how “permanently deleted” files in a computer are still accessible by data recovery tools?

Question

So i was enjoying some down time for myself the other night taking a nice warm bath and letting my mind wander when i suddenly recalled a time when i worked at a research station and some idiot managed to somehow delete over 3000 excel spreadsheets worth of recently collected data. I was charged with recovering the data and scanning through everything to make sure it was ok and nothing deleted…must have spent nearly 2 weeks scanning through endless pages…and it just barely dawned on me to wonder…exactly…how the hell do data recovery tools collect “lost data”???

I get like a general idea of like how as long as like that “save location” isnt written over with new data, then technically that data is still…there???? I…thats as much as i understand.

Thanks much appreciated!

And for those wondering, it wasnt me, it was my first week on the job as the only SRA for that station and the person charged with training me for the day…i literally watched him highlight all the data, right click, and click delete on the data and then ask “where’d it all go?!?”

In: Technology

Answer 1

Here’s my ELI5:

Think of your diskspace like a neighbourhood. Buildings like houses, apartments, stores, schools are all different types of files.

To find the building you are looking for, you simply search for the “door number” assigned to that building, that is the address and files have “addresses”, just like buildings.

Now truly erasing a file is a lot of work, computers don’t do that, what they do is “de-address/de-register” the file. Let’s stay your local McDonald’s goes out of business and the address was 1234 Hexadecimal Street. If you lookup what’s at this address, you will be told there’s nothing there, property/space is up for sale for the next business to move in.

However, a clever person is able to guess that there used to be a McDonald’s there just by looking at the old signage, building shape, drive-thru area, overabundance of red and yellow paint,etc.

A deleted file is like that out-of-business joint: as long as no one has demolished the building… it’s still there, and clever softwares recognize “deleted” files by the patterns they leave at those addresses.

For a file to be completely gone, one needs to demolish the pattern left by the file which is like demolishing that golden arch food joint and building a veterinary clinic instead: new building, new signage, no traces of the old building and yet, it’s address will be 1234 Hexadecimal Street.