Data recovery glossary

Terms

From allocation bitmap to wear levelling

Cluster

The smallest unit in which a file system allocates space to files. A file always occupies whole clusters, even when it is smaller. exFAT commonly uses cluster sizes from 4 KB to 32 MB.

Sector

The smallest physically addressable unit of a device, usually 512 or 4096 bytes. Several sectors together form a cluster.

Carving

A technique that searches the raw data stream for known file starts and carves files out from there. It works without a file system but loses file names, timestamps and folder structure.

Fragmentation

The state in which a file is stored not contiguously but spread across several separate areas. Fragmented files are especially hard for carving, because the continuation does not follow directly after the start.

DCIM

Digital Camera Images: the standardised folder name cameras use to store their recordings. An empty DCIM folder does not necessarily mean the data is physically gone.

exFAT

Extensible File Allocation Table: the file system SDXC and microSDXC cards ship formatted with. The specification is published officially.

FAT (file allocation table)

A table that records, for fragmented files, which cluster follows which. In exFAT it is only needed for fragmented files; contiguous files instead use a flag in the directory entry.

Allocation bitmap

A bitmap in which exFAT notes for every cluster whether it is in use or free. On deletion the bit is cleared here while the data itself initially remains.

Volume boot record

The first sector of a file system. It holds every layout parameter: sector size, cluster size, position of the FAT, start of the cluster heap and the first cluster of the root directory.

Backup boot region

A copy of the boot region that exFAT places at sector 12. If the main boot region is damaged, the copy can restore the structure.

Cluster heap

The area of an exFAT device where the actual file data lives. Its start position is recorded in the volume boot record.

Quick format

A format that only recreates the management structures and leaves the data areas untouched. Recordings therefore often remain reconstructable, as long as nothing new has been written.

Full format

A format that additionally overwrites or verifies the data area. Recovery is generally no longer possible afterwards.

Overwriting

Writing new data over a storage area. Overwritten content is permanently lost; no software can bring it back.

Disk image

An uncompressed, sector-exact copy of an entire device as a file, commonly with the extensions IMG, DD, RAW or BIN. Do not confuse it with RAW photo files.

Wear levelling

A technique in flash storage controllers that spreads writes evenly across the memory cells. It means logical addresses do not permanently correspond to the same physical cells.

TRIM

A command with which an operating system tells the storage which areas are no longer needed. Affected areas can then be erased immediately, which makes recovery much harder or impossible.

MBR

Master boot record: the classic partition table in the first sector of a device. It describes up to four primary partitions and their start positions.

GPT

GUID partition table: the more modern partition table without the MBR's limitations. It additionally keeps a backup copy at the end of the device.

File signature

A fixed byte sequence at the start of a file by which its format can be recognised. JPEG, for instance, begins with FF D8 FF and WAV with the characters RIFF.

Container

A file format that bundles several data streams, such as the picture and sound of a video. MP4, MOV and MXF are containers; the actual video inside is encoded with a codec.

Codec

The method by which picture or sound data is encoded and decoded. An intact container does not yet guarantee that the codec data inside is complete.

Demuxing

Separating a container into its individual data streams. Succeeding across the full duration is a strong indication of a complete file.

The .UNVERIFIED suffix

A marking in the file name for a result whose completeness could not be confirmed. It is a technical file suffix and is not translated.

FOUND.000 and CHK

A folder created by a Windows file-system repair, and the fragment files placed inside it. They are produced by CHKDSK and are not regular media files.

RAW (photo format)

A camera's unprocessed sensor format, such as CR3 on Canon or ARW on Sony. A RAW file usually contains an embedded preview, and displaying it does not yet prove the sensor data is complete.