Firstly, let’s look at some more common data loss scenarios and what can be done:
- Deleted Database: If the deletion is at the file system level as long as the metadata is intact and the data has not been overwritten it is possible to recover the database intact and complete.
- Deleted Rows: the deleted rows can be recovered as long as the table information is intact.
- Deleted Table/Dropped Table: When the table is deleted, the table ID is removed; however, the table can be recovered and put it back into the database.
The important theme above is: has the data not been overwritten. It is therefore vital that immediately after the issue or fault is discovered that the current state of the file system be preserved before any attempts at restoring from a backup or a data recovery is attempted. The file system can be taken offline while the issue is assessed. If taking the file system offline for any significant time is not possible, then make an image of the file system.
Steps to take after discovering the deletion
- Report the discovery by following the company’s incident procedure and take the volume storing the database offline, if possible, or make a clone.
- Assess the situation and formulate a disaster recovery plan with all interested parties. The primary concern is to assess how much data will be lost since the last backup was made, how long it will take to restore from backup and what is the estimated loss to the business of the data base being offline and potentially lost or re-entered.
- Consult with a reputable data recovery provider, like Kroll Ontrack, to see if the database can be recovered intact and how long it will take to get the database back online. Kroll Ontrack has a remote capability that can quickly evaluate the damage and then recover the data if this is the best option to proceed.
Remote Data Recovery
Kroll Ontrack has a unique solution which can help recover corrupted or damaged relational database files called Ontrack Remote Data Recovery technology to get the data back as fast as possible.
The process of a database recovery begins with finding the database file requested. If the database file is inaccessible due to problems with the storage device, then we work to get that data extracted. If the file is missing, deleted or truncated due to problems with the file system, then we work to adjust or repair the file system to correctly point to the data stream of the file. Finally if the file system has no pointers at all to the file, then we search the entire drive looking for database data.
The next stage is to work on the database file itself. This is where the specific database type toolset comes (MSQL, Oracle, NetApps etc). These tools analyse the complex internal structures of the file and provide reports as to what tables are recoverable. The reports also list the number of data rows that are recoverable.
Once the evaluation is complete and authorisation is given to recover the data, our recovery toolset will copy the data into another server database. After this phase is complete, we can backup or archive the recovered data.
Remote Data Recovery is the fastest solution for database recoveries. The Remote Data Recovery process will copy the recovered data into a database server that is setup on your site.
Corrupt File: A database file that cannot be opened by the database engine. Either directly from the customer, after the file has been restored from a tape recovery, or after the file has been copied out after a hard drive recovery.
Deleted File: A database file that has been dropped by the database engine. This is a deleted file recovery first. If the file is not present after a deleted recovery then it is a Lost Page recovery.