Reference
Data Recovery Glossary
The terms you hit during a storage failure, in plain English.
Written by the Refindo Recovery Team · Updated
What each one means and why it matters for whether your files come back. Jump to a term from the list, or skim straight through.
RAW drive
RAW is not a file system — it is the label an operating system applies when it cannot recognize a valid one on a partition. Windows shows RAW in Disk Management; macOS shows an unmountable or unformatted volume. The underlying data is usually still present, with only the file system header or partition entry preventing normal access, which is why a RAW drive can often be scanned and recovered.
TRIM
TRIM is a command that tells an SSD which blocks are no longer in use so the controller can erase them in advance for faster future writes. The catch for recovery is that once TRIM clears a deleted block, the data is gone for good. Because TRIM can run within seconds to minutes of a deletion or format, recovering data from an SSD is far more time-sensitive than from a traditional hard drive.
Master File Table (MFT)
The Master File Table is the index at the heart of an NTFS volume. It stores a record for every file — name, size, timestamps, and the location of its data — and keeps a partial backup (the MFT mirror) elsewhere on the disk. When the MFT survives a deletion or format, recovery software can rebuild files with their original names and folder structure; when it is damaged, files are recovered by content instead.
APFS container
On modern Macs, an APFS container is a storage pool that can hold several volumes sharing the same free space. Damage to a single volume often leaves the others intact, but damage to the container itself can hide every volume inside it. Because volume data blocks are stored independently of the container header, files frequently survive even when the structure that indexed them is broken.
File signature (carving)
Every file type begins with recognizable header bytes — a JPEG starts with FF D8 FF, an MP4 carries an ftyp box, a PDF starts with %PDF. When directory records are gone, recovery tools scan the raw disk for these signatures and reconstruct files directly, a technique called file carving. It recovers contiguous files reliably but struggles with fragmented ones, and the original names and folders are usually lost.
found.000 and .chk files
When CHKDSK repairs an NTFS volume, it gathers data clusters that are no longer linked to a valid directory entry into hidden folders named found.000, found.001, and so on, naming each chain FILE0000.CHK and similar. The bytes are intact, but the original names, extensions, and paths are stripped. The .chk files can sometimes be renamed back to a usable extension, or recovered by a tool that reads their content.
Quick format vs full format
A quick format only rewrites the file system structures and marks the space as free, leaving the actual file content in place until new data overwrites it — which is why recovery after a quick format often succeeds. A full format does much more: on modern Windows it also scans for bad sectors and, on some drives, writes across the surface, making recovery far harder or impossible.
Partition table (GPT and MBR)
The partition table is a small map at the start of a disk that records where each partition begins, how large it is, and its type. Older disks use a Master Boot Record (MBR); modern disks use a GUID Partition Table (GPT), which keeps a backup copy and checksums for resilience. A damaged partition table can make a whole volume vanish even though its data is fully intact further into the disk.
Unallocated space
In Disk Management, unallocated space is an area of a disk not currently assigned to any partition. After a partition is lost or deleted, the space it occupied is shown as unallocated — but the volume's own structures and files typically remain there until something writes over them, so a scan can often recover a complete file system from "empty" space.
Bad sector
A bad sector is a region of a drive that can no longer be read reliably. A few bad sectors may only damage individual files, but bad sectors in the file system metadata can make a whole volume unmountable. On a failing drive, bad sectors tend to multiply with continued use, so recovering or imaging the data sooner rather than later protects more of it.
Quick Scan vs Deep Scan
A Quick Scan reads the remaining file system records to list recently deleted or still-indexed files — fast, and it preserves original names and folders. A Deep Scan reads the drive sector by sector and reconstructs files from their signatures, which is slower but finds data after a format, a RAW state, or heavy metadata damage. The usual approach is Quick Scan first, Deep Scan if files are missing.
SMART
SMART (Self-Monitoring, Analysis and Reporting Technology) is built-in drive health reporting that tracks indicators such as reallocated sectors, read-error rates, and spin-up problems. Rising SMART error counts are a strong sign a drive is failing physically rather than suffering a one-time software fault — a cue to recover data immediately and stop relying on the drive.
Matched a term to your problem?
Start from the exact failure in the recovery guides, or scan a drive for free before deciding what to recover.