In Depth Deleted Data Recovery- How is it possible to Recover the Deleted Data?Murtaza J.
We delete files and photos daily, some by means and some accidentally. But when you delete something, is it really deleted? Even when you empty your recycle bin you can still get the same file back. Assume you have an old laptop selling out and you just delete the files assuming that it’s all deleted, but be careful as it still can be recovered. In cases like that, anybody can recover your deleted confidential data easily.
Most of the operating systems keep a track of the location of files on your hard drive through “pointers”. Every single file on your drive has a pointer to determine the location of your file including where it starts and ends.
What happens when you delete a file?
When you delete a file the hard drive deletes the pointer and scripts the sector as containing the data available. Now from the perspective of the file system, the file is removed from your hard drive and the sectors that still have your data is taken as a free space available. So, whenever you add new data, your operating system overwrites the data on those sectors. Until the data is overwritten, it’s possible to recover the files. If the part of the sector is only overwritten then only part of it is recoverable.
This process doesn’t apply to SSDs-Solid State Drives
Why doesn’t my computer just delete the files completely?
The answer is pretty logical. It’s an extremely fast process of removing the printer and marking the space available. Let’s take an example, assume you are deleting a 12 GB file from your hard drive, it will nearly take 15-20 seconds. But now try writing the same 12 GB file on your hard drive and it will take a lot of time because overwriting the files takes longer time. So basically if your computer deletes a 12 GB file completely then it will take a similar time to writing a file.
SSDs are different in this case
All the topics discussed above doesn’t apply to an SSD drive because it has a different mechanism. All new drives come TRIM-enabled. When we delete something on SSD it gets deleted completely. Data cannot be overwritten in flash chips so to write new data it has to first empty the cell and then write the new data in. your operating system will delete the entire data on the spot to increase the speed of processing. If it tries to overwrite the data then it will make SSD slower moving away from the main purpose of speed.
Recovering deleted files
- Stop using the drive
The first thing to do when you accidentally deleted the file is to just stop working. Don’t add or remove any of the data on the same hard drive. More the data you add the more sectors gets overwritten.
- Use a data recovery tool
Windows or Mac doesn’t come with any recovery utility to scan the files. You can always use third party tools to scan for deleted files. Tools like that will scan the sectors of your drive to rebuild the erased files and recover it.
How to permanently delete the files?
If you have really important personal or confidential data and you need to dispose of your hard drive or computer then perform these steps to permanently erase the data.
- Using a Disk wipe tool: Programs such as CCleaner comes with an option to wipe the complete hard drive and overwrite the sectors with a different data for permanent data cleaning and impossible recovery.
- File shredder: shred a file while deleting it. Shredding tools such as Eraser will not only delete the file but entirely overwrite the data. So not a single file can be recovered.
Note: Processes above takes a longer time to remove than just deleting a file.
Always remember that no data is lost until it’s overwritten. In cases of recoveries consult a Data Recovery services for advice, because they can even repair and recover from damaged hard drives. Always shred or completely remove the data from a Hard drive before disposing or giving away your computer.