Recovering Deleted Data

In the vast majority of cases, deleted data is actually still lurking around on your hard drive. If you put data in the Recycle Bin or Trash, and them empty it, all you are actually doing is telling the system that it can reuse those parts of the disk when it wants. Until you replace those areas with new data, the old data will still be there.

Recovering Deleted Data

The Filing Cabinet

The tried and trusted analogy is of a filing cabinet. When you delete a file, you are removing the index card from the front of the drawer, but the actual file is still in there.

This is why it is really important to switch off your computer as soon as possible if you have accidentally deleted some files. You may not realise but even small actions like checking e-mail or browsing the internet can write cache files to the disk. That is when data could be lost.

Overwritten / Deleted Data

We often hear about the FBI being able to recover overwritten files. While this may have been possible on very old – low capacity hard drives (~100MB), it is unlikely to be possible on modern hard drives. The magnetic material is far too densely packed. Even then, it would only be tiny fragments of data recovered, and not whole files.

The Problem With SSDs

Solid state drives bring a whole new problem of their own. Due to the way the data is distributed around the device, known as wear levelling, you can never be sure of which sector you are writing or overwriting. Wear levelling is necessary to prolong the life of an SSD, but it means the drive could be moving data around behind the scenes, making deleted files much more difficult to track down.

Specifics

In most cases, we can recover deleted files with the original file names and folders. With deleted Mac data, this is often not possible. In that case we have to use a special type of scan, which finds all files of a given type and saves them to numbered files. This means camera photos may be recovered into a JPG folder, with files named like photo0001.jpg, photo0002.jpg and so on.

If required we can process certain types of these files into more meaningful order. For photos we can arrange into folders by date taken, and for music files we can arrange into Artist / Album order.

The Important Bit

If you accidentally delete some files, they are likely to be recoverable. It’s the actions you take next which can make the recovery difficult – if not impossible.

One Reply to “Recovering Deleted Data”

  1. Regards to the wear leveling in SSD, the result of this is (at a RAW level) multiple blocks will consist of the same block number. While the real block will remain accessible, the previous blocks (such as relocated blocks, blocks marked as bad, blocks erased during garbage collection or blocks moved to equalize writes per block) do not feature in the translation table so are not accessible via traditional logical recovery means.

    In the event of data loss on SSD it is advisable that power to the media is cut and the device remains powered off until it can be analysed by a professional.

Leave a Reply

Your email address will not be published. Required fields are marked *