Solutions Products Services Download Order Knowledge Base Support
 
Knowledge Base
 
 

Chances for recovery

    

In the process of any file deletion, both intentional and accidental, the operating system aims at clearing storage space for new files marking the space used by previous files as “free”. Fortunately, the storage space remains occupied by the previous file until it is
overwritten with a new one, thus leaving the possibility of retrieving deleted files.

Chances to recover deleted files depend on the file system, as each file system conducts file deletion differently. In addition, users can increase data recovery chances by choosing efficient, safe and reliable data recovery software.


Data recovery chances strongly depend on the actual cause of data loss and further user's actions. To get the best possible data recovery result, it is strongly recommended to prevent any possibility of anything being written to the storage and run data recovery software immediately..

  • Data loss caused by file deletion

    Any deleted file remains on the storage until the storage space is reused by other data. After file deletion, an OS may reuse disk space to store a new file. Thus, even a minor piece of information written to the storage can cause permanent data loss. Using a web browser might result in overwriting deleted files through caching or saving cookies to the storage. If you install any software to the same drive, your data can be overwritten as well.

    Another factor that affects data recovery chances after file deletion is the file deletion algorithm of a file system. For Windows NTFS file system recovery chances are quite high: if the file descriptor remains on the disk, the software can easily find all the required information about the file. Unlike NTFS, BSD UFS file system destroys information about file start, location and size permanently and together with a high degree of file fragmentation (typical for this file system) leaves few chances for successful data recovery.

    Other file systems (like FAT) provide average chances for data recovery. Here, the information is destroyed partly (like information about file fragments), but information about the file name, start and size remains on the disk. Heuristic algorithms allow “predicting” file fragments and recover undamaged files. Please, keep in mind, that due to the lack of real information about the allocation of file fragments any data recovery software may fail to detect the actual position of the file, especially if several fragmented files situated close to the same location on the storage were deleted.

    These factors determine using a set of deterministic and heuristic algorithms to predict the location of the deleted file. Please, consider that these algorithms differ from manufacturer to manufacturer and so do the recovery results.


  • Recovery after file system formatting

    After file system formatting, a part of information on the storage is destroyed due to overwriting the space with new information of a new file system. Again, data recovery chances after formatting depend largely on the differences between the original and the new file systems..

    For instance, if a file system is formatted with FAT, it overwrites huge amount of storage space on the disk starting with zeros (empty block allocation tables) and therefore destroying all the previous data. Even if the previous file system was FAT as well, the information about allocation of the previous files will be lost completely. Other file systems usually allocate more or fewer structures to different storage locations.

    Sometimes, recovery chances are higher when the file system is formatted with the same file system type: in case of NTFS overwritten with NTFS data recovery chances are quite high, while FAT overwritten with FAT has worse recovery chances.

    Efficient data recovery software usually gives a satisfying recovery result after file system formatting. Most file systems (except those like FAT) might keep file allocation information, directory records and file names allowing users to reconstruct the file system successfully. However, since new structures are written to the disk, some user information can be damaged and some files or folders can be lost.


  • Recovery after file system damage

    In this case, data recovery software applies the same techniques as in the case of a formatted file system. Data recovery chances depend on the actual file system damage (damage of user files, file folders, file location, file name).


  • Loss of information about partition

    This data loss case is an extremely singular one. Working with this type of damage, data recovery software identifies the file system starting with the known file system structures while scanning the storage. If the loss didn't affect the file system itself, the data can be fully retrieved in its original form.


  • Hardware failure

    Note: Never try to recover data from a failed or failing storage on your own. This can result in permanent data loss. The only exception is RAID systems where storage redundancy allows recovering data completely with the failed unit missing.

    RAID failure might also affect the file system. But if the file system remains intact, your RAID has relatively high data recovery chances. For further information concerning the specifics of data recovery from RAID please refer to RAID systems recovery.


  • Recovery of wiped/overwritten data

    Recovery of wiped and then overwritten data is impossible due to the technology of writing data. The myth about the possibility to recover the lost files that were overwritten is the result of successful attempts to recover data from old floppy disks and hard drives. These devices with storage capacity from kilobytes to megabytes use very wide magnetic trace and simple digital encoding to store information. That is why it was possible to read “traces of data” after wiping or overwriting by calibrating read “head” sensitivity and position.

    Modern systems use very thin tracks, high precision of head calibration and extremely high signal frequency near to the top of technology limit. Performance of modern chips only allows picking a good discrete signal from a disk platter and never identifies any 'signal traces'. This scheme is impossible for any digital device as discreet signal frequency to handle such data lies much beyond the theoretical limit of electronic circuits.

    Thus, the companies that claim to be able to recover data this way are not to be trusted.