Data loss is an error condition in information systems in which information is destroyed by failures or neglect in storage, transmission, or processing. Information systems implement backup and disaster recovery equipment and processes to prevent data loss or restore lost data.
Recovering deleted data from a hard drive is generally possible because typically the actual data is not deleted. Instead, information about where the data is stored is removed. In this article I will explain how data is stored on a hard drive, what happens when files are deleted, what formatting a hard drive does, and why it is impossible to recover files after they were overwritten.
When data is overwritten, the magnetic domains on the HDD are re-magnetized. This is an irreversible process that physically removes information previously stored in this location. While some residual physical traces of the changes (or none changes) in magnetization potentially remain, which may theoretically allow a partial restore, this would require the use of a magnetic force microscope or similar technologies, none of which have been shown to recover data successfully so far (although you never know what’s going on in secret government intelligence labs). So in essence, there is no software or other technical way known to the public that can restore overwritten data.
What Happens When Data Is Deleted?
In a RAM module, the organizational structure is very flat. When data is removed from memory, the actual information vanishes instantly. Also, when power is lost, the capacitors quickly discharge and hence all information is lost.
The situation on a HDD is completely different as information is stored in two ways. First, data is stored physically on the magnetic hard drive. Secondly, all stored data is managed by a file system, which creates an information table revealing the exact location of data, i.e. where on the hard drive a certain file is stored. This is necessary because one file can be stored in different locations across the hard drive. The operating system then uses this table to locate files and put together the pieces of large files.
When a file is deleted, typically only the information stored in the file system’s table is removed. Since it would take too long to delete the actual file, the physical location of the data remains untouched. When the operating system wants to store new files, however, it consults the table for available space. Since the location of the deleted files was marked as vacant, the operating system may then write new data over the old data, which terminally deletes that information.
Generally when a file is deleted, the file system makes no effort to erase the actual data from where it is physically stored on the disk. The file system deletes files by simply breaking the file name. In windows and DOS, the delete command simply replaces the first letter of the filename with a question mark. This indicates to the file system that the file is no longer needed and any space it occupies can now be treated as blank space, even though it isn’t. To recover the lost file, assuming no new files have been written to that space, all one needs to do is restore the file name. This can be done manually, but it is far simpler (and generally more effective) to use a file recovery utility. If it is desired to permanently delete the data such that it cannot be recovered, the data must be over-written, preferably many times over.
We’ve all been using computers for a while now and I bet none of us have been spared from at least one data loss related problem in our technical “career”. Data is so easily losable that you’re practically forced to make backups for everything you have, for obvious safety reasons. Data loss can occur due to several reasons, including:
Human error - human error factors include everything from “oops, I accidentally pressed delete” to overwriting files, moving them around, formatting over essential files and so forth. Basically, of the three types of data loss causes, human error ones are the easiest to avoid and yet they are the most common, because of the users’ low computer skills, impatience or forgetfulness.
Logical damage - logical data damage takes place at file structure level as opposed to physical level. Logical damage is more common, as it can be caused by numerous additional factors such as power outages, system crashes, driver problems, RAID controller issues and so forth.
Physical damage - when your data storage unit gets physically damaged, data recovery is often difficult. Physical damage can translate into a badly scratched CD or DVD containing essential data, a failing hard disk head or motor and so forth. Physical damage can be avoided, but you can never really protect yourself from it 100%. A hard disk for example, can break down due to aging, constant workload and so forth. CDs and DVDs aren’t fully protected even if you keep them in the cleanest, scratch-free conditions possible.
If your hard disk blows up on you, there’s absolutely nothing to be done about it and no specialized data recovery program or data recovery professional will be able to help you out. But not all hardware (physical) problems fall into this category. For example, a hard disk with a failing motor still holds a chance for data recovery, whereas if the section that holds the logical data gets burnt out or magnetized, you most likely have no chance of getting anything back. Some physical problems may be partially fixed, with only a part of the data being recovered. Although this is never a reason to cheer for, you can at least scavenge up some of your lost data.
If you’re a simple user that lost some important data, you won’t really be interested in knowing WHY you lost it, but rather if you can get it back. Still, data recovery may often depend on the “WHY you lost it” factor. And unfortunately, in some rare cases, data recovery becomes impossible and the most common of data loss categories is the physical damage one.
The easiest type of data loss to recover is, fortunately, the one falling under the human error category (fortunately – because this is also the most common). When you delete a file from your operating system, it won’t show up in the file structure anymore, but that doesn’t mean it’s gone forever. What the operating system does is to store away that file on a specific sector of your hard disk, where it is held for safe keeping. The only way you can truly delete these files is by overwriting that sector with new data, over and over again. That’s why time is an important factor when it comes to data recovery. If you deleted a file yesterday for example, chances are that your system didn’t overwrite it with anything else in that “safe closet” on your hard disk. However, if you deleted it last year and subsequently deleted, overwritten and moved files around your hard disk since then, chances are data recovery becomes impossible.