In-place repairs vs. read-only data recovery

There are two significantly different approaches to data recovery, each of those with its own advantages and drawbacks.

In-place repair

In-place repair tools try to fix the filesystem by modifying it to achieve some consistent state. The most widespread example of an in-place repair tool is the Windows "chkdsk" program.

This approach does not require additional disk space.

The drawback of this approach is that in case the repairs are not successful, it may be impossible to return to the original state of the volume and try again. Also, it is possible for the situation to deteriorate further because of the incorrect repair actions. In Google Groups there is an interesting example of chkdsk working wrong way.

More than that, the trend is that the vendors of modern storage devices are less and less likely to choose "pure" filesystems for their devices, instead opting for hybrids of a filesystem and RAID. Such complex systems include Storage Spaces, BTRFS used in modern NETGEAR devices, and BeyondRAID used in Drobo devices. Such hybrid filesystems allow creating very complex configurations and the possibility of successful in-place repair is highly questionable while the consequences of unsuccessful repair are usually disastrous. You can learn more about the specifics of data recovery from BTRFS filesystem at the BTRFS recovery site.

Read-only recovery (data extraction)

Read-only tools do not modify the data on the damaged volume. Instead, they create a copy of the recovered files in the separate location somewhere on the known-good storage.

The read-only approach requires the additional disk space to store the recovered data. Typically, this amount should be no smaller than the total size of files on the damaged volume. Certain additional disk space considerations also apply.

Safety of read-only recovery

Given that there is no "physical" problem with the device you are recovering, the read-only recovery can be performed as many times as needed, possibly using different tools.

If there are bad blocks or, worse yet, some sort of a mechanical problem associated with a single point of failure (e.g. a problem with a read head) then it may be not safe to even read the drive. In this case, typical approach is to make a sector-by-sector copy of the drive into a file (called a "disk image", or "disk image file"). Disk image file provides a stable copy of the data which does not degrade over time. Most if not all data recovery tools allow importing an image file. The downside of this approach is that one more copy needs to be stored, thus doubling the storage requirement. This may quickly become a significant problem especially with RAIDs.

Making the choice

For more valuable data, choose the read-only option. This gives you an unlimited number of attempts if you don't succeed at the first try. For less valuable data, something you do not really worry about, attempt an in-place repair. If it fails, you just declare it the lost case and move on.

If you want to try and recover the unbootable Windows installation without having to reinstall every program, consider taking the disk image first. With the disk image, you can try CHKDSK /f, and if it fails, you still have the image recoverable by read-only means.

With the very large storage (consider a 24x 1TB RAID), read-only recovery may be impractical (mostly due to the cost of the required temporary storage). In this case, there is no choice but to try in-place repair. However, try to positively determine the originating problem and make sure it does not hinder the repair attempt.

Continue to Hardware and disk space.