Read how files are stored on a disk and exactly how Windows handles file deletion . Many different data recovery programs offer to recover deleted files in just a few clicks. 

How do they work, and most importantly – why? In this article, we tried to answer this question.

How Windows Stores Files

• In order to understand why file recovery is possible, you must first understand how these files are stored on disk and how Windows handles file deletion .
• Files are stored as blocks of information recorded on hard disk sectors. Sectors can be located either sequentially, one after another, or randomly scattered over the entire surface of the disk. 
• The location of the sectors depends on which blocks were free at the time the file was saved to disk. If the system does not find a contiguous free block of sectors on the disk large enough to store the file as a contiguous sequence of data,
• The system will fragment the file, writing its individual parts into free blocks.
• In order to navigate the recorded information, Windows creates an entry in the file system indicating which sectors on the disk are occupied by the contents of a particular file.

How Windows deletes files

When a user deletes a file, Windows does not erase or overwrite the contents of the sectors on the disk. The content of a file record in the file system is also not deleted, but modified: the system marks the record as belonging to the deleted file. 

Accordingly, all sectors on the disk belonging to this file are free – now Windows can save some other file to this space. 

But until this happens, you can try to restore the contents of the deleted file. This will require a special tool – a product for information recovery.

File recovery algorithm

• Finally, we got to the heart of the matter. Deleted file recovery programs scan the file system looking for entries marked as deleted. 
• After analyzing such records, it becomes possible to find out the exact addresses of the sectors on the disk in which the contents of the original file were written. 
• After a quick additional check to see if these sectors belong to some other file, the program reads the data from the required sectors and saves them in a new file. Problem solved!
• What happens if there is no record left in the file system that points to a deleted file? In this case, the simplest tools do not work.

 A different approach is required – ” signature search for data recovery “.

 The essence of the algorithm is to search for a combination of certain bytes on the disk, which indicate the beginning or end of files. For example, *.avi, *.docx, *.pdf, *.ppt, *.pst, *.zip files start with bytes “52 49 46 46”, “50 4B 03 04”, “25 50 44 46” , “D0 CF 11 E0”, “21 42 44 4E”, “50 4B 03 04” respectively.

Data recovery from SSD drives

The storage technology of SSD disks involves the operation of TRIM algorithms and the background garbage collection process. 

These algorithms effectively destroy the contents of deleted files at the physical (electronic) level, making it impossible to restore the contents of even recently deleted files. Why this happens – read the article about SSD drives .

Thank You For Visiting Collaborate Activate.