Recovering Deleted/Lost/Missing Data From Novell Servers

When a file is 'deleted', only the first few bytes of that files entry in the Directory Table/Tree are modified to make the file system recognize that file as deleted. Data Recovery software scan the Directory Table/Tree looking for modified entries which have been labeled as 'deleted'. When it finds one, it verifies whether the clusters occupied by this file have been left untouched or whether the clusters have already been overwritten by a new file. If the clusters are still 'free' and have not been reallocated, then this file is recoverable.

This is the reason why an affected disk should be disconnected and not left running as tiny files keep getting generated/updated every few seconds, thus increasing the likelihood of crucial data getting overwritten – it is easy to understand then, why even something as simple as a system restart could turn out to be catastrophic.

Sometimes, however, even the Directory Table/Tree may be corrupt or may have been overwritten. In such cases, data recovery software go into advanced mode and scan the disk cluster by cluster. When the software finds a file, it verifies whether that file's entry exists in the Directory Table/Tree – if it does, then the file is obviously 'visible' to users. However, if an existing file on the disk does not have an associated entry in the Directory Table/Tree, then it is considered to be a lost/missing entry and the software will display this as a 'found' file.

Thus, data can be recovered either by analyzing the Directory table/tree of a file system (to look for deleted files), or by doing a cluster by cluster search of the physical disk (to look for lost/missing files). These two options are given different names (like 'Standard Search' and 'Advanced Search') by different data recovery software.
The next section discusses the recovery process of deleted files and missing/lost NetWare partitions using Stellar Phoenix Novell.

Problems faced in recovering data from compressed/sub-allocated/segmented volumes:

Data recovered from volumes which are compressed, sub-allocated, or segmented presents a few problems.

Compressed Volumes
Data recovery software recover lost data exactly as it was stored in the disk, and the recovered data may be compressed. Data must be decompressed before it can be used. This gives rise to the problem of recovered data being unusable (because it is in a compressed format).

Sub-allocated Volumes
Sub-allocated Volumes are virtual and not 'visible'. Since data recovery software do a physical scan on the hard disk, recovery of lost data from sub-allocated sections of a volume is a problem.

Segmented Volumes
Regular data recovery software can usually scan only one disk at a time, but segmented volumes may be spanned across multiple disks, which is what creates the difficulty in the recovery of segmented volumes.

Effective data recovery software for NetWare requires advanced modules to fully recover data from such volumes while at the same time maintaining the original configuration –