Hard Drive Problems

Lost File Allocation

Problems requiring data recovery can occur even when there isn't a hardware problem. Lost file allocation is one such problem. The allocation information referred to as being lost  is critical information that the file system uses to locate and piece together the fragments of the files stored within it. The file allocation information in a filesystem is a little like a recipe book that also knows where the ingredients for the recipes are stored. The book tells you what the recipe is called what ingredients are required and the order in which they required to successfully make the cake, or whatever you were trying to make. Losing file allocation information would be like losing pages of the book. The data may still be stored on the disk just like the ingredients might still be in the cupboard but without the recipe you would not know what ingredients you would need and in what order to put them.  Unlike humans who, if they make the same cake over and over again would remember where everything is stored, and in what order it is required. It doesn't matter how many times a computer reads a file from the file system, each time its done it, it forgets and requires the file allocation information again the next time it wants to correctly read the file.

"Lost" in the term "Lost File Allocation" unfortunately does not mean that it can easily be found. A better phrase would be "destroyed allocation" as an error that causes allocation problems tends to lead allocation data being overwritten, and thus it cannot be reconstructed. The only way to recover valuable data in such instances is to use information stored within the file to identify and re-sequence the blocks of data that make up the file. This can only be done if the nature of the data in the file allows for this.

Symptoms

File allocation problems first become apparent when the operating system request that filesystem checking software needs to be run. On Microsoft operating systems such as MS-DOS, Windows, Windows Vista etc. the program is call chkdsk (Check Disk). Linux Extended 2 and Extended 3 filesystems have e2fsck etc. File allocation problems may also become apparent when you try to open the document or file in the program that created it e.g. XLS file in Microsoft Excel and the program reports that the file is unrecognisable or is corrupt.

If the data on the hard drive is important to you then immediate action needs to be taken to ensure no further damage occurs to critical data files. Steps to be taken can be found at the bottom of the page.

How does lost file allocation occur?

The most likely cause of file corruption due to lost allocation occurs if the computer is shutdown in an uncontrolled manner such as a power failure or operating system crash. Lost allocation can also be caused by destructive computer viruses or other malicious software. In all cases the results are that the filesystem information that details where the fragments of a file are located on a disk are lost and can no longer, under normal operation be pieced back together.

What Can Be Done?

It depends upon many factors such as:

• The file system in which your data files are stored.
• How the allocation was "lost" and so on.
• How long ago did the filesystem corruption occur.

Technically, allocation information is not usually "lost" as this would imply there is a chance of finding it again. Usually it has been eradicated by a deletion process, or some misplaced writing that has overwritten data on the disk. For FAT based file systems the allocation information is stored in a table at the start of the file system making it particularly vulnerable to damage, whereas node based file systems such as NTFS store allocation information along with other file information in structures that can be spread through out the disk, so less prone to being eradicated by a random write error.

Without allocation information to follow, and so locate the elements that make up a file, the only options are to identify the data by its contents or to hope that the data is contiguous (the complete file data is stored in consecutive sectors) so, if you can find the start of a file then you can recover all of a file. If a de-fragmentation process has been run recently then the recoverability of files where there is file system damage is greatly increased. However if a de-fragmentation process has been run since the corruption occurred recoverability of corrupt files is greatly reduced.

WARNING: Never run a defragmentation process on a corrupt filesystem if you wish to have your files recovered. Doing so will greatly reduce the chance of a successful recovery.

Some data types, especially page based database files such as Microsoft SQL and Microsoft Exchange have an identifiable structure for each storage unit which means there is the possibility that the data can be rebuilt by trawling the data space of filesystem and identifying data by its contents. For other file types, (word processing documents, graphics files etc.) this is not really a viable option.