How to Validate Recovered Data

How to check whether recovered files are actually usable using structural checks, application-level opening, sampling, hashes and recovery context.

Start with the recovery context

If the source image contains unreadable regions, determine which files intersect them when the recovery tool can provide that information. A file copied without an error message may still contain substituted or missing data from the acquisition stage.

Use format-aware checks where possible

Archives can be tested, many images can be decoded, databases can be checked with their own tools, and structured documents can be parsed. A format-aware check is usually stronger than verifying only that a file has a plausible extension and size.

Open representative samples

For large sets, sample different directories, file types, sizes, dates and source regions. Pay special attention to large or fragmented files and to data recovered from damaged areas.

Hashes answer a narrower question

A hash is excellent for proving that a recovered file has not changed after it was hashed or for comparing it with a known-good copy. Without a known reference, a hash alone cannot tell you whether the recovered contents were originally correct.

Keep the validation result with the recovery

For important jobs, record which checks were performed, which files failed, and which files remain uncertain. This is useful when a recovery set is too large for every file to be manually opened.

Related: Data Recovery Workflow · What Disk Image Preserves · Metadata Vs Raw Recovery