TOC · Work · Data Recovery

Removed Data Recovery

Removed recovery is generally performed the same way as other data recovery. However the possibility to recover removed files depends strongly on a file system, device type, and operating system activity.

Overwritten Is Not Recoverable

Really overwritten data cannot be recovered using any modern means. For modern HDD's there are no technologies to recover data even after single cycle of overwritting. But it depends on an OS activity and a fortuity how fast the data is overwritten after removal. Removed files on a system disk may be overwritten during several seconds on a modern OS. It may even worth to immediately unplag the PC power instead of regular shutting it down if you wish to prevent overwriting of accidentally removed data.

Another obstacle to recover removed data is a trim technology used on SSD drives. It is used to mark removed blocks as empty so these blocks are not readable after the removal. Theoretically it is possible to read memory banks directly using special equipment but there is constant rotation as well as another transformation of data on SSD disks which make such recovery job unreliable (however some random fragments of data still can be found).

Anyway it is not possible to surely predict if the data is already overwritten so you should try data recovery anyway. Regarding recovery of super valued data it also worths to contact specialists having special equipment and knowledge.

File System vs Signature Based (Raw) Recovery

FS based recovery allows recovering files with their original names and paths, whilst Raw (signature) based recovery provides only a bunch of files named randomly (see Full Scan). Of course the both may help only if the data is not overwritten.

FS based recovery possibility depends strongly on a file system when removed files are being recovered. Some file systems keep removed FS structures almost untouched after removal while others wipe FS structures immediately. File systems may also support journaling however it may help to recover only the most recent removed data. Raw recovery is a last resort when FS based recovery is not possible.

File SystemFS Recovery
Journal Support 
NTFShigh+ Large files (>2GB) may be truncated to a zero size due to a specific behaviour of Windows NTFS driver
medium- Fragmented files are not recoverable correctly (only the first fragment position is being kept)
low+ Only journal may help to recover some removed files. On Ext FS file names may remain but location info is wiped.

Previous File Versions and Copies

You should take into account there may be previous file versions or temporary copies or copies on other disks.

When you use Windows restore points there may be previous file versions implemented by the OS. Right click the file/directory and check their properties. There may be previous versions available for recovery.