Causation of logical data errors:
Logical data errors are defined for the purpose of this
article, as those errors that occur in dynamic or static media, which are either
un-related, or only partially related to the physical condition of the media
unit. For this article, I
will define the media unit, as a fixed drive, removable media [i.e. Zip disk, or
floppy disk, tape, etc.], or as the dynamic memory embedded in a device, to
which power has never been interrupted.
Logical errors can be generated either by error or
malice. Malicious programs
such as public or private viruses can often be the source of serious logical
errors. The program may
implement an agenda of data loss, or data manipulation, which is contrary to the
agenda or objectives of the owners of the data or media unit. A large number of public viral programs are well
documented on a variety of anti-virus sites around the world, a couple of note
includes Symantec, and McAfee, but there are also numerous academic and private
sites, which detail the somewhat predictable actions of public viruses.
These programs are then classified along with private programs with
malicious agendas. Many such
programs have be documented, they are distinguished from public virus by certain
characteristics in that they are often highly dependent upon a specific system
context, and depend upon privileged logical or physical access to the system,
network, or media unit.
In either case, public or private, the possible
targets of malice are limited to either a system area, a resource of specific
criteria, or a specific target. A
number of system areas are possible targets.
According to the OS, used to format the drive, [i.e. FAT16, FAT32, NTFS,
HPFS, etc.], the system areas will include a master resource of the media unit.
These master resources may include a bootstrap, allocation, or organizational
resource. If any of these resources
is adulterated with either erroneous or malicious data, the media unit may be
rendered partially, completely, contextually, or apparently dis-functional.
Examples of such damage are when a DOS based unit indicated that no valid
boot resource is available, or a MAC fails to initialize.
The adulteration of a key system area, will often
effectively affect the media unit by the introduction of false program paths, or
invalid resource tables. If
false program paths are introduced, be they well designed or simply erroneous,
will cause the system processor(s) to execute commands which are either invalid
or at the very least not in the interests of the user. System level programmers are intimately familiar with
such conditions, as execution paths which lead to data areas, or which cause
infinite loops. When these
conditions occur, the results are highly unpredictable, and possibly injurious
to existing data on the media unit. The
possibilities of injury result primarily from erroneous or malicious commands
that cause good data areas to be overwritten, deleted, or damaged.
The other source of possible functional damage, which is slightly more
common, and preferable to invalid execution paths, is that of adulterated system
resources. In these instances, the OS or application damages a key
system resource in such a way as to cause the resource to fail initialization or
integrity tests. This type of
damage may also, by containing invalid jump addresses, cause secondary processes
to fail. If for example the partition table of a media unit is damaged, then it
may appear to have partitions, which are inconsistent with the actual formatting
of the drive.
Symptoms of logical data errors:
Media units with logical data errors may exhibit a
number of characteristic problems, however the best POST tests are based upon
elimination. If the media
unit is recognized by the system initialization procedure [BIOS], this
effectively rules out many serious hardware errors.
Beyond this test the water gets murky, between hardware and logical
errors.
Many physical hardware errors can cause data errors,
which might also be the result of logical data errors. Generally the saving grace is that logical errors are
generally fairly systematic in their expression.
For example a disk, which is recognized, by the BIOS, but reports as
having no boot partition is most likely the result of a logical data error.
While if that same disk was unable to boot, due to file errors, then the
problem is most likely physical. Specific
common manifestations of logical data errors include missing files, folders, or
partitions. Also when a file
contains no data, partial data, or incorrect data this is most likely a logical
data error.
Recovery from logical data errors:
Most logical data errors are recoverable.
If user data has not been overwritten by the actions of the logical
error, it will most likely be recoverable.
The methods to affect the recovery vary widely according to the source
and extent of the errors.
In most cases a senior system programmer will be able
to look at the drive with an editor, locate important data and move it into
another file. This generally works
well if the files are small, or textual.
Larger, or non-textual files, like graphics or sounds, will require
either intact organizational resources, such as FAT tables, or a machine
language expert will attempt to reconstruct the file. There are proprietary programs that are used in the
data recovery field that may aid this process, but they can be extremely
damaging in the hands of even experts who are not intimately familiar with the
delicate data structures, which make up modern media units.
|
Data
Recovery Services,
inc.
