how “permanently deleted” files in a computer are still accessible by data recovery tools?

Question

So i was enjoying some down time for myself the other night taking a nice warm bath and letting my mind wander when i suddenly recalled a time when i worked at a research station and some idiot managed to somehow delete over 3000 excel spreadsheets worth of recently collected data. I was charged with recovering the data and scanning through everything to make sure it was ok and nothing deleted…must have spent nearly 2 weeks scanning through endless pages…and it just barely dawned on me to wonder…exactly…how the hell do data recovery tools collect “lost data”???

I get like a general idea of like how as long as like that “save location” isnt written over with new data, then technically that data is still…there???? I…thats as much as i understand.

Thanks much appreciated!

And for those wondering, it wasnt me, it was my first week on the job as the only SRA for that station and the person charged with training me for the day…i literally watched him highlight all the data, right click, and click delete on the data and then ask “where’d it all go?!?”

In: Technology

Answer 1

Normal deletion means the os marks the hard drive space as free, but doesn’t actually remove stuff until something overrides it. So it lives there.

Then there is the more crazy stuff where certain drives basically use magnets to put memory in a certain state (higher capacity HHD are a good example of this), so you code overwrite the memory which for most people is good enough, but someone with special tools can basically still look at how magnetized a bit was to try and figure out it’s old state. Basically the protocol to protect this is you need to overwrite multiple times to make this very hard, but best practice for organizations that can’t afford a leak ever is super strong magnet (way stronger then the hhd would use), then physical destruction of the drive. For normal people get software to wipe it properly aka overwrite the data, no one is realistically going to spend the time to try and recover your memes with the equipment needed to do this.