storage and keep the rest empty for maintenance work.
Use SMART tools to check HDD and SSD health and prioritize data backup for soon-tofail storage devices.
Use online UPS systems to supply constant electricity to workstations, servers, and data
center storage arrays.
When using external mass storage devices, scan for viruses before opening the drive.
For all removable storage devices, perform eject before unplugging the device from the
computer or server.
Stay away from phishing content, emails, texts, etc.
Do not install every software that you get for free online.
Always use robust antivirus software.
HOW TO RECOVER DATA
CHKDSK COMMAND:
This command looks for bad sectors in a partition. It also reads existing data from a bad sector
and tries to repair known file types. You can run the command easily on Windows Command
Prompt by using this code. Replace letter e with the drive letter you want to check.
Chkdsk e:f/r/x
RESTORE PREVIOUS VERSION:
If you’re facing issues with any file like Word, Excel, JPEG, MP4, etc., you can try restoring any
previous version that Windows might have saved.Select the file and right-click to draw the
context menu. Now, click Restore Previous Versions to get file restoration options.
DEPLOYMENT IMAGE SERVICING AND MANAGEMENT(DSIM): IT
administrators and developers use the DSIM tool to repair operating system files and images like
Windows Recovery Environment, Windows Setup, etc. If you need to repair a corrupted
Windows 10 or 11 OS image, you can run the following command in CMD with Administrator
rights: DSIM/Online/Cleanup/-Image/RestoreHealth
USE DATA RECOVERY TOOLS: The most convenient way to repair corrupt data is using
professional and enterprise-grade data recovery software.
POPULAR DATA RECOVERY TOOLS
1.StellarInfo offers various data recovery services under one software. For example, you can use
the tool for Windows data recovery, iPhone data recovery, video/image recovery, Mac data
recovery, and more. For businesses, it offers advanced data recovery services like recovering
corrupted data from magnetic tapes, virtual machines, mass storage devices, and more.
2.Tenorshare: Tenorshare 4DDiG Data Recovery helps businesses recover more than 1,000
types of files and documents from corrupted discs, partitions, SSDs, NVMes, USB drives, etc.
The tool supports all the latest operating systems and hardware like Windows 11, Mac T2,
etc. The tool has many supporting utilities like duplicate file deleter, photo repair, video repair,
Mac Boot Genius, Windows Boot Genius, etc.
3.Recoverit: Wondershare Recoverit is a complete data recovery suite for all business and
individual data recovery requirements. It offers a dedicated tool for Windows and Mac devices.
Moreover, the tool is highly efficient in recovering photo, video, and audio files. The developer
claims the tool offers a 95% recovery rate for 500+ data corruption scenarios.
CONCLUSION
In conclusion, data corruption can have serious consequences for individuals and organizations.
However, by understanding the causes and implementing effective recovery methods, it is
possible to minimize the impact of data corruption and protect important information. Through
this project work, we explored the various types of data corruption and the methods that can be
used to recover corrupted data. We also have seen how important it is to have regular backups, as
well as to implement robust data integrity checks and monitoring systems. By taking these steps,
we can help ensure that the risks of data corruption are minimized and that data can be quickly
and effectively recovered in the event of corruption. Data corruption is a common problem for
businesses and individuals. The business around data recovery services is booming too.
According to a recent study from GlobeNewswire, global market revenue for data recovery will
grow at a CAGR of 9.6% between 2022 and 2030. By 2030, data recovery will become a $23.1
billion industry. Hence, you can prepare yourself to develop unique solutions by learning about
data corruption. You could start your startup or join IT giants who rule the data recovery domain.
It is better to learn data corruption theories and lab projects and apply the learning in your
business to prevent data corruption. By learning data corruption theories, you can also groom
yourself to develop novel solutions that businesses might benefit from.
LIST OF REFERENCES:
https://phoenixnap.com/blog/data-corruption
https://www.gillware.com/data-recovery-services/corrupt-data-recovery/
https://geekflare.com/data-corruption/
.