Deleted Files and Partitions
Data Recovery ScenarioThe following is an in-depth discussion of how your data can be recovered with corruptions or formats. It's late at night and you have an important document to get ready by tomorrow and suddenly the screen freezes, upon rebooting your computer you find your document is lost and that operating system files are corrupted or lost due to machine failure or power loss. You phone your trusty computer whiz who comes around and tells you nothing can be done except that the Operating System needs to be re-installed , wrong. If our whiz understood data recovery then he would know there's is a good chance the operating system files can be recovered along with the missing document.
All that's required is an understanding of filesystems and recovery tools. The simplest and most common file system is FAT and consists of a directory table which contains the filename, extension, atrributes (SHR), file size, time, date and starting cluster. The list of clusters numbers or disk positions is contained in a table called FAT the table stores these numbers as a linked list each number indicating a position on the disk. Two copies of the File Allocation Table are kept .
When a file is marked as deleted it's first letter becomes an underscore, none of the underlying data is touched. This is true of files removed from the recycle bin although the Operating System will quickly reuse the clusters allocated to that file.
Two things are likely to occur with lost or corrupted files the first being that the directory entry is lost and so the file appears gone however all the data is still there and recoverable. Secondly, File Allocation Tables can also become corrupt however as we still know the first cluster from the directory table we can trace a path thru the linked list of clusters until we encounter a break in the link. If this occurs there's a very high probability of regaining the lost cluster based on the way clusters get allocated by the disk drive.
So there it is in a nutshell it's never over until a complete examination has been done and fortunately these sorts of recovery procedures are found in many programs which can be booted off the floppy drive or CDROM.
Some things to note;
- once a corruption occurs it could also be indicative of a drive failing.
- it is possible to overwrite your "lost" files by reusing the computer.