How can files that have been deleted and no longer take up space on a hard drive be recoverable?
In: Technology
Hard drives are really, really big. The biggest hard drives out there can contain more than 200 *TRILLION* individual 1s and 0s. So, to deal with how many different 1s and 0s are on a hard drive computers take shortcuts. One of these shortcuts is creating an “Index” of all the files on the hard drive. This index is a listing of where every file is on the hard drive, similar to how a library might write down where each book is kept. It might say that the file “My cool picture.jpg” is located at location 2413145 and the file “My resume.pdf” is located at location 59139.
Another shortcut that your computer takes is that when you delete a file, your computer doesn’t actually delete the file. It would take a lot of time to delete every file if everything was immediately erased from the hard drive, so all that your computer does is remove the entry in the index that says “My cool picture.jpg is located at location 2413145”. The actual data is still there, it’s just marked that “Location 2413145 is empty, you can write something else there now”. But since hard drives are pretty big, it could take a while before that free space is re-used.
Another shortcut that computers use is marking every file with something known as a “header”. A header contains information about what type of file something is. A picture will have a header that says “This is a picture, it’s a certain size, it was taken with this camera, on this particular date” and a document might have a header that says “This is a document, it was created with Microsoft Word, and it was created by a user called Dave”.
To recover a deleted file, you can use a program known as a “File carver”. A file carver program will search through all the space on a hard drive marked as “Empty” and look for any headers. If it finds a header, it can say “Hey, there was a file here that was deleted! I know this is a picture and the data is still here, it hasn’t been overwritten!” Then, the program will go back into the index of the hard drive, and mark the location the file is at as no longer being empty. You then have a recovered file!
Latest Answers