Deleted File Recovery
The picture on the right shows structures that are critical to the layout of data on a hard drive of any Operating system be it Windows , MAC or Flash Drives. If these structures are corrupted your drive will appear empty as RAW or you will be asked to format it.</br>
Recovery of data is usally not a problem in this case.</br></br>
There are also other structures eg FAT or file allocation table and MFT (Master File Table) stored on the Hard Drive which contain the location of your data.
Data Recovery Scenario
The following is an in-depth discussion of how your data can be recovered with corruptions or formats.
It’s late at night and you have an important document to get ready by tomorrow and suddenly the screen freezes, upon rebooting your computer you find your document is lost and that operating system files are corrupted or lost due to machine failure or power loss. You phone your trusty computer whiz who comes around and tells you nothing can be done except that the Operating System needs to be re-installed , wrong. If our whiz understood data recovery then he would know there’s is a good chance the operating system files can be recovered along with the missing document.
All that’s required is an understanding of filesystems and recovery tools. The simplest and most common file system is FAT and consists of a directory table which contains the filename, extension, atrributes (SHR), file size, time, date and starting cluster. The list of clusters numbers or disk positions is contained in a table called FAT the table stores these numbers as a linked list each number indicating a position on the disk. Two copies of the File Allocation Table are kept .
When a file is marked as deleted it’s first letter becomes an underscore, none of the underlying data is touched. This is true of files removed from the recycle bin although the Operating System will quickly reuse the clusters allocated to that file.
Two things are likely to occur with lost or corrupted files the first being that the directory entry is lost and so the file appears gone however all the data is still there and recoverable.
Secondly, File Allocation Tables can also become corrupt however as we still know the first cluster from the directory table we can trace a path thru the linked list of clusters until we encounter a break in the link. If this occurs there’s a very high probability of regaining the lost cluster based on the way clusters get allocated by the disk drive.
So there it is in a nutshell it’s never over until a complete examination has been done and fortunately these sorts of recovery procedures are found in many programs which can be booted off the floppy drive or CDROM.
Some things to note;
- once a corruption occurs it could also be indicative of a drive failing.
- it is possible to overwrite your “lost” files by reusing the computer
Basically all you can do is switch the machine off and leave it until you get someone who can fix the problem.</div>
Data Recovery Scenario 2
Quite often the approach to recovery is to think outside the box as time is always a factor.
An honors student came to me in desperate trouble because she had used her flash drive , which she transported to and from uni, as her primary storage. I cannot emphasize enough that USB drives are a transport option not a backup option. Because of time limitations it was not possible to send the Flash drive of for repair it was however possible to examine the Laptop she had used to write most of the Honors thesis.
Although she had opened and closed the file on the USB drive , Microsoft Word write a backup copy to a temporary location while the file is in use.
The file is deleted when Word is closed, Using recovery tools it was possible to recover all possible Word Documents on the laptop and the save them to a different drive. Then using document indexing tools we were able to recognize the word fragment and recover the bulk of her latest edit.
REQUEST A QUOTE
126 Whatley Crescent Maylands
call: (08) 6180 6959
126 Whatley Crescent
6 Days a week from 8:00am – 5:00pm