Chances to recover data

Data loss often comes with a sense of uncertainty, leaving us wondering why it happened, what to do next and whether recovery is even possible. Fortunately, in most cases, the storage space occupied by the lost files remains untouched until new data overwrites them. This means that most data loss scenarios are recoverable – at least for a certain time. However, the recovery potential also depends on several critical factors, including the cause of data loss, the steps taken immediately after it and the methods used for data recovery. Understanding these factors enables you to develop a more informed recovery strategy and improve the chances of getting those files back.

Cause of data loss

The answer to the question whether data recovery is possible depends heavily on the actual cause of data loss. Determining what led to the issue – be it accidental deletion, formatting, file system corruption or physical damage – plays a crucial role when estimating the odds for successful recovery. Below, you can evaluate the recovery potential for some of the most common scenarios:

Hint: The information about the most typical causes of data loss is available in the article explaining the principles of data recovery.

• Data loss caused by file deletion

  Any deleted file remains on the storage until the space it occupies is reused by other data. After deletion, the operating system may use the very same portion of disk space to save a new file. Thus, even a minor piece of information written to the digital medium may cause permanent data loss. Using a web browser might result in overwriting deleted files through caching or saving cookies to the storage. If you install any software to the same drive, your data can be overwritten as well.

  Another factor that affects the prospect of data recovery after deletion is the file deletion algorithm of a file system. For the Windows NTFS file system, the chances of a positive outcome are quite high: if the file descriptor remains on the disk, data recovery software can easily find all the required information about the file. Unlike NTFS, the UFS file system of BSD and other Unix derivatives permanently destroys the information about the file’s start, location and size and, together with a high degree of file fragmentation (typical for this file system), leaves few chances for successful data recovery.

  Other file systems (like FAT) provide average chances for data recovery. Here, the information is destroyed partly (like the information about file’s fragments), but the information about the file’s name, start and size remains on the disk. Heuristic algorithms allow "predicting" the placement of file’s fragments and recovering undamaged files. However, owing to the lack of real information about the allocation of file fragments, data recovery software may fail to detect the actual position of the file, especially if several fragmented files situated close to the same location on the storage were deleted.

  Hint: To learn more about file systems and their types, please, refer to the basics of file systems.

  These factors require the use of specific deterministic and heuristic algorithms to predict where a deleted file might be located on a storage device. Such algorithms may vary significantly from one data recovery software provider to another, which leads to different recovery results.

  Hint: Please rely on the following guide if you need to recover accidentally deleted files.

• Recovery after file system formatting

  When formatting is performed, the process typically involves overwriting certain parts of information stored on the drive, preparing it to use the structure of a new file system. As a result, some data may be destroyed if the storage space previously occupied by the old file system is overwritten with data belonging to the new file system. In view of this fact, data recovery chances after formatting depend largely on the differences between the original and the new file systems.

  For instance, if a storage gets formatted with FAT, this file system overwrites a huge amount of storage space on the disk starting with zeros (empty block allocation tables) and therefore destroys all the previous data. Even if the previous file system was FAT as well, the information about the allocation of previous files will be lost completely. Other file systems usually allocate more or fewer structures to different storage locations.

  In some cases, data recovery chances are higher when the file system is formatted with the same file system type: in case of NTFS overwritten with NTFS, the possibility of successful data recovery is quite high, while FAT overwritten with FAT has worse data recovery chances.

  Efficient data recovery software usually gives a satisfying recovery result after file system formatting. Most file systems (except for those like FAT) might keep the information about the allocation of files, directory records and file names, allowing data recovery utilities to successfully reconstruct the file system. However, since new structures are written to the disk, some user data may be damaged, and certain files or folders are likely to be irreversibly lost.

• Recovery after file system damage

  In this case, data recovery software applies similar techniques to those used in the case of a formatted file system. Data recovery chances depend on the type of information affected by file system damage (damage to user files, folders, file location information or file names).

• Loss of information about a partition

  This type of data loss may be considered the most optimistic one. The system may be unable to locate a partition due to corruption of the partition table or structure, while the data within the partition often remains intact. In that event, data recovery software needs to scan the storage device and identify the file system structure. For this, it looks for known file system patterns that help it detect the starting point of the file system. If the loss hasn't impacted the file system itself, the data can be fully retrieved in its original form.

• Hardware failure

  When the physical components of a storage device fail due to factors like mechanical damage, natural wear, electrical surges or overheating, the chances of data recovery will be determined by the nature and severity of the failure. That is why such a device should be brought to a data recovery service center for evaluation. In some cases, professionals may still be able to retrieve the data after repairing or replacing the damaged parts in a special clean room environment. However, you should never try to recover data from a failed or failing storage on your own. DIY repair attempts usually result in permanent data loss.

