Reference
Data Recovery Glossary
The terms you hit during a storage failure, in plain English.
Written by the Refindo Recovery Team · Updated
What each one means and why it matters for whether your files come back. Jump to a term from the list, or skim straight through.
RAW drive
RAW is not a file system. It is the label an operating system applies when it cannot recognize a valid one on a partition. Windows shows RAW in Disk Management; macOS shows an unmountable or unformatted volume. The underlying data is usually still present, with only the file system header or partition entry blocking normal access, which is why a RAW drive can often be scanned and recovered.
TRIM
TRIM is a command that tells an SSD which blocks are no longer in use so the controller can erase them in advance for faster future writes. The catch for recovery is that once TRIM clears a deleted block, the data is gone for good. Because TRIM can run within seconds to minutes of a deletion or format, recovering data from an SSD is far more time-sensitive than from a traditional hard drive.
Master File Table (MFT)
The Master File Table is the index at the heart of an NTFS volume. It stores a record for every file (name, size, timestamps, and the location of its data) and keeps a partial backup, the MFT mirror, elsewhere on the disk. When the MFT survives a deletion or format, recovery software can rebuild files with their original names and folder structure; when it is damaged, files are recovered by content instead.
APFS container
On modern Macs, an APFS container is a storage pool that can hold several volumes sharing the same free space. Damage to a single volume often leaves the others intact, but damage to the container itself can hide every volume inside it. Because volume data blocks are stored independently of the container header, files frequently survive even when the structure that indexed them is broken.
File signature (carving)
Every file type begins with recognizable header bytes. A JPEG starts with FF D8 FF, an MP4 carries an ftyp box, a PDF starts with %PDF. When directory records are gone, recovery tools scan the raw disk for these signatures and reconstruct files directly, a technique called file carving. It recovers contiguous files reliably but struggles with fragmented ones, and the original names and folders are usually lost.
found.000 and .chk files
When CHKDSK repairs an NTFS volume, it gathers data clusters that are no longer linked to a valid directory entry into hidden folders named found.000, found.001, and so on, naming each chain FILE0000.CHK and similar. The bytes are intact, but the original names, extensions, and paths are stripped. The .chk files can sometimes be renamed back to a usable extension, or recovered by a tool that reads their content.
Quick format vs full format
A quick format only rewrites the file system structures and marks the space as free, leaving the actual file content in place until new data overwrites it, which is why recovery after a quick format often succeeds. A full format does much more: on modern Windows it also scans for bad sectors and, on some drives, writes across the surface, making recovery far harder or impossible.
Partition table (GPT and MBR)
The partition table is a small map at the start of a disk that records where each partition begins, how large it is, and its type. Older disks use a Master Boot Record (MBR); modern disks use a GUID Partition Table (GPT), which keeps a backup copy and checksums for resilience. A damaged partition table can make a whole volume vanish even though its data is fully intact further into the disk.
Unallocated space
In Disk Management, unallocated space is an area of a disk not currently assigned to any partition. After a partition is lost or deleted, the space it occupied shows up as unallocated, but the volume's own structures and files typically stay there until something writes over them, so a scan can often recover a complete file system from "empty" space.
Bad sector
A bad sector is a region of a drive that can no longer be read reliably. A few bad sectors may only damage individual files, but bad sectors in the file system metadata can make a whole volume unmountable. On a failing drive, bad sectors tend to multiply with continued use, so recovering or imaging the data sooner rather than later protects more of it.
Quick Scan vs Deep Scan
A Quick Scan reads the remaining file system records to list recently deleted or still-indexed files. It is fast and it preserves original names and folders. A Deep Scan reads the drive sector by sector and reconstructs files from their signatures, which is slower but finds data after a format, a RAW state, or heavy metadata damage. The usual approach is Quick Scan first, Deep Scan if files are missing.
SMART
SMART (Self-Monitoring, Analysis and Reporting Technology) is built-in drive health reporting that tracks indicators such as reallocated sectors, read-error rates, and spin-up problems. Rising SMART error counts are a strong sign a drive is failing physically rather than hitting a one-time software fault, and a cue to recover data right away and stop relying on the drive.
File system header
The file system header is the small structure at the start of a volume that tells the operating system what kind of file system it is (NTFS, exFAT, APFS, and so on) and how to read it. When that header is damaged or overwritten, the OS can no longer mount the volume and often labels it RAW or offers to format it, even though the files underneath are usually intact. Recovery reads past the broken header to rebuild the data.
Boot sector
The boot sector is the first sector of a volume and holds key parameters the file system needs before it can mount, such as cluster size and the location of core structures. exFAT and FAT keep a backup copy as well. A single corrupted boot sector can make a whole volume unreadable, which is why a scan that reads past it, or uses the backup copy, can often still recover the data.
Cluster
A cluster (or allocation unit) is the smallest block of space a file system assigns to a file, typically several sectors grouped together. Files are stored across one or more clusters, and when a file is deleted those clusters are marked free for reuse. Recovery works by finding the clusters that still hold a deleted file before new data is written into them.
Journaling
A journaling file system, like NTFS or APFS, keeps a log of pending changes so it can recover to a consistent state after a crash or power loss. It protects the file system structure, not your individual files, and lighter file systems like FAT32 and exFAT have no journal, which is why an unsafe removal can leave them corrupted with no automatic repair.
Garbage collection
Garbage collection is background housekeeping an SSD controller runs to reclaim and erase blocks that are no longer in use, keeping future writes fast. Together with TRIM, it is why deleted data on an SSD can disappear within minutes: once the controller clears a freed block, the old contents are gone for good, so SSD recovery is far more time-sensitive than on a hard drive.
Wear leveling
Wear leveling is how an SSD spreads writes across all its memory cells so no single area wears out early. A side effect is that the drive constantly remaps where data physically lives, which is part of why low-level recovery on SSDs is harder than on hard drives and why a healthy, readable file system matters more for getting data back.
DCIM folder
DCIM (Digital Camera Images) is the standard folder cameras, phones, and drones use to store photos and video on a memory card, usually in numbered subfolders like 100CANON. When a card reads as empty or the DCIM folder is gone after an error, the media is often still on the card behind a damaged directory, and a scan can rebuild it.
Disk image
A disk image is a sector-by-sector copy of an entire drive saved as a file. Imaging a failing drive once, then working from the image, avoids stressing the original with repeated reads, which is the approach data recovery labs use on drives that are physically unstable. For healthy drives, a normal scan is enough and imaging is not required.
Matched a term to your problem?
Start from the exact failure in the recovery guides, or scan a drive for free before deciding what to recover.