Tuesday, 19 May 2015 00:00

How Windows deletes data: why can data be recovered?

Rate this item
(0 votes)

b2ap3_thumbnail_iStock_000018644252XSmall.jpgA large variety of data recovery applications resurrect deleted files by several mouse clicks. This article explains the way such applications work.

How Windows stores data?

To understand how data recovery works one should know how data are stored in the hard disk and how Windows deletes these data.

Data are stored in blocks on the disk sectors. Sectors containing data may be arranged either in direct serial order (one by one) or chaotically (all over the disk platter). Sector arrangement depends on availability of empty (containing no data) sectors. If there is no available block of sectors large enough to store all data in direct serial order then the data will be fragmented into smaller parts which will be recorded to empty blocks.

To remember location of all data parts, the OS creates a special record which indicates in which sectors the data parts are stored.

How Windows deletes data?

When a user deletes a file, Windows neither erases nor rewrites sector’s contents. The record on data location is also retained, though, slightly modified. The OS marks the record as related to deleted data. Consequently, all sectors on the disk platter indicated by that record become “empty” – Windows may now record other data to these sectors. However, until other data are not recorded to the sectors, the deleted data can be recovered. To do that you will need a special data recovery application.

How data recovery works?

Data recovery application scans the file system for records marked as related to deleted data. The record is then analyzed to retrieve information about location of sectors containing data parts indicated by the record. The application runs also an additional test to determine whether the sectors truly belong to the given file and not to any other file. After the additional test is completed, the application retrieves data from the sectors and records them as a new file.

If the file system has no record related to the deleted data you will need a special tool employing signature search.

Data recovery from SSD

SSD storage technology uses TRIM algorithm – a background garbage collector. TRIM deletes files on the physical (electronic) level preventing recovery of even recently erased files.

Last modified on Tuesday, 19 May 2015 17:35
Data Recovery Expert

Viktor S., Ph.D. (Electrical/Computer Engineering), was hired by DataRecoup, the international data recovery corporation, in 2012. Promoted to Engineering Senior Manager in 2010 and then to his current position, as C.I.O. of DataRecoup, in 2014. Responsible for the management of critical, high-priority RAID data recovery cases and the application of his expert, comprehensive knowledge in database data retrieval. He is also responsible for planning and implementing SEO/SEM and other internet-based marketing strategies. Currently, Viktor S., Ph.D., is focusing on the further development and expansion of DataRecoup’s major internet marketing campaign for their already successful proprietary software application “Data Recovery for Windows” (an application which he developed).

Leave a comment

Make sure you enter the (*) required information where indicated. HTML code is not allowed.