UFS Explorer
HomeContact
  Solutions Products Services Download Order Knowledge Base Support
Knowledge Base
 
 

Deleted files: chances for recovery

    

In the process of any file deletion, both intentional and accidental, the operating system acts to clear storage space for new files marking the space used by previous files free. Luckily, the storage space actually remains occupied by the previous file until the moment of its overwriting with a new one, thus leaving a possibility to retrieve deleted files.

Chances to recover deleted files successfully depend on the file system, as each file system performs file deletion differently. In addition, users can increase data recovery chances by choosing efficient, safe and reliable data recovery software.


Windows file systems

Major Windows file systems include FAT (with FAT32 extension), NTFS and newly developed ReFS for Windows Servers. It's worth emphasizing that data recovery from these file systems – like from any other systems – is possible until the moment of files overwriting.

File system: FAT/FAT32

  • File deletion:a directory record is marked 'unused'. Clusters are marked 'free' that destroys chain of clusters, used by file.

  • Recovery of non-fragmented files: a file name, size and on-disk position remain inside of directory record increasing file recovery chances up to almost 100%.

  • Recovery of fragmented files: a chain of file clusters is destroyed leaving no information about file fragments. Yet, a file name, a file size and start position remain known. With heuristics (trial-and-error method) predicting fragments locations is possible, however, without any guarantees of correctness.

    We recommend to recover files with:
    Raise Data Recovery for FAT
    UFS Explorer Standard Recovery


File system: NTFS

File system: ReFS

  • File deletion: metadata structure is modified with CoW operation marking the area free for new entries.

  • File recovery: the system stores huge amount of older backup copies making data recovery possible with recovery result up to 100%.

    We recommend to recover files with:
    UFS Explorer Professional Recovery



MacOS file systems

Apple Mac OS applies HFS+ file system as a major file system for the Mac computers, iPhone, iPod etc. It is worth emphasizing that data recovery from HFS+, like from any other systems, is possible until the moment of files overwriting.

File system: HFS+



Linux file systems

Modern Linux operating systems use Ext2, Ext3 and Ext4, XFS, ReiserFS, JFS (JFS2) file systems.

File system: XFS

  • File deletion: XFS clears a part of information about a file node and updates a tree of free blocks. Information about file name is disconnected from directory entry.

  • Recovery of non-fragmented files: Using heuristics, it is possible to find file name and file size and position rounded to block. Chances for recovery are close to 100%; whereas chances to retrieve real file name are near 80%.

  • Recovery of fragmented files: File name, size and fragments chain can be retrieved using heuristics. If file data is not damaged, file recovery chances are close to 100%. Chances to get real file name are close to 80%.

    We recommend to recover files with:
    Raise Data Recovery for XFS
    UFS Explorer Standard Recovery


File system: Ext2

  • File deletion: Ext2 marks a file node free and updates a map of free blocks. Information about file name is disconnected from directory entry. The file name to node reference is wiped.

  • Recovery of non-fragmented files: Information about file start and size can remain on the disk. Analysis of nodes can help to recover intact files. At the same time, information about file name is lost.

  • Recovery of fragmented files: Same as for non-fragmented files.

    We recommend to recover files with:
    Raise Data Recovery for Ext2/Ext3/Ext4
    UFS Explorer Standard Recovery


File system: Ext3/Ext4

  • File deletion: The file system wipes a file node and updates map of free blocks. Information about a file name is disconnected from a directory entry, yet it references the right node.

  • Recovery of non-fragmented files: Information about file start and size is destroyed permanently, but may remain in the file system journal. The link between file name and on-disk location lacks. Heuristics and journal analysis enable recovering files completely even with real names.

  • Recovery of fragmented files: Usually, information about the first 12 blocks of a file is missing. There also remains no information about the file name and size. Chances for recovery of a deleted file are quite poor, however, information about most recently deleted files may still remain in file system journal increasing chances to recover a file with a real file name up to 100%.

    We recommend to recover files with:
    Raise Data Recovery for Ext2/Ext3/Ext4
    UFS Explorer Standard Recovery


File system: ReiserFS

  • File deletion: The system updates its S+-tree to exclude a file and renews the map of free space.

  • Recovery of non-fragmented files: S+-tree node may remain on disk (a copy in file system journal and an old copy, created with copy-on-write). In this case file recovery chances are up to 100%.

  • Recovery of fragmented files: Same as for non-fragmented files.

    We recommend to recover files with:
    Raise Data Recovery for ReiserFS
    UFS Explorer Standard Recovery


File system: JFS (JFS2)

  • File deletion: JFS updates the counter of object use and clears the inode in inode use map. The directory is rebuilt to reflect changes.

  • Recovery of non-fragmented files: A file inode remains on the disk increasing chances of files recovery up to almost 100%. Recovery chances are low for the file name.

  • Recovery of fragmented files: Same as for non-fragmented files.

    We recommend to recover files with:
    Raise Data Recovery for JFS
    UFS Explorer Standard Recovery



BSD, Solaris, Unix file systems

These file systems commonly use UFS and UFS2 file systems.

File system: UFS/UFS2

  • File deletion: UFS clears file node and updates a map of free blocks. Information about file name is disconnected from directory entry.

  • Recovery of non-fragmented files: The information about file start and size is destroyed permanently. The link between file name and on-disk location lacks. Heuristics methods make possible to recover good files of known file type. At the same time, you will rarely come across non-fragmented files on UFS due to the specifics of its Soft Updates algorithm.

  • Recovery of fragmented files: The information about the first 12 blocks of a file lacks. There also remains no information about file name and size. Chances to recover deleted files are quite poor, yet possible.

    We recommend to recover files with:
    Raise Data Recovery for UFS
    UFS Explorer Standard Recovery



Clustered file systems

SysDev Laboratories LLC offers data recovery from such file systems as Apple Xsan (CentraVision file system, StorNext file system), RedHat Linux Global File System (GFS), VMware ESX Server Virtual Machine File System (VMFS) as logical data recovery services. If you need to recover data from any of such file systems, contact us and request a remote recovery service.