← Back to the catalog

Glossary

Terms used across this catalog

The case articles try to explain each term in context rather than assume it, but a few come up across more than one case. This page collects them in one place, each linked back to the article or guide where it actually matters.

A

APFS

Apple File System, the default file system on macOS since 10.13. Organizes storage as one physical "container" that can hold several logical volumes sharing the same free space, plus built-in space-efficient snapshots. See APFS Container or Volume Corruption.

B

Bad Sector

A small region of a drive that can no longer reliably store data. A few bad sectors on an otherwise working drive is usually an early warning sign, not an emergency by itself. See Bad Sectors and a Failing (but Working) Drive.

C

Checksum

A calculated value stored alongside a block of data that lets a system detect when that data has been silently altered or corrupted, without needing to compare it against a separate copy. See Database Corruption.

chkdsk / fsck

Built-in file-system repair utilities — chkdsk on Windows, fsck on Linux and macOS. Genuinely useful for ordinary file-system errors, but running one against a physically failing drive before imaging it can overwrite the exact data a recovery attempt needed intact. See File System Corruption.

Cleanroom

A dust-controlled physical workspace, typically ISO Class 5 or better, that a lab needs before opening a drive's sealed enclosure. Airborne dust that would be harmless anywhere else can permanently damage a platter or read/write head on contact. See Mechanical Hard Drive Failure and the Providers directory.

F

File Carving

Recovering files by scanning a drive's raw data for known file signatures and structures, rather than trusting the file system's own index of what's there. Works even when the index itself is gone, but can't recover a file's original name or folder location. See File Carving, Explained.

FileVault

Apple's built-in full-disk encryption for macOS. Like other full-disk encryption, losing both the password and the recovery key means there's no technical path back into the data. See APFS Container or Volume Corruption and Locked Out of an Encrypted Volume.

Flash Translation Layer (FTL)

The logic an SSD's controller runs to map the "logical" addresses an operating system asks for onto the actual physical flash cells data lives in, since that mapping constantly shifts as the drive spreads writes out through wear leveling. See SSD Controller Failure.

G

Garbage Collection

Background housekeeping an SSD performs on its own, reclaiming flash blocks that TRIM has marked as no longer in use. Often what actually erases deleted data at the flash level, sometimes within seconds of deletion. See Why Deleted Files Usually Can't Be Recovered on an SSD.

H

Hypervisor

The software layer (like VMware ESXi or Hyper-V) that runs virtual machines on top of physical hardware, and manages the large container files their virtual disks live inside. See Virtual Machine Disk Corruption.

N

NAS

Network-Attached Storage — a small dedicated device, often running its own Linux-based operating system, that holds multiple drives and serves files over a network. A dead NAS is very often its own OS failing rather than the drives themselves. See NAS Device Failure.

P

Partition Table (MBR/GPT)

The small on-disk structure — either the older MBR or the newer GPT format — that records where each partition on a drive starts and ends. Damage here can make a drive look empty or "unallocated" while the actual data underneath is untouched. See Partition Loss.

PST / OST

The two container-file formats Outlook stores mail in locally. A PST is often the only copy of an account's mail in existence; an OST is just a local cache of a mailbox that lives on a server, and rebuilds itself automatically if deleted. See Outlook PST/OST Corruption.

R

RAID

A method of spreading or duplicating data across multiple physical disks, used for performance, redundancy, or both. Different RAID levels fail in very different ways, and the recovery attempt itself is where most RAID data actually gets lost. See RAID Array Failure.

RAID Rebuild

The process an array runs to reconstruct a failed disk's data onto a replacement, using the redundancy built into the array. A rebuild that stalls or hits a second failing disk partway through is how a single-disk failure turns into the loss of an entire array. See Failed or Interrupted RAID Rebuild.

Ransomware

Malware that encrypts files (sometimes an entire drive) using a key the attacker holds, then demands payment for it. Not the same problem as forgetting your own password — recoverability depends heavily on the specific strain involved. See Ransomware Encryption.

RAW (drive)

What Windows reports when it can no longer recognize a drive's file system, even though the drive itself is readable. Usually means the operating system lost track of the file system, not that the data is gone. See Drive Shows as "RAW".

Recovery Key

A separately-saved backup credential for an encrypted volume, distinct from the everyday password, usually stored with a cloud account, an organization's IT system, or printed on paper. The only realistic way back into strong modern encryption if the password itself is forgotten. See Locked Out of an Encrypted Volume.

S

SAN

Storage Area Network — enterprise-scale shared storage infrastructure, built from several distinct layers (physical disks, a RAID or storage layer, a network fabric, and the servers consuming it). A SAN failure usually traces to just one of those layers. See SAN (Storage Area Network) Failure.

Seed Phrase

A sequence of words that encodes a cryptocurrency wallet's private key. Unlike a damaged wallet file or device, a lost seed phrase with no backup has no recovery path — the same underlying math as losing an encryption key. See Cryptocurrency Wallet Recovery.

SHR (Synology Hybrid RAID)

Synology's own layout for combining mixed-size drives into one storage pool, used on many consumer NAS devices instead of standard RAID levels. Its own structure matters for how a rebuild or recovery actually proceeds. See NAS Device Failure.

SMART (S.M.A.R.T.)

Self-Monitoring, Analysis and Reporting Technology — a drive's own built-in health-monitoring system, which can flag warning signs like a rising reallocated-sector count before a drive fails outright. See Bad Sectors and a Failing (but Working) Drive.

Snapshot

A point-in-time copy of a volume's state, stored efficiently by recording only what's changed since it was taken. APFS and Time Machine both use snapshots locally, and they can survive damage that makes the live volume itself unmountable. See APFS Container or Volume Corruption.

T

Transaction Log

A database engine's running record of every change made, used to recover cleanly after a crash by replaying or rolling back incomplete transactions. A corrupted log is a harder problem than a single corrupted table. See Database Corruption.

TRIM

A command an operating system sends an SSD when a file is deleted, telling the controller which blocks are no longer in use. Often leads the drive to actively erase that data at the flash level within seconds, unlike deletion on a hard drive. See Why Deleted Files Usually Can't Be Recovered on an SSD.

W

Wear Leveling

An SSD controller's strategy of spreading writes evenly across all its flash cells, so no single cell wears out from repeated use much faster than the rest. Part of why an SSD's logical-to-physical data mapping is constantly shifting. See SSD Controller Failure.

Write-Blocker

Hardware or software that guarantees nothing — not even the operating system itself — can accidentally write to a drive while it's connected for recovery or imaging. See What a Write-Blocker Does.