Data recovery glossary

30 terms defined by our laboratory engineers. Every entry has a stable anchor so it can be linked and cited directly.

Actuator

The pivoting arm assembly inside a hard drive that positions the read/write heads over the platters. A seized or misaligned actuator prevents the drive from reading any data and requires laboratory disassembly.

Bad sector

A sector the drive can no longer read reliably. Bad sectors may be physical (surface damage) or logical (a failed error-correction check). Repeated read attempts across bad sectors accelerate media degradation.

BitLocker

Microsoft's full-volume encryption. Data recovered from a BitLocker volume remains encrypted until the recovery key or password is supplied; without it the recovered blocks cannot be decoded.

Chain of custody

A documented, unbroken record of who handled a piece of evidence, when, and why. Required when recovered data may be presented in a legal proceeding.

Clicking (click of death)

A repeating click produced when the heads fail to locate servo data and the actuator resets. It indicates a physical fault. Continuing to power the drive typically increases platter damage.

Controlled laboratory environment

A filtered, particulate-controlled workspace used to open sealed drives. Opening a drive outside such an environment allows airborne particles onto the platter surface, which the flying heads then drag across the media.

Controller

The processor on an SSD, flash drive, or memory card that maps logical addresses to physical NAND blocks. When a controller fails, the raw NAND may be intact but unreadable without reconstructing its translation layer.

Degaussing

Exposing magnetic media to a strong alternating magnetic field to erase it. Degaussing is permanent and destroys the servo information, making the drive both unrecoverable and unusable.

Degraded array

A RAID set still serving data but with less redundancy than its level provides, because one or more members have failed or dropped out. A degraded array has no margin for a further failure.

ECC (error-correcting code)

Redundant data stored alongside each sector or NAND page so a limited number of bit errors can be corrected on read. When errors exceed the ECC budget, the sector is reported unreadable.

Firmware / service area

Manufacturer code and adaptive parameters stored in a reserved region of the drive itself (the service area), separate from user data. Corrupted firmware can make a mechanically healthy drive appear dead or report zero capacity.

Forensic image

A bit-for-bit copy of a storage device, including unallocated space, captured through a write blocker and verified with a hash. All examination work is performed on the image, never on the original.

Head crash

Contact between a read/write head and the platter surface while the platter is spinning. It removes magnetic coating and can render the affected tracks permanently unreadable.

Hot spare / hot swap

A standby drive that a RAID controller automatically rebuilds onto when a member fails. If the array was already degraded or a second drive is marginal, an automatic rebuild can overwrite recoverable data.

Logical failure

Data loss where the hardware works but the file system, partition table, or metadata is damaged — deletion, formatting, corruption, or a failed operating-system upgrade.

NAND flash

The non-volatile memory used in SSDs, USB drives, and memory cards. NAND cells wear with each program/erase cycle and lose charge over long unpowered storage periods.

Over-provisioning

Spare NAND capacity an SSD reserves for wear levelling, garbage collection, and bad-block replacement. It is invisible to the operating system but visible to chip-level analysis.

Parity

Redundant information calculated across RAID member drives so the contents of a missing drive can be reconstructed. Parity protects against drive loss, not against deletion, corruption, or ransomware.

Physical failure

Data loss caused by hardware damage — failed heads, seized motor, electronics failure, controller failure, water damage, fire, or impact. Physical failures require laboratory intervention.

Platter

The rigid magnetic disk inside a hard drive that stores data. Platters are read by heads flying a few nanometres above the surface without touching it.

RAW recovery / file carving

Recovery by scanning for file signatures rather than reading the file system. It can retrieve file contents when metadata is destroyed, but original filenames and folder structure are usually lost.

Reallocated sector

A sector the drive has retired and remapped to spare capacity after read or write failures. A rising reallocated-sector count in SMART data indicates progressive surface degradation.

Secure erase / sanitisation

A deliberate command that purges user data — ATA Secure Erase on a hard drive, or a cryptographic-key purge on a self-encrypting SSD. Correctly executed sanitisation is not reversible.

SMART

Self-Monitoring, Analysis and Reporting Technology: counters a drive maintains about its own health. SMART can warn of degradation, but a passing SMART status does not mean a drive is healthy.

Spin-up failure

The platters do not reach operating speed, usually due to seized bearings or heads stuck on the platter surface. Repeated power cycling in this state causes additional damage.

Stripe size / block size

The amount of contiguous data written to one RAID member before the controller moves to the next. Reconstructing an array requires the correct stripe size, member order, parity rotation, and start offset.

TRIM

A command that tells an SSD which blocks the file system no longer needs, so they can be erased in advance. Once TRIM has processed a deleted file, its contents are generally gone permanently.

Wear levelling

The controller's distribution of writes across NAND blocks to equalise wear. It means a logical file's data may be scattered across physical locations that only the translation layer can resolve.

Write blocker

Hardware or software that permits reads from a device while blocking every write, so the evidentiary state of the original media is preserved during acquisition.

Zero-fill

Overwriting every addressable sector with zeros. On a hard drive this destroys the previous contents of those sectors; recovery afterwards is not possible.