So i was enjoying some down time for myself the other night taking a nice warm bath and letting my mind wander when i suddenly recalled a time when i worked at a research station and some idiot managed to somehow delete over 3000 excel spreadsheets worth of recently collected data. I was charged with recovering the data and scanning through everything to make sure it was ok and nothing deleted…must have spent nearly 2 weeks scanning through endless pages…and it just barely dawned on me to wonder…exactly…how the hell do data recovery tools collect “lost data”???
I get like a general idea of like how as long as like that “save location” isnt written over with new data, then technically that data is still…there???? I…thats as much as i understand.
Thanks much appreciated!
And for those wondering, it wasnt me, it was my first week on the job as the only SRA for that station and the person charged with training me for the day…i literally watched him highlight all the data, right click, and click delete on the data and then ask “where’d it all go?!?”
In: Technology
What is really deleted when you delete a file is the pointer to that file. Put simply, your computer’s file system is an index listing the file names and the location(s) on the disk drive. When you delete a file, only that index entry is deleted, so the file system no longer knows where it is. The file system thinks it’s deleted because it can’t see it, but it’s actually there.
A data recovery tool is designed to scan all the data on the drive, whether or not it has an index pointer. It looks for file formats, metadata, and other indicators to recover those files. It doesn’t always work (“deleted” files can be overwritten), but they work fairly effectively.
One way to wipe a hard drive is to overwrite the entire disk with “1s” and then “0s”, this is fairly effective.
There are more advanced techniques to both recover data and wipe a drive, but what I’ve described should cover the question.
Latest Answers