So i was enjoying some down time for myself the other night taking a nice warm bath and letting my mind wander when i suddenly recalled a time when i worked at a research station and some idiot managed to somehow delete over 3000 excel spreadsheets worth of recently collected data. I was charged with recovering the data and scanning through everything to make sure it was ok and nothing deleted…must have spent nearly 2 weeks scanning through endless pages…and it just barely dawned on me to wonder…exactly…how the hell do data recovery tools collect “lost data”???
I get like a general idea of like how as long as like that “save location” isnt written over with new data, then technically that data is still…there???? I…thats as much as i understand.
Thanks much appreciated!
And for those wondering, it wasnt me, it was my first week on the job as the only SRA for that station and the person charged with training me for the day…i literally watched him highlight all the data, right click, and click delete on the data and then ask “where’d it all go?!?”
In: Technology
so say you have a hard drive that can store 10 things in it, for simplicity. The addresses are arranged thusly – note that while I have combined things quite a bit, each individual file has its own address – so like the windows OS address in a real computer would actually be like a few hundred things, not just one thing
address 1: windows OS
address 2: word document “RoughDraft”
address 3: word document “stuff”
address 4: empty
address 5: league of legends game data
address 6: empty
address 7: pictures
address 8: empty
address 9: zoom
address 10: empty
Now if you read the hard drive it has all that data in that order: something like [addresses][win32][RoughDraft][stuff][garbage][league.dll][garbage][pngdata][garbage][zoom.dll][garbage]
If i then delete league of legends, it will remove it from the address list, but it doesn’t actually change what’s ON the hard drive, so you get an address list that says this…
address 4: empty
address 5: empty
address 6: empty
but then if you go read the actual data on the hard drive for those addresses, you get this: [garbage][league.dll][garbage] – so you can still see all the files there, because the bits that encode the league of legends data never actually got flipped.
~~~~~~~~
If you actually want to delete something, then you need to flip the bits on the hard drive – the best way to do this is to put new data in the address where the old data used to be – so if you fill up address 5 with copies of the song despacito, you will no longer be able to see the league of legends data, because it has been overwritten by despacito.
Latest Answers