Deleted Photo Recovery Case Study: How We Recover Lost Files

The client in this data recovery case came to us after 34 gigabytes of photos had been deleted from their laptop. Once they had realized the amount of data they’d lost, they removed the solid state drive from the computer and sent it in to Gillware. This was a job for our deleted photo recovery experts.

---

---

When you delete a file, you haven’t destroyed it. What you have done is, essentially, send it to purgatory. This is what happens when you delete something from your hard drive:

Deleted Photo Recovery: Where Do Your Photos Go?

In order to work quickly and efficiently, the NTFS filesystem (like most filesystems) takes a few shortcuts. One such shortcut has to do with file deletion. When you tell your PC to empty your recycle bin, you might think you’ve just erased those files from existence altogether. You have, in fact, done nothing of the sort. Erasing those files takes a lot of work that your hard drive would rather not do. So instead of doing that, the filesystem looks at the data blocks containing the deleted data and marks them as “unused”. The filesystem recognizes all “unused” space as blank. From your perspective, the data you’ve deleted is gone.

This shortcut has a twofold effect on deleted data recovery.

First and foremost, it makes our deleted data recovery services possible. If your hard drive or solid state drive automatically zeroed out any sector it was told to delete, it wouldn’t be possible at all to recover deleted files. Once a sector has been overwritten, there’s no way to “roll back” the sector to its previous state. An experienced data recovery technician can analyze a hard drive’s or SSD’s “unused” space and pluck out deleted files, bringing them back to life.

The second effect, however, isn’t quite so beneficial. When you mark space on a drive as “unused”, you tell the drive that it’s okay for it to reuse that space. As previously stated, you can’t “undo” overwriting a sector. Whenever you make a new file after deleting some old ones, some of the new file might land right on top of an old file. This can result in heavy corruption to a deleted file. It can even make the deleted file just cease to exist altogether.

Pitfalls to Avoid and Best Practices for Deleted Photo Recovery

If you delete something important from your computer, the worst thing you can do is keep using it. Even booting up your hard drive or SSD writes a small amount of new data to your drive. Even this new data can trample over the deleted data. The best thing to do if you want your deleted files back is to turn off the drive immediately and remove it from your computer. You can turn the drive on safely all you want—just don’t boot from it. And you certainly should not install or run any data recovery software from the drive itself.

When you’ve got important files you need to recover, it’s important to be wary of widely-available data recovery software. You can run file recovery software safely as long as the software hasn’t been installed on the affected drive itself. You just need to connect the drive with the deleted data to a new computer. But you need to be wary of the pits software data recovery tools can fall into, especially free tools.

Many data recovery software tools can handle simple and optimal situations, but choke when it comes to more complex issues. For example, these tools might find metadata pointing to where a deleted file should be and serve it up to you, even if the file itself has been partially or completely overwritten with new data. Without powerful and intelligent analytical capabilities, the software might not even know that the file it’s given you isn’t even usable.

A simple tool can solve simple problems. But it takes a powerful data recovery tool, in the hands of experienced data recovery professionals, to solve complex problems. When you need to restore deleted files, it’s best to let the professionals solve your problem.

How to Restore Deleted Files, the Gillware Way

To recover lost files, Gillware has its own suite of data recovery software tools. In the hands of an experienced and well-trained data recovery technician, these tools prove exceptionally powerful.

To restore deleted files, our data recovery technicians analyze every inch of the storage device. They sift through the drive sector by sector and pick up any scrap of filesystem metadata that can point to deleted files. Our engineers can also analyze file headers to pick out files that otherwise would have been hopelessly lost, and to gauge the amount of corruption among deleted files.

The file header marks the beginning of every file you create. Every file type has a standard file header, which it shares with all other files of the same type. By scanning for file headers, our engineers can dig up lost files just by their header. In addition, when the metadata points to a file that has been so overwritten that its header no longer exists, we can easily identify the file as corrupt by analyzing its (lack of a) file header.

Intelligently identifying valid file headers is something our proprietary data recovery software tools excel at. On the other hand, other data recovery software tools, especially free data recovery apps, can fail miserably. In situations where data has been lost or deleted and significant file corruption has ensued, widely-available data recovery apps can’t always intelligently analyze the results of their efforts. On the other hand, Gillware’s proprietary software tools can. Our engineers can cross-reference file headers to determine how much of a client’s recovered data actually works.

Deleted Photo Recovery Results

Our data recovery experts managed to dredge up the 34 gigabytes of deleted photos our client had lost. There was, however, some corruption. By analyzing the integrity of the recovered files’ headers, our engineers could tell how many of the recovered photos still functioned. We could also show the client which files had functional headers and which did not when we sent them a list of results. After perusing the list of recovered files