So i was enjoying some down time for myself the other night taking a nice warm bath and letting my mind wander when i suddenly recalled a time when i worked at a research station and some idiot managed to somehow delete over 3000 excel spreadsheets worth of recently collected data. I was charged with recovering the data and scanning through everything to make sure it was ok and nothing deleted…must have spent nearly 2 weeks scanning through endless pages…and it just barely dawned on me to wonder…exactly…how the hell do data recovery tools collect “lost data”???
I get like a general idea of like how as long as like that “save location” isnt written over with new data, then technically that data is still…there???? I…thats as much as i understand.
Thanks much appreciated!
And for those wondering, it wasnt me, it was my first week on the job as the only SRA for that station and the person charged with training me for the day…i literally watched him highlight all the data, right click, and click delete on the data and then ask “where’d it all go?!?”
In: Technology
The physical location on the storage media where the contents of the file isn’t erased when you press delete, so as long as nothing else has been written to that same spot, it’s still there.
Files are not deleted.
A file on a computer is the data on the hard drive and a notation that says the file exists and where it is.
When a file is deleted what really is deleted is the notation that says the file exists and where it is. The file is still there.
But since the notation no longer exists, when more space is needed the computer will write over the old file.
So a deleted file remains until a new file is written over it.
Think of it like throwing out an aluminum can. The can exists until they melt it down and turn it into a new can. We just treat a thrown out can as no longer being a can.
It really depends on what you mean by “deleted”, but you seem to have an inkling of that.
In general ‘deleting’ data simply means a command that tells the computer to forget something important is contained in that portion of memory. Technically the information is still, literally physically, there the computer just doesn’t know it anymore. Kind of like a dictionary where the page numbers are deleted. A specialist, or special software just needs to know where to look and it can be restored.
“permanently deleted” implies something actively *destroyed* the old information. In this the computer might literally go and write over the old data with new garbage data. In this case the dictionary pages weren’t just deleted, the pages were bleached and then a copy of James Joyce’s “Finngans Wake” was written over it. In fact, the computer probably then bleaches the pages again and puts “Twilight” over Finnegans Wake, and then bleaches it again and writes a Trump speech over that. Literally random, incoherent gibberish over gibberish over gibberish. In this case whatever you deleted cannot be recovered and is truly erased from the drive. Period.
What is really deleted when you delete a file is the pointer to that file. Put simply, your computer’s file system is an index listing the file names and the location(s) on the disk drive. When you delete a file, only that index entry is deleted, so the file system no longer knows where it is. The file system thinks it’s deleted because it can’t see it, but it’s actually there.
A data recovery tool is designed to scan all the data on the drive, whether or not it has an index pointer. It looks for file formats, metadata, and other indicators to recover those files. It doesn’t always work (“deleted” files can be overwritten), but they work fairly effectively.
One way to wipe a hard drive is to overwrite the entire disk with “1s” and then “0s”, this is fairly effective.
There are more advanced techniques to both recover data and wipe a drive, but what I’ve described should cover the question.
Computer memory consists of two important components: the actual data (stored as 1’s and 0’s) and an “index” or “table of contents” that links groups of 1’s and 0’s into “files.”
When a file sits on your desktop, that’s just a little blurb of information that says “when this gets double-clicked, read out the 1’s and 0’s from XYZ region of the memory”
Accordingly, there’s two ways of “deleting” a file:
* You could physically take all the 1’s and 0’s and write them all into 0’s.
* You could just delete the blurb that makes the computer know that a certain region of the memory corresponds to a real file
The first is time-intensive (takes a while), and is worse for the longevity of your memory especially with physical drives that have a limited number of times you can rewrite each 1 or 0.
The second is quick and easy because erasing the table of contents means the file is *essentially* gone. Then when you create a new file, the computer knows it can use that memory area for the new file and just write over whatever’s there. That way you aren’t constantly turning 1’s and 0’s into all-0’s and then back into 1’s and 0’s when you make new files, but rather you get fewer rewrites of the same memory.
However, importantly the second way also lets you re-access the data because it’s still technically there unless a new file has overwritten it. You could re-create the table of contents and say “hey computer tell me what used to be here” and it will give you the original data back because all you’re doing is re-accessing data the computer has “forgotten” about
saving and deleting often killlllllls a solid state drive. best to spread that operation over the whole drive so you do not kill it quickly.
It’s not x marks the spot its continuously move the spot so we do not kill the drive quickly
Delete is not delete. It’s move the x somewhere else
Hard drives are like books: There’s a table of contents pointing to which chapter has the right information. When you retrieve a file, it looks at the table of contents, finds out what page the information is on, then goes to that page.
When you delete a file, it only deletes the entry in the table of contents. When you look for the file in the table of contents, it won’t be there, so it’s like it’s deleted. However, if you actually go through the pages, that information is still there.
Data recovery for deleted files usually involve going through every page and seeing what’s there.
If you truly want to “delete” and erase all information about the file, you would have to write over those pages. Lots of software will let you do this but it’s usually quite time consuming.
So far most answers have given the correctish answer but not really ELI5. So:
Think of your hard drive as a bunch of storage units, like those garage hunters shows. And they have a manager (this is a part of the PC that handles the process of memory storage.)
So when you delete something, the manager gets a notification for the storage units that file occupied. He now knows those are available, but does little else to them.
So as long as there is nobody new that needs to occupy those storage units, they will remain with the stuff they had. But as soon as a new tenant comes, the manager flicks and swishes his magical erase wand and makes room for the new tenant.
Recovery tools go to the manager and ask him for the list of all storage units, whether they are currently under a tenant or not. Then they let you re-asign them as you wish.
Shortest possible explanation: Files aren’t deleted they are simply flagged as free space to be overwritten.
To find a file
You walk into the library, go to the card catalog ( yes I’m that old), Then search for the book you need and follow the directions to the book.
Deleting a file is like walking into the library and setting the card catalog on fire and roasting some marshmallows, now you didn’t burn the library, just the instructions on how to find the particular book you need.
When you are trying to recover the files it would be like rebuilding that card catalog by seeing what book is where and rewriting those cards by hand.
Now if you wanted to really destroy those files, you would go to each book and paint over the names and all identification of the book. Essentially you write gibberish over top the files to make them unrecoverable.
Latest Answers