Solutions Products Services Download Order Knowledge Base Support

Deleted files recovery for Microsoft Windows

Windows operating system currently applies two file systems - FAT and NTFS. Lately released ReFS is now available for Windows 8 Server systems only.

FAT file system was developed for an old DOS operating system. Due to design simplicity and low reliability it's mainly used now for memory cards represented in digital cameras, mobile phones and other portable devices.

FAT file system gives rather good chances for recovery of deleted files possibly reduced with file fragmentation. The more the file has been fragmented, the more difficult it is to be recovered. If a file is deleted on FAT by emptying or bypassing recycle bin, the system wipes information about its location. At the same time, the data are not deleted immediately. File recovery is possible only on condition that it has not been overwritten. SysDev Laboratories offer a variety of software products for recovery of deleted files from FAT and specialized software for FAT file system among them - Raise Data Recovery for FAT.

NTFS file system is the main one for Windows. It's a default file system for Windows NT/2000/XP/2003, Windows Vista and Windows 7 versions and the only file system supporting disk partitions over 32GB.

NTFS features one of the best data recovery chances unless the information on the disk is overwritten. The system provides high possibility for exact recovery of deleted files. If a file is deleted on NTFS, its Master File Table record is marked as 'unused'. Bitmap of used space is updated to release used clusters. A file entry is deleted from the directory record. SysDev Laboratories offer the multi-purpose tools to cover even complicated cases of recovery of lost data from NTFS. Raise Data Recovery for NTFS is a product specially created for this file system.

ReFS (Resilient File System) is the latest development of Microsoft presently available for Windows 8 servers. The major purpose of this file system is working with large amounts of data with maximized reliability and increased performance for a data storage system.

File system architecture differs from other Windows file systems and is mainly organized in a form of B+-tree. ReFS has high tolerance to failures due to new features of the system. For instance, Copy-on-Write (CoW) feature: no metadata is modified without being copied; no data is written over the existing ones and into a new disk space. With any file modifications a new copy of metadata is created into any free storage space, and then the system creates a link from older metadata to the newer ones. As a result, a system stores significant quality of older backups in different places providing easy file recovery for non-overwritten storage space. Moreover, the system is capable of constant integrity control to protect itself from failure of all backups at once.

Another feature for the account of overall system reliability is checksums for metadata and for user data (optional). The checksum is automatically updated once the new data appear. This feature allows checking and even correcting errors bringing the system back into consistent state.

Despite all these insurance mechanisms, in practice, the system can still lose data. This may happen, when, for instance, the system isolates some area with corrupted data to ensure uninterruptable volume operation. The file deletion modifies the metadata structure using CoW and marks the area as free for writing. As mentioned above, the system stores huge amount of older backup copies providing good chances for complete data recovery. We recommend UFS Explorer Professional Recovery working with ReFS file systems with a set of all necessary tools and mechanisms to solve the data loss task.

Note: Like any deleted data recovery, file recovery from these file systems is possible before actual disk space is re-used for a new file.

Related articles:
Chances for recovery

Ask a question  Order license  Compare and choose  Download free trial