Why Deleted Files Can Be Recovered?

Dec 31,2019 • Filed to: Answer Hard Drive Problems • Proven solutions

0
With the influx of relatively affordable data recovery software on the market, haven’t you ever wondered how these light but powerful software recover missing or lost data? Before we answer this, it’s prudent to have a brief overview of what your Windows does when a file is deleted.

1.How Windows Deletes Files?

A sector is the tiniest unit accessible on a disk. Well, your files are stored as blocks of data on these sectors and they can be placed in one of two ways: Scattered randomly all over the hard drive’s surface or more organized and placed sequentially.

Sector placement is determined by the manner in which free blocks were arranged at the moment a file was saved on the disk. It’s possible your system won’t be able to identify uninterrupted sector blocks large enough for the file to be saved on them via a continuous process. If such a thing happens, then your system will break up the file and write each part into free blocks.

Your Windows OS saves the files on your drive and catalogs them in the file system, which in turn keeps the records of the attributes, names, and sizes of the data on the drive. It also keeps the exact location of the data on the drive, and that’s perhaps the most important of them all.

Scattered randomly all over the hard drive
Scattered randomly all over the hard drive

Here’s something you might not be aware of:

  • Anytime you delete a file, Windows doesn’t really get rid of the file, no; it doesn’t even alter the original data at all.
  • Our Windows merely alters the corresponding record in the file system to label the file as being ‘deleted’.
  • Both the file system and data aren’t erased.Deleted files are still on your system.

So anytime you delete a file, Windows only makes a change to the file’s record in the file system, which then ‘frees up’ the space occupied by the file and marks it as being available. Even though the real data is still in the said space, your operating system designates it as being available for use. But this is just temporary because anytime your system is need of space to write another file, it will utilize the available space and save a different file inside it. That’s when the actual data is truly gone for good.

But prior to all this, the data of the file you delete is still resting in your system, perfectly capable of being recovered. That’s what makes it possible for data recovery software to get all your deleted files back.

2. How Tools Undelete Files

Simply speaking, the new disk is a newly bought notebook, which is empty. When we try to record something, we just choose an empty page and write down. This process is simple and clear. However, when full of contents after a period, the notebook would be difficult to use when we try to find certain content. Then we would introduce a catalog to manage these contents. The catalog is quite similar to the file system, which helps us locate the certain data in the disk.

Now we could understand the process of accessing data.:

Step 1: Acquire the corresponding file catalog.

Step 2: Locate the storage space according to the catalog.

The absence of any step would cause data loss or corruption

We could learn these two data loss scenarios via two cases.

Case 1: File Deletion

If the file catalog lost, the file would be invisible, which is the process of file deletion. In most cases, the system just erases the location information of the file or mark the file as deleted. let's take a notebook as an example, when we revise page 35 into page *5, we have to check all the 5-ended page to locate page 35 again. With the professional tool and enough time, we could definitely locate the correct page and retrieve the deleted data. This is the technical core of data recovery technology.

Case 2: Hardware malfunction

The reasons will be very complicated if your data gets lost because of the hardware faults. For example, the storage device itself is corrupted, the hard disk platter bad sectors, the burned chip, etc. In the second scenario, it will be much more difficult to recover data. You might need some necessary hardware equipment.

If the storage media itself, like hard disk platter and flash memory, is intact, you still stand a good chance of recovering lost data. Usually, we regard the corruption of the storage device as physical damage, while the problems not related to the storage device as logical failure.

Take the textbook. The sudden rain soaks your textbook heavily. It becomes damaged physically and is not able to be opened any more. Another case is that you think that the content in a certain page is no longer important, or has been marked as "deleted" in the system. You want to write something else in the page, but have no extra free space. So you erase all the content in the page with an eraser and write something new down. The operation is the so-called data overwriting. In the case, even if there is the same file directory, the files are not the original ones present the same location. It is true of our hard disk. When the area is considered as the deleted one by the computer, everyone can write new data to the place.

Therefore, when you lost your important data, use your device CAUTIOUSLY! Do not write any new data in the device where data loss happens. The overwriting can result in the failure of data recovery to a large extent.

David Darlington

staff Editor

0 Comment(s)
Home > Resources > Answer Hard Drive Problems > Why Deleted Files Can Be Recovered?