← Back to the catalog

Glossary

Terms used across this catalog

The case articles try to explain each term in context rather than assume it, but a few come up across more than one case. This page collects them in one place, each linked back to the article or guide where it actually matters.

A

APFS

Apple File System, the default file system on macOS since 10.13. Organizes storage as one physical "container" that can hold several logical volumes sharing the same free space, plus built-in space-efficient snapshots. See APFS Container or Volume Corruption.

B

Bad Sector

On a hard drive, a sector that cannot be read reliably; SSDs can expose similar logical read errors even though flash is managed internally in pages and erase blocks. New or growing read errors are a reason to preserve important data and stop treating the device as reliable. See Bad Sectors and a Failing (but Working) Drive.

C

Checksum

A calculated value stored alongside a block of data that lets a system detect when that data has been silently altered or corrupted, without needing to compare it against a separate copy. See Database Corruption.

chkdsk / fsck

Built-in file-system repair utilities — chkdsk on Windows, fsck on Linux and macOS. Genuinely useful for ordinary file-system errors, but running one against a physically failing drive before imaging it can overwrite the exact data a recovery attempt needed intact. See File System Corruption.

Cleanroom

A dust-controlled physical workspace, typically ISO Class 5 or better, that a lab needs before opening a drive's sealed enclosure. Airborne dust that would be harmless anywhere else can permanently damage a platter or read/write head on contact. See Mechanical Hard Drive Failure and the Providers directory.

F

File Carving

Recovering files by scanning a drive's raw data for known file signatures and structures, rather than trusting the file system's own index of what's there. Works even when the index itself is gone, but can't recover a file's original name or folder location. See File Carving, Explained.

FileVault

Apple's built-in full-disk encryption for macOS. Like other full-disk encryption, losing both the password and the recovery key means there's no technical path back into the data. See APFS Container or Volume Corruption and Locked Out of an Encrypted Volume.

Flash Translation Layer (FTL)

The logic an SSD's controller runs to map the "logical" addresses an operating system asks for onto the actual physical flash cells data lives in, since that mapping constantly shifts as the drive spreads writes out through wear leveling. See SSD Controller Failure.

G

Garbage Collection

Background housekeeping an SSD controller performs to consolidate valid pages and reclaim flash erase blocks. TRIM/deallocation can tell the controller which logical data is no longer needed, but when the corresponding flash is physically erased is controller-dependent and not reliably predictable from outside the drive. See Why Deleted Files Usually Can't Be Recovered on an SSD.

H

Hypervisor

The software layer (like VMware ESXi or Hyper-V) that runs virtual machines on top of physical hardware, and manages the large container files their virtual disks live inside. See Virtual Machine Disk Corruption.

N

NAS

Network-Attached Storage — a small dedicated device, often running its own Linux-based operating system, that holds multiple drives and serves files over a network. A dead NAS is very often its own OS failing rather than the drives themselves. See NAS Device Failure.

P

Partition Table (MBR/GPT)

The small on-disk structure — either the older MBR or the newer GPT format — that records where each partition on a drive starts and ends. Damage here can make a drive look empty or "unallocated" while the actual data underneath is untouched. See Partition Loss.

PST / OST

The two container-file formats Outlook stores mail in locally. A PST may contain local-only mail or archives. An OST is normally a synchronized local cache of a server mailbox and can often be recreated from the server, but unsynchronized or locally stored items can make the existing file worth preserving. See Outlook PST/OST Corruption.

R

RAID

A method of spreading or duplicating data across multiple physical disks, used for performance, redundancy, or both. Different RAID levels provide different redundancy and fail in different ways; recovery becomes risky when member order, layout, failure history, or current array state is uncertain. See RAID Array Failure.

RAID Rebuild

The process an array runs to reconstruct a failed disk's data onto a replacement, using the redundancy built into the array. A rebuild writes reconstructed data to the array or a replacement member. If another member fails, unreadable sectors are encountered, or the assumed array state is wrong, a rebuild can fail or make later reconstruction more difficult. See Failed or Interrupted RAID Rebuild.

Ransomware

Malware that makes files or systems inaccessible and demands payment, commonly by encrypting data. Key generation and storage differ by ransomware family, which is why identifying the exact variant matters. Not the same problem as forgetting your own password — recoverability depends heavily on the specific strain involved. See Ransomware Encryption.

RAW (drive)

What Windows reports when it cannot mount a recognized file system on a volume. The cause can be file-system or partition damage, encryption, unsupported structures, or an underlying device problem; RAW is a symptom rather than a diagnosis. See Drive Shows as "RAW".

Recovery Key

A separately-saved backup credential for an encrypted volume, distinct from the everyday password, usually stored with a cloud account, an organization's IT system, or printed on paper. The only realistic way back into strong modern encryption if the password itself is forgotten. See Locked Out of an Encrypted Volume.

S

SAN

Storage Area Network — enterprise-scale shared storage infrastructure, built from several distinct layers (physical disks, a RAID or storage layer, a network fabric, and the servers consuming it). A SAN failure usually traces to just one of those layers. See SAN (Storage Area Network) Failure.

Seed Phrase

A sequence of words that encodes a cryptocurrency wallet's private key. Unlike a damaged wallet file or device, a lost seed phrase with no backup has no recovery path — the same underlying math as losing an encryption key. See Cryptocurrency Wallet Recovery.

SHR (Synology Hybrid RAID)

Synology's own layout for combining mixed-size drives into one storage pool, used on many consumer NAS devices instead of standard RAID levels. Its own structure matters for how a rebuild or recovery actually proceeds. See NAS Device Failure.

SMART (S.M.A.R.T.)

Self-Monitoring, Analysis and Reporting Technology — a drive's own built-in health-monitoring system, which can flag warning signs like a rising reallocated-sector count before a drive fails outright. See Bad Sectors and a Failing (but Working) Drive.

Snapshot

A point-in-time copy of a volume's state, stored efficiently by recording only what's changed since it was taken. APFS and Time Machine can use snapshots locally. A readable snapshot may provide an earlier consistent state, but it lives on the same storage and is not an independent backup. See APFS Container or Volume Corruption.

T

Transaction Log

A database engine's running record of every change made, used to recover cleanly after a crash by replaying or rolling back incomplete transactions. A corrupted log is a harder problem than a single corrupted table. See Database Corruption.

TRIM

A deallocation command that tells an SSD which logical blocks no longer contain data the operating system needs. After TRIM, the old contents may stop being available through normal logical reads; physical flash erasure may occur later during garbage collection. Whether TRIM is issued and passed through depends on the operating system, file system, interface, RAID or virtualization layer, and device. See Why Deleted Files Usually Can't Be Recovered on an SSD.

W

Wear Leveling

An SSD controller's strategy of spreading writes evenly across all its flash cells, so no single cell wears out from repeated use much faster than the rest. Part of why an SSD's logical-to-physical data mapping is constantly shifting. See SSD Controller Failure.

Write-Blocker

A mechanism used to prevent writes to source media during examination or imaging. A properly implemented hardware write-blocker enforces this below the operating-system layer; software read-only controls depend on the software stack and should not be described as an absolute hardware-level guarantee. See What a Write-Blocker Does.