Friday, June 15, 2007

How file recovery software works

I discussed about a File recovery tool in one of my earlier posts and deferred the discussion on how such tools work for some future post. Today I will discuss how file recovery software actually works.

Files in a computer have a volume table (directory table) that contains, among other things, an entry for each file in the hard disk along with the address of the location where the file is stored. When a file is deleted, a small part of the table for that entry is modified marking the space as free. The data still remain in the disk until it is overwritten at some later time. Now two possibilities arise:

1) The table entry for a deleted file is intact. In this case, it will still contain the pointer to the file. A quick reading of volume table by the file recovery software followed by looking at the location for the file may recover data if it is not overwritten by that time. This is QuickScan option in the tool in the figure of earlier post.

2) The table entry itself is overwritten, i.e. some other file entry has replaced the free'd file's entry. In this case, the file recovery software uses Advance mode (SuperScan option in the figure). In this mode, it scans the whole disk reading each block and matches the files there with entries in the table. That is the reason this option takes a long time. If the file in any block has an associated entry in the table, it means the file is still alive i.e. not deleted, and it skips to next file and its entry. If a file has no corresponding entry in the table, it means this file has been deleted and so the tool marks this as "Found".

The most important step in data recovery after a file is accidentally deleted is to make sure that the disk is immediately detached if one wants to recover the file. Otherwise, the data might get overwritten and not recoverable by such tools. It also means that just deleting a file doesn't ensure the data is gone. One needs a proper tool to erase data. Such tools overwrite the whole data in the disk with random bit patterns many times over rendering it pattern-less and non-recoverable. Hardware techniques also exist to erase data such as degaussing which basically erases data in a disc magnetically.

9 comments:

TemporalBeing said...

Actually, it doesn't have to be random. It just has to be able to (a) flip all the bits, and (b) guarantee it does so, and do so enough to prevent recovery.

A simple method would be writing 0x0,0xAA,0x55,0xFF numerous times for every byte of the file.

Randomness can actually work against you by not flipping all bits.

unirecovery said...

The main problem faced by data recovery expert is that very often, after the data has been lost, people tries to recover the data by themselves first, and in many cases the data are overwritten and permanently lost.
If someone has critical data and wants to restore it, he has to directly go to the data recovery expert and not try anything with the hard disk.

http://www.unirecovery.co.uk

Anonymous said...

Some recovery programs are better than others. One that is guaranteed to work for windows operating systems is Selkie Rescue. It takes all your files from your crashed computer and transfers them to a working computer, all in the same order they were originally in.

www.tugboatenterprises.com

shopping cart said...

When deleted a file from recycle bin is it possible to recover it, or such a tool is available?

Mayur Pawar said...

To restore a difficult drive that was corrupted can turn out to be simple should you have software program to help you recover all of your deleted documents. You most likely gave up individuals documents as becoming lost forever. But whatever the type of documents they're, a great application ought to recover them - data documents, audios, videos, image documents and zip documents and emails are all within the scope.

Regardless of whether you've lost your documents simply because of hardware or software program failure or virus or just by becoming careless you should be able to have them back. It should be an exciting round recovery application that could be part of file protection strategy for pros such as network staff and house users alike. Hard Drive Data Recovery Software are obtainable free of charge mostly on internet.

File recovery software said...

Stellar Phoenix File Recovery Plus is an easy, fast, and secure file recovery software that recovers all lost, missing, and deleted files and folders from FAT 16, FAT 32, and NTFS & NTFS5 based hard drives.

Fakhruddin40 said...

Is there any file recovery software that restore a file deleted from recycle bin.

Plastic Card

Manoj Kumar said...

hey, please explain can we recover our data or file without any third party tool...? If yes, then how...?

Asger Lauritsen said...

Recovery may be required due to physical damage to the storage device or logical damage to the file system that prevents it from being mounted by the host operating system (OS). A wide variety of failures can cause physical damage to storage media. CD-ROMs can have their metallic substrate or dye layer scratched off; hard disks can suffer any of several mechanical failures, such as head crashes and failed motors; tapes can simply break. Data recovery is often performed by specialized commercial services. Here's a tool that I'm using capable in retrieving files in any type of storage devices. If the data is critical, a professional data recovery service may be the best solution.