Data Recovery Digest

Everyone knows that on modern operating systems when you delete a file it first heads to the trash can or recycle bin, depending on the operating system you are running. When the trash can or recycle bin is emptied, the files aren’t actually deleted from the hard drive. Rather, the link pointing to those files is deleted and the hard drive is free to overwrite the data when it needs the space. This means that it could be quite sometime before the data you want to delete is actually overwritten. Data recovery software takes advantage of this process by looking at all of the data on the hard drive and trying to combine it back together to make the original file. This can be very difficult because sometimes part of a file will be overwritten while part of it will remain on the disk. If data has been overwritten it is practically impossible to recover the data. There have been some controversial academic papers that suggest ways to get the data back, but they aren’t very applicable to real world scenarios and haven’t been put into popular practice.

Data Recovery software will actually examine the contents of the hard drive, not what the operating system says in on the hard drive. The operating system, whether it is Microsoft Windows or Mac OS X, has an index of the files on the hard drive and where they are located. In this sense, it is just like the index at the back of a textbook. When a file is deleted, the index entry pointing to the file is removed. Most data recovery software gets around this by actually inspecting the bit contents of the disk and not relying on the operating system’s index to tell it what files are on the disk and where they are located. Hundreds of data recovery programs exist, some commercial and others open-source, and some specialize in recovering a specific type of data and others are more general.

More advanced data recovery tools may use a technique known as file carving. This process attempts to reconstruct files or parts of files when the data and the metadata (data about other data) has been corrupted or deleted. It can apply common structures found in data in hopes of reconstructing a file. Data structures are often times dictated by the file type, such as JPG, GIF, PNG, and MP3, and each file type has a common structure. File carving is a very computationally intensive process because there are so many different ways to recombine data. Free and open source file carving applications exist, such as Foremost and PhotoRec. Commercial applications are also available, like Adroit, which is very popular for recovering digital photos that have been lost. Adroit even boats “SmartCarving” and “GuidedCarving” algorithms that supposedly increases it effectiveness. File Carving is a relatively new technique and isn’t very widely used and even though it isn’t always successful in recovering a high percentage of data, it is definitely a technology to watch.

If you do plan on using data recovery software, one of the most important things to always keep in mind is that you should not be saving new data to a disk that you want to run data recovery software on. This is because the new data could overwrite the data you want to recover.