Logical (software related) data loss - The device is mechanically working but suffers from a software issue.
The most common causes of logical data loss:
- Formatted device - Formatting alone leaves the data areas (on a sector level) intact despite not being accessible via the operating system.
- Operating system re-installation or reload - Data that was on the device, prior to reinstalling the operating system, and/or applications (with or without formatting) is normally intact (on a sector level).
- Deleted file(s) and/or folder(s) - Accidental or intentionally deleted directories and/or files are normally intact (on a sector level).
- Deleted or corrupt partition(s) - Deleting a partition alone leaves the data areas (on a sector level) intact despite not being accessible via the operating system.
- Data corruption - could be due to number of factors including storage device quality, application quality (e.g. bad programming), memory quality, power stability, incorrectly shutting down devices or applications and incorrect ejection of removable drives.
- Virus-infected or malware - Viruses and malware are malicious software applications that can delete, corrupt or encrypt your data for ransom.
- Hacked - Can originate from inside or outside of your computer or network.
Data can in most cases be recovered and successfully investigated using specialised data recovery and forensic software unless the data areas have been compromised - overwritten, corrupted, encrypted or due to SSD trimming. The success rate would be dependent on the file sizes, file location and fragmentation before the potential data loss scenario, data activity after the incident and type of encryption. The best advice is to stop working, the moment you suspect data loss, and not to attempt to access the advice if you wish to have the best possible chance of recovering or investigation your data loss.