All the recoveries that come into the lab have a fault of some kind. Some faults are worse than others. There are occasions when a job comes in and the drive is completely fine mechanically meaning that there is either a problem with the data (data is corrupt), or the drive was previously formatted, overwritten or deleted.
If this is the case then we would need to image the original drive as normal so we have a copy, and we would then immediately scan the image to see if the data shows up. The problem is that even if the data that the customer wants is there, it might not be useable as the files might become damaged due to what happened in the first place.
For example if the drive was overwritten with new data and we still managed to find the data from before it was overwritten, then the files wouldn’t be usable as the contents of the files would have been essentially wiped and replaced with new data so there would be no way of obtaining the original contents and structure. In this situation we would perform what we call a “RAW recovery” where we have a better chance of recovering the content of the file but with the downside of having numbered file names instead of keeping the original file names.
If a drive has deleted data then it’s a lot easier for us to try and recover instead of trying to recover data that has been overwritten. Most of the time if data has just been deleted then the content of the file is normally intact, it’s only a few of the files that are damaged.
In conclusion, there are positives and negatives regarding logical recoveries (and pretty much all of the jobs that get sent to us), when we can recover data from a logical recovery then it’s more of an achievement then if we recover data from a drive that is degraded.