  The only exception to this is a RAID system where redundancy allows for complete data recovery from the remaining units, even when one of the drives fails (or more, depending on the RAID configuration. In some cases, a RAID failure might also affect the file system. But if the file system remains intact, a RAID set has relatively high data recovery chances. For further information concerning the specifics of data recovery from RAID, please refer to the organization and recovery of data on RAID.

• Recovery of wiped/overwritten data

  As mentioned earlier, overwriting occurs when new data occupies the storage space previously allocated to the lost files. It may be caused by new data written to the same storage device, specific patterns used by shredding or secure erasure utilities, zeros written during a full formatting operation or the TRIM command triggered by SSDs.

  Recovery of wiped or overwritten data is impossible due to the way data is written on modern storage devices. The myth about the possibility to recover lost files that were overwritten stems from successful attempts to recover data from old floppy disks and hard drives. These devices, with storage capacities from kilobytes to megabytes, used very wide magnetic trace and simple digital encoding to store information. As a result, it was possible to read "traces of data" after wiping or overwriting by adjusting the sensitivity and position of the read head.

  Modern digital media use very thin tracks, high precision of head calibration and extremely high signal frequency that are close to the theoretical limits of technology. The performance of modern chips only allows picking a good discrete signal from a disk platter, but it is not capable of detecting any "signal traces". This scheme is impossible for any digital device, as the discreet signal frequency required to handle such data lies well beyond the theoretical limit of electronic circuits. Therefore, companies claiming to be able to recover overwritten data are not trustworthy.

Actions taken after data loss

Apart from the described objective factors, further user actions may also improve or decrease the likelihood of retrieving the lost files. In this respect, it is strongly recommended to prevent any possibility of writing to the affected storage, which may not always be immediately apparent. This includes:

• Continued use of the storage device

  Once data loss is discovered, it’s crucial to stop using the storage device right away. Writing new data to the same drive, even inadvertently, will overwrite the space occupied by the lost files, making them irrecoverable. It is also worth noting that, unlike secondary partitions, the system partition is constantly subject to background operations, essential to keep the OS functional. These operations are indispensable, yet, they increase the risk of overwriting the missing data, even if the computer stands idle. For this reason, if data loss has occurred on the OS partition, it is highly advisable to shut down the computer, disconnect the drive and use another PC for data recovery, or run the same machine using a bootable USB drive (Live CD). Such an approach helps to minimize the risk of further damage to the lost files.

• Attempts to fix issues with the storage

  When the user attempts to correct storage errors or inconsistencies, for example, by applying system repair tools, like chkdsk or fsck, reinstalling the OS or performing any other fixes, they always risk writing data directly to the problem drive. The thing is that any inexpert manipulations with the device can further complicate the recovery process or even make data recovery impossible. So, it's important to avoid trying to resolve any issues until data recovery is completed and the necessary files are copied to another location.

• Formatting or resetting the device

  Formatting or resetting the device creates a significant obstacle to data recovery. This is especially true when dealing with complex storage systems, such as RAID. In this case, it is crucial not to attempt rebuilding or adjusting the configuration. Improper actions can result in significant data overwriting, which will permanently damage the information. So, it's vital to refrain from any operations that could somehow alter the storage setup.

• Saving the recovered data to the same storage

  When restoring lost files, it’s critical not to save the recovered data to the same drive or partition from which it was lost. By doing so, it is possible to overwrite parts of the lost files right in the process and make them irretrievable, even before they are copied. Therefore, to preserve their integrity, the obtained files must always be saved to a different storage device.

Methods used for data recovery

Generally speaking, data recovery can be addressed in two primary ways: using a software-based approach or by repairing/replacing damaged hardware components in a laboratory environment. Selecting the most appropriate of these two methods may also influence the prospects for a successful procedure.

• Physical data recovery

  This method is used in more severe cases where physical damage to the storage device is taking place, such as mechanical failures, electrical issues or negative effects of environmental factors. The problem is that when the drive’s physical components stop functioning correctly, attempting data recovery without proper tools and expertise is unlikely to bring any results and will cause irreparable damage to the device. Therefore, only professionals with specialized equipment can handle it without aggravating the situation.

• Logical (software-based) data recovery

  In other cases, data recovery can be performed using specialized data recovery utilities, able to scan the storage and interpret or restore its logical structure. These tools retrieve lost or deleted files from the device and provide it to the user for further copying, without the need to deal with the hardware. The choice of data recovery software usually depends on several factors, including the type of storage medium, the file system format and the user’s technical skills.

  In particular, UFS Explorer and Recovery Explorer can be recommended as effective and reliable software solutions for logical data recovery in a variety of data loss scenarios. Both programs are designed to recover deleted, lost or inaccessible files from a wide range of storage devices, including desktop PCs and laptops, portable drives, complex RAID or NAS systems, encrypted media and virtual machines.

Last update: November 22, 2024