Print this page
Wednesday, 20 May 2015 00:00

How signature-based search algorithms work in data recovery applications

Rate this item
(0 votes)

b2ap3_thumbnail_iStock_000025193225XSmall.jpgSignature-based search is the most essential algorithm used in data recovery applications. This algorithm facilitates data recovery from formatted, damaged or failed disks.

Signature-based search

Signature-based search allows applications to recover data from damaged, formatted or partitioned disks. Among tools employing this algorithm are Power Search, Content-Aware Analysis, Smart Scan, etc.

File identification

Signature-based search algorithm works similarly to antivirus software. Virus removal tool scans a file for fragments containing virus codes while signature-based search algorithm, employed by the data recovery application, scans the disk platter for sectors containing “deleted” data. File headers (signatures) contain symbols typical of only certain files. For example, JPEG files are identified by “JFIF” sequence, ZIP archives are indicated with “PK” at the beginning of the file header. PDF documents are marked with “%PDF” in the beginning of the file header.

Such files as HTML have no characteristic signatures but may be identified by indirect indicators since they contain ASCII symbols.

File size determination

To recover a file it is not enough to find where it begins. To complete data recovery OS must “know” where this file ends. File’s end may be found only if its size is known. File size is determined by analysis of the file header (ZIP, JPEG, AVI, etc.) or by analysis of sectors of the disk platter which immediately follow the file beginning. For example, the signature-based search algorithm will identify the sector as the HTML or TXT file’s end if this sector doesn’t contain symbols from ASCII table.

Limitations

Signature-based search is not cure-all solution. Re-recorded and fragmented files (especially large files) are probably one of the biggest headaches in data recovery.

Hybrid algorithms

Modern data recovery tools employ hybrid approach to the analysis of the disk sectors. The main idea of which is to retrieve as much information from the file system as possible and to use signature-based search as little as possible – only by damaged or failed file system or by search of data deleted long time ago.

Last modified on Wednesday, 20 May 2015 19:03
Data Recovery Expert

Viktor S., Ph.D. (Electrical/Computer Engineering), was hired by DataRecoup, the international data recovery corporation, in 2012. Promoted to Engineering Senior Manager in 2010 and then to his current position, as C.I.O. of DataRecoup, in 2014. Responsible for the management of critical, high-priority RAID data recovery cases and the application of his expert, comprehensive knowledge in database data retrieval. He is also responsible for planning and implementing SEO/SEM and other internet-based marketing strategies. Currently, Viktor S., Ph.D., is focusing on the further development and expansion of DataRecoup’s major internet marketing campaign for their already successful proprietary software application “Data Recovery for Windows” (an application which he developed).