TOC · Work · Data Recovery

Removed Data Recovery

Removed recovery is generally performed the same way as other data recovery. However the possibility to recover removed files depends strongly on a file system, device type, and operating system activity.

Overwritten Is Not Recoverable

Really overwritten data cannot be recovered using any modern means. For modern HDD's there are no technologies to recover data even after single cycle of overwritting. But it depends on an OS activity and a fortuity how fast the data is overwritten after removal. Removed files on a system disk may be overwritten during several seconds on a modern OS. It may even worth to immediately unplug the PC power instead of regular shutting it down if you wish to prevent overwriting of accidentally removed data.

Another obstacle to recover removed data is a trim technology used on SSD disks (as well on modern SMR HDD disks). It is used to mark removed blocks as empty so these blocks are not readable after the removal. Theoretically it is possible to read memory banks directly using special equipment but there is constant rotation as well as another transformation of data on SSD disks which make such recovery job unreliable (however some random fragments of data still can be found).

Anyway it is not possible to surely predict if the data is already overwritten so you should try data recovery anyway. Regarding recovery of super valued data it also worths to contact specialists having special equipment and knowledge.

Removed Data Recovery Based on a File System

Unlike Raw recovery (signature based), FS based recovery allows recovering files with their original names and paths, and accounting the fragmentation (see Full Scan).

However if the data is lost due to removal then FS based recovery ability depends strongly on a file system type. Some file systems destroy FS structures immediatelly while others only mark files as removed keeping them available until not overwritten. File systems may also support journaling however a journal keeps a small amount of the most recent operations only. Raw recovery is a last resort when FS based recovery is not possible.

File SystemAvailability 
by FS
Remarks
NTFShigh Large files (>2GB) may be truncated to a zero size by Windows NTFS driver
ReFS, APFS, Btrfshigh Copy-on-write strategy leaves old structures on the disk until they are overwritten (unless trim is used)
FAT,
ExFAT
medium Only the first file fragment address is known after removal, on FAT32 the first fragment address may be not known exactly as well, no journal
HFS+/X,
Ext3/4
low On Ext FS file names may retain but file location information is wiped out

Data Recovery after Format

Full format in Windows, starting with Windows Vista, overwrites the partition with zeros. Still, only not rewritten data can be recovered (for example, formatting was interrupted, previously there was a different partition size, etc.).

Fast formatting usually causes only some loss of the original FS structure, some files. However, the initial fragmentation of FS structures, changing formatting parameters, the presence of garbage, and interspersions of other FSs (for example, from disk images) can significantly worsen the result of FS reconstruction.

When FAT / exFAT is formatted cluster tables containing information for restoring fragmented files are cleared.

Previous File Versions and Copies

You should take into account there may be previous file versions or temporary copies or copies on other disks.

Windows restore points is enabled may keep previous file versions before removal. Right click the file/directory and check their properties. There may be previous versions available for recovery.