Home › Hard Drive Data Recovery › Deleted File Recovery
Deleted File Recovery
Deleting a file removes the pointer, not the file. In most cases the data is untouched and sitting exactly where it was — which is why recovery is usually not a problem.
When a file is marked as deleted, its first letter becomes an
_underscore. None of the underlying data is touched. This is true of files removed from the recycle bin, although the operating system will quickly reuse the clusters allocated to that file.
Directory tables, FAT and the MFT
There are structures that are critical to the layout of data on a hard drive of any operating system, be it Windows, Mac or flash drives. If these structures are corrupted your drive will appear empty, appear as RAW, or you will be asked to format it. Recovery of data is usually not a problem in this case.
There are also other structures such as the FAT (file allocation table) and the MFT (Master File Table) stored on the hard drive which contain the location of your data.
The simplest and most common file system is FAT, and consists of a directory table which contains the filename, extension, attributes, file size, time, date and starting cluster. The list of cluster numbers or disk positions is contained in a table called FAT. The table stores these numbers as a linked list, each number indicating a position on the disk. Two copies of the File Allocation Table are kept.
What actually breaks
The directory entry is lost
The file appears gone, however all the data is still there and recoverable. Nothing has been overwritten — the index simply no longer points at it.
The File Allocation Table is corrupt
As we still know the first cluster from the directory table, we can trace a path through the linked list of clusters until we encounter a break in the link. If this occurs there is a very high probability of regaining the lost cluster, based on the way clusters get allocated by the disk drive.
So there it is in a nutshell — it’s never over until a complete examination has been done.
Two recovery scenarios
The document lost at midnight
It’s late at night and you have an important document to get ready by tomorrow. Suddenly the screen freezes. On rebooting your computer you find your document is lost and that operating system files are corrupted or lost due to machine failure or power loss.
You phone your trusty computer whiz, who comes around and tells you nothing can be done except that the operating system needs to be re-installed. Wrong.
If our whiz understood data recovery then he would know there’s a good chance the operating system files can be recovered along with the missing document. All that’s required is an understanding of filesystems and recovery tools.
These sorts of recovery procedures are found in many programs which can be booted off external media, so the drive is never written to during the process.
The honours thesis on a flash drive
Quite often the approach to recovery is to think outside the box, as time is always a factor.
An honours student came to me in desperate trouble because she had used her flash drive, which she transported to and from uni, as her primary storage. I cannot emphasize enough that USB drives are a transport option, not a backup option.
Because of time limitations it was not possible to send the flash drive off for repair. It was, however, possible to examine the laptop she had used to write most of the honours thesis. Although she had opened and closed the file on the USB drive, Microsoft Word writes a backup copy to a temporary location while the file is in use. That file is deleted when Word is closed.
Using recovery tools it was possible to recover all possible Word documents on the laptop and save them to a different drive. Then, using document indexing tools, we were able to recognise the word fragment and recover the bulk of her latest edit.
Some things to note
Basically all you can do is switch the machine off and leave it until you get someone who can fix the problem.
Deleted something important?
The chances of data recovery are high. The examination and quotation are no charge and obligation free.