How can files that have been deleted and no longer take up space on a hard drive be recoverable?
In: Technology
Yes!
But how difficult it is will differ greatly how long ago the delete happened.
Generally deleting files will not actually remove the data. It will just declare that space free to be overwritten, but a simple file restoration tool will be able to find it again.
If the files were already (partially) overwritten they can still be restored, but then you’re looking at like $10k for a professonional to take your harddrive apart and systematically look for residual charges of files that lived there in the past. This will usually only happen when the file is either super valuable or relevant for uncovering a crime
Deleting something actually only tells the computer that it’s now okay to write over the old files, it doesn’t actually remove them. So until the data is written over with new data, it remains accessible to anyone with the proper software and knowhow. That’s the basics anyhow.
On a mechanical hard drive, deleting a file doesn’t overwrite anything. It just removes it’s listing from the hard drive’s table of contents. An undelete program will read every sector of the hard drive and identify those areas with files on it that aren’t listed on the table of contents; to recover it, it just rebuilds that particular entry.
Computers are generally quite lazy. When you delete a file the computer does not go through the trouble of overwriting the data. It just marks those data blocks as free space in the index. It no longer takes up any space because when you write new data to the disk the computer may overwrite those old files since it is marked as something.
Hard drives are really, really big. The biggest hard drives out there can contain more than 200 *TRILLION* individual 1s and 0s. So, to deal with how many different 1s and 0s are on a hard drive computers take shortcuts. One of these shortcuts is creating an “Index” of all the files on the hard drive. This index is a listing of where every file is on the hard drive, similar to how a library might write down where each book is kept. It might say that the file “My cool picture.jpg” is located at location 2413145 and the file “My resume.pdf” is located at location 59139.
Another shortcut that your computer takes is that when you delete a file, your computer doesn’t actually delete the file. It would take a lot of time to delete every file if everything was immediately erased from the hard drive, so all that your computer does is remove the entry in the index that says “My cool picture.jpg is located at location 2413145”. The actual data is still there, it’s just marked that “Location 2413145 is empty, you can write something else there now”. But since hard drives are pretty big, it could take a while before that free space is re-used.
Another shortcut that computers use is marking every file with something known as a “header”. A header contains information about what type of file something is. A picture will have a header that says “This is a picture, it’s a certain size, it was taken with this camera, on this particular date” and a document might have a header that says “This is a document, it was created with Microsoft Word, and it was created by a user called Dave”.
To recover a deleted file, you can use a program known as a “File carver”. A file carver program will search through all the space on a hard drive marked as “Empty” and look for any headers. If it finds a header, it can say “Hey, there was a file here that was deleted! I know this is a picture and the data is still here, it hasn’t been overwritten!” Then, the program will go back into the index of the hard drive, and mark the location the file is at as no longer being empty. You then have a recovered file!
Latest Answers