A large variety of data recovery applications resurrect deleted files by several mouse clicks. This article explains the way such applications work.How Windows deletes data?
When a user deletes a file, Windows neither erases nor rewrites sector’s contents. The record on data location is also retained, though, slightly modified. The OS marks the record as related to deleted data. Consequently, all sectors on the disk platter indicated by that record become “empty” – Windows may now record other data to these sectors. However, until other data are not recorded to the sectors, the deleted data can be recovered. To do that you will need a special data recovery application.
How data recovery works?
Data recovery application scans the file system for records marked as related to deleted data. The record is then analyzed to retrieve information about location of sectors containing data parts indicated by the record. The application runs also an additional test to determine whether the sectors truly belong to the given file and not to any other file. After the additional test is completed, the application retrieves data from the sectors and records them as a new file.
If the file system has no record related to the deleted data you will need a special tool employing signature search.
Data recovery from SSD
SSD storage technology uses TRIM algorithm – a background garbage collector. TRIM deletes files on the physical (electronic) level preventing recovery of even recently erased files.
