Recovery methodsTechnical

Recovery Copies: Source, Image, Working Copy and Destination

Why recovery work separates the original source, acquisition image, experimental working copy and recovered-file destination instead of treating them as one disk.

The source is the state you are trying to preserve

The source may be a disk, SSD, memory card, RAID member set, virtual disk or storage image. Once its state changes, some recovery options may disappear, so unnecessary writes and experiments belong elsewhere.

The acquisition image preserves readable source data

An image or clone moves analysis away from the original. With an unstable source, the acquisition should also preserve information about unreadable or unattempted regions.

A working copy is disposable

If you need to run a repair utility, modify a partition table, test a RAID layout or alter metadata, a duplicate of the acquisition image can provide a reversible workspace. If the experiment makes things worse, discard it and start again from the preserved image.

The destination holds extracted files

Recovered files should be written to separate healthy storage. Writing them back onto the source or into the only image risks overwriting data that has not yet been recovered.

Important recoveries may need redundancy

An acquisition image can itself be valuable and expensive to reproduce. If the source is severely degraded or no longer available, keeping more than one verified copy of that image can be justified.

Practical rule

The exact storage arrangement can vary, but keep the roles separate: preserve the source, preserve the acquisition, experiment on something replaceable, and extract elsewhere.