Chances for data recovery
Fortunately, the storage space occupied by the lost file remains unaltered until it is overwritten with new information, thus leaving the possibility to retrieve the missing data.
First and foremost, the chances for data recovery strongly depend on the actual cause of data loss and further user's actions. To get the best data recovery result, it is strongly recommended to prevent any possibility of anything being written to the storage and immediately run data recovery software.
Hint: The information about the most typical causes of data loss is available in the article explaining the principles of data recovery.
-
Data loss caused by file deletion
Any deleted file remains on the storage until the storage space is reused by other data. After file deletion, the operating system may reuse the disk space to save a new file. Thus, even a minor piece of information written to the storage can cause permanent data loss. Using a web browser might result in overwriting deleted files through caching or saving cookies to the storage. If you install any software to the same drive, your data can be overwritten as well.
Another factor that affects the prospect of data recovery after file deletion is the file deletion algorithm of a file system. For the Windows NTFS file system the chances for a positive outcome are quite high: if the file descriptor remains on the disk, the software can easily find all the required information about the file. Unlike NTFS, the BSD UFS file system destroys information about the file start, location and size permanently and together with a high degree of file fragmentation (typical for this file system) leaves few chances for successful data recovery.
Other file systems (like FAT) provide average chances for data recovery. Here, the information is destroyed partly (like the information about file fragments), but the information about the file name, start and size remains on the disk. Heuristic algorithms allow "predicting" file fragments and recovering undamaged files. Owing to the lack of real information about the allocation of file fragments data recovery software may fail to detect the actual position of the file, especially if several fragmented files situated close to the same location on the storage were deleted.
Hint: To learn more about file systems and their types, please, refer to the basics of file systems.
These factors determine using a set of deterministic and heuristic algorithms to predict the location of the deleted file. These algorithms differ from manufacturer to manufacturer and so do the recovery results.
Hint: Please rely on the following guide if you need to recover accidentally deleted files.
-
Recovery after file system formatting
After file system formatting, a part of information on the storage is destroyed due to overwriting the space with new information of a new file system. Data recovery chances after formatting depend largely on the differences between the original and the new file systems.
For instance, if a storage gets formatted with FAT, this file system overwrites a huge amount of storage space on the disk starting with zeros (empty block allocation tables) and therefore destroying all the previous data. Even if the previous file system was FAT as well, the information about allocation of the previous files will be lost completely. Other file systems usually allocate more or fewer structures to different storage locations.
In some cases data recovery chances are higher when the file system is formatted with the same file system type: in case of NTFS overwritten with NTFS the possibility of successful data recovery is quite high, while FAT overwritten with FAT has worse data recovery chances.
Efficient data recovery software usually gives a satisfying recovery result after file system formatting. Most file systems (except those like FAT) might keep the information about the file allocation, directory records and file names, allowing data recovery utilities to reconstruct the file system successfully. However, since new structures are written to the disk, some user information can be damaged and some files or folders can be lost.
-
Recovery after file system damage
In this case, data recovery software applies the same techniques as in the case of a formatted file system. Data recovery chances depend on the kind of file system damage (damage of user files, file folders, file location, file name).
-
Loss of information about a partition
This data loss case is an exceptional one. Working with this kind of damage, data recovery software identifies the file system starting with the known file system structures by scanning the storage. If the loss didn't affect the file system itself, the data can be fully retrieved in its original form.
-
Hardware failure
Never try to recover data from a failed or failing storage on your own. This can result in permanent data loss. The only exception is RAID systems where storage redundancy allows recovering data completely without the missing failed unit.
RAID failure might also affect the file system. But if the file system remains intact, your RAID has relatively high data recovery chances. For further information concerning the specifics of data recovery from RAID please refer to the orgainzation and recovery of data on RAID.
-
Recovery of wiped/overwritten data
Recovery of wiped and then overwritten data is impossible due to the specifics of the mechanism of writing data. The myth about the possibility to recover the lost files that were overwritten is the result of successful attempts to recover data from old floppy disks and hard drives. Those devices with storage capacity from kilobytes to megabytes used very wide magnetic trace and simple digital encoding to store information. That is why it was possible to read "traces of data" after wiping or overwriting by calibrating read "head" sensitivity and position.
Modern systems use very thin tracks, high precision of head calibration and extremely high signal frequency near to the top of technology limit. Performance of modern chips only allows picking a good discrete signal from a disk platter and never identifies any 'signal traces'. This scheme is impossible for any digital device as discreet signal frequency to handle such data lies much beyond the theoretical limit of electronic circuits.
Thus, the companies that claim to be able to recover data this way are not to be trusted.
Last update: August 02, 2022