Solutions Products Services Download Order Knowledge Base Support
 
Knowledge Base
 
 

OS recovery specifications

    

File system (disk) formatting is an operation which initializes a file system on a disk or disk partition and prepares it for storing files. With file system formatting a storage starts its life and operation. Once file system is created, work with the storage can be started.

At the same time, accidental file system formatting may lead to loss and damage of existing file system information. Each file system acts in its own way during formatting predetermining chances for data recovery from an over-formatted storage or partition.

Further information may be helpful concerning the ways to assess data recovery perspectives after file system formatting over the same file system.


Windows file systems

Major Windows file systems include FAT (with FAT32 extension), NTFS and newly developed ReFS for Windows Servers. It's worth emphasizing that data recovery from these file systems – like from any other systems – is possible until the files are overwritten.

File system: FAT/FAT32

  • File deletion: A directory record is marked "unused". Clusters are marked "free" which destroys the chain of clusters, used by the file.

    • Recovery of non-fragmented files:A file name, size and on-disk position remain inside the directory record increasing file recovery chances up to almost 100%.

    • Recovery of fragmented files:A chain of file clusters is destroyed leaving no information about file fragments. Yet, a file name, file size and start position remain known. With heuristics (the trial-and-error method) predicting fragments locations is possible, however, without any guarantees of correctness.

  • Formatting: A file allocation table is destroyed. A new root folder is created.

    • Recovery of non-fragmented files:A file name, size and on-disk position remain inside of the directory record increasing file recovery chances up to almost 100%.

    • Recovery of fragmented files:A chain of file clusters is destroyed leaving no information about file fragments. Yet, a file name, file size and start position remain known. With heuristics (the trial-and-error method) predicting fragments locations is possible, however, without any guarantees of correctness.

    We recommend to recover files with:
    Raise Data Recovery for FAT
    UFS Explorer Standard Recovery

File system: NTFS

  • File deletion: The Master File Table record is marked as "unused". A bitmap of used space is updated to clear used clusters. A file entry is deleted from the directory record.

    • File recovery:A file name, size and on-disk position remain inside the Master File Table record increasing file recovery chances up to almost 100%.

  • Formatting: The Master File Table record is marked “unused”. The bitmap of used space is updated to release used clusters. A file entry is deleted from the directory record.

    • Recovery of non-fragmented files:A file name, size and on-disk position remain inside the Master File Table record increasing file recovery chances up to almost 100%.

    • Recovery of fragmented files:Information about a file name, size and fragments chain remains inside the Master File Table record increasing file recovery chances up to almost 100%. Recovery chances are lower for very fragmented files.

    We recommend to recover files with:
    Raise Data Recovery for NTFS
    UFS Explorer Standard Recovery
    UFS Explorer RAID Recovery
    UFS Explorer Professional Recovery

File system: ReFS

  • File deletion: Metadata structure is modified with CoW operation marking the area free for new entries.

    • File recovery:The system stores huge amount of older backup copies making data recovery possible with a recovery result up to 100%.

    We recommend to recover files with:
    UFS Explorer Professional Recovery



MacOS file systems

Apple MacOS applies HFS+ file system as a major file system for the Mac computers, iPods etc. It is worth emphasizing that data recovery from HFS+, like from any other system, is possible until the moment files are overwritten.

File system: HFS+

  • File deletion: The file system wipes data from B-Tree metadata records (B-Tree is a tree data structure that keeps stored data and in which a node can have more than two children) about the file and updates the map of free space.

    • File recovery: A file name, size and on-disk position are wiped; however, the file system journal may still contain this information allowing to recover good files. Using IntelliRAW™ increases chances to recover lost information, however, file name information can be lost.

    We recommend to recover files with:
    Raise Data Recovery for HFS+
    UFS Explorer Standard Recovery
    UFS Explorer RAID Recovery
    UFS Explorer Professional Recovery



Linux file systems

Modern Linux operating systems use Ext2, Ext3 and Ext4, XFS, ReiserFS, JFS (JFS2) file systems.

File system: XFS

  • File deletion: XFS clears a part of information about the file node and updates the tree of free blocks. Information about file name is disconnected from the directory entry.

    • Recovery of non-fragmented files: Using heuristics, it is possible to find the file name and size and the position rounded to block. Chances for recovery are close to 100%; whereas chances to retrieve the real file name are almost 80%.

    • Recovery of fragmented files: The file name, its size and the fragment chain can be retrieved with heuristics. If file data is not damaged, file recovery chances are close to 100%. Chances to get the real file name are close to 80%.

  • Formatting: XFS destroys the map of used clusters and creates a new root directory. File allocation groups are updated as well.

    • Recovery of non-fragmented files: Information about user files remains on the disk. Chances for recovery are close to 100%; whereas chances to retrieve the initial file name are close to 95%.

    • Recovery of fragmented files: The same as for non-fragmented files.

    We recommend to recover files with:
    Raise Data Recovery for XFS
    UFS Explorer Standard Recovery

File system: Ext2

  • File deletion: Ext2 marks a file node as “free” and updates the map of free blocks. Information about a file name is disconnected from directory entry. A file name to node reference is wiped.

    • Recovery of non-fragmented files: Information about a file start and size can remain on the disk. The analysis of nodes can help to recover intact files. At the same time, information about a file name is lost.

    • Recovery of fragmented files: Same as for non-fragmented files.

  • Formatting: All allocation groups as well as file nodes are wiped.

    • Recovery of non-fragmented files: Complete recovery of files is possible with heuristics, without the initial file names though.

    • Recovery of fragmented files: Recovery of undamaged files is possible only with applying heuristics. However, the initial file names will be lost.

    We recommend to recover files with:
    Raise Data Recovery for Ext2/Ext3/Ext4
    UFS Explorer Standard Recovery

File system: Ext3/Ext4

  • File deletion: The file system wipes a file node and updates the map of free blocks. Information about a file name is disconnected from a directory entry, yet it references the right node.

    • Recovery of non-fragmented files: Information about file start and size is destroyed permanently, but may remain in the file system journal. The link between a file name and on-disk location lacks. Heuristics and journal analysis enable recovering files completely keeping the initial names of the files.

    • Recovery of fragmented files: Usually, the information about the first 12 blocks of a file is missing. There also remains no information about a file name and size. Chances for recovery of deleted files are quite poor, however, the information about most recently deleted files may remain in the file system journal increasing chances to recover a file with the initial file name up to 100%.

  • Formatting: All allocation groups, as well as file nodes, are wiped. Depending on a driver, the file system journal may still contain information about some most recently created files.

    • Recovery of non-fragmented files: Recovery of undamaged files is possible only by applying advanced heuristics and journal analysis; however, in most cases the initial file names cannot be retrieved.

    • Recovery of fragmented files: Only advanced heuristics and journal analysis allow recovering files completely, however, in most cases the initial file names are lost.

    We recommend to recover files with:
    Raise Data Recovery for Ext2/Ext3/Ext4
    UFS Explorer Standard Recovery

File system: ReiserFS

  • File deletion: The system updates its S+-tree to exclude a file and renews the map of free space.

    • Recovery of non-fragmented files: An S+-tree node may remain on the disk (a copy in the file system journal and an old copy, created with copy-on-write). In this case file recovery chances are up to 100%.

    • Recovery of fragmented files: The same as for non-fragmented files.

  • Formatting: The file system creates a new S+-tree over the existing one.

    • Recovery of non-fragmented files: An S+-tree node may remain on the disk (a copy in the file system journal and an old copy, created with copy-on-write). In this case file recovery chances are close to 100%.

    • Recovery of fragmented files: The same as for non-fragmented files.

    We recommend to recover files with:
    Raise Data Recovery for ReiserFS
    UFS Explorer Standard Recovery

File system: JFS (JFS2)

  • File deletion: JFS updates the counter of object use and clears the inode in the inode use map. The directory is rebuilt to reflect changes.

    • Recovery of non-fragmented files: The file inode remains on the disk increasing chances of files recovery up to almost 100%. The file name is unlikely to be recovered though.

    • Recovery of fragmented files: The same as for non-fragmented files.

    We recommend to recover files with:
    Raise Data Recovery for JFS
    UFS Explorer Standard Recovery



BSD, Solaris, Unix file systems

These file systems commonly use UFS and UFS2 file systems.

File system: UFS/UFS2

  • File deletion: UFS clears the file node and updates the map of free blocks. Information about a file name is disconnected from a directory entry.

    • Recovery of non-fragmented files: The information about file start and size is destroyed permanently. The link between a file name and on-disk location lacks. Heuristic methods make possible to recover good files the type of which is known. At the same time, you will rarely come across non-fragmented files on UFS due to the specifics of its Soft Updates algorithm.

    • Recovery of fragmented files: The information about the first 12 blocks of a file lacks. There also remains no information about a file name and size. Chances to recover deleted files are quite poor, yet it is possible.

  • Formatting: All allocation groups, as well as file nodes, are wiped.

    • Recovery of non-fragmented files: Complete recovery of files is possible with heuristics, without the initial file names though.

    • Recovery of fragmented files: Recovery of undamaged files is possible only with applying heuristics. However, the initial file names will be lost.

    We recommend to recover files with:
    Raise Data Recovery for UFS
    UFS Explorer Standard Recovery



Clustered file systems

SysDev Laboratories LLC offers data recovery from such file systems, as Apple Xsan (CentraVision file system, StorNext file system), RedHat Linux Global File System (GFS), VMware ESX Server Virtual Machine File System (VMFS). If you need to recover data from any of these file systems, contact us and request a remote recovery service.