Recovery of deleted files from formatted hard drive

Rather often we face the situation, when a user has casually removed the necessary files from a hard disk, USB removable disk or a memory card. It can be a simple deleting operation, logic formatting or a file (directory) overwriting. What should one do in such a case?

First of all, switch power off a computer. As soon as you have understood, that you have accidentally deleted the necessary information or formatted the wrong section (disk). Switch power off not in a correct way using "Start -> end of work", but pull a power cord out of the plug, or switch off a power unit. Why it is necessary to switch your computer off this way?

The matter is, that having deleted a file (we speak about simple deletion by means of Windows, without use of third party utilities) you physically delete not a file itself but a file record in the file accommodation table. And the system starts to consider place, occupied by the file or directory, free. At any moment OS can overwrite something else on a free, from the OS' point of view, place. It can be OS service information as well. At usual end of work, the buffers, transactions and so on are reset, completed and come to the end at the storage disk. And switching off a computer in the classical way you risk to make a file recovery impossible.

The same concerns the formatting process. At reformatting and remarking of a disk logic space data on the section size, cluster, files accommodation table location are overwritten. Before overwriting the old data remain in the storage disc. There is a probability of their successful recovery. If third party utilities are used for deleting (for example, PGP), not only a file record but also the file place is overwritten. This action is called wipe or security erase. Data recovery after such deleting is practically impossible. There are methods based on OS and FS features, but here the situation is from the category " it depends " and chances of success are insignificant.

There is a lot of programs for deleted files or data from the formatted section recovery. They are good enough in their own way, but have one common fault - these programs give in to fragmented files. What is a fragmented file? Imagine a file divided into two equal parts. The file beginning (its signature) starts at 1000 LBA and lasts up to 2000 LBA. The second part lays within 3000 on 4000 LBA. The information on parts quantity and their site is written down in the file accommodation table. If the file is deleted, this recording will be erased. The automatic recovery program is unable to recover a fragmented file. Therefore, if your disk has had a strong file fragmentation, you risk to receive injured data as a result of such program work. Information recovery in such cases is a nontrivial task. Even having specialized software, an expert has to spend a lot of time and efforts for the disk space analysis, search of signatures, relevant fragments and attempt to glue them in a single whole.

I have got enough experience in deleted information recovery in file systems of various types. If you have accidentally deleted the necessary data or have formatted a disk, just tell me. I shall try to help.

In "Articles" section materials about current tasks on deleted data recovery are renewed regularly, so you can get additional information on the matter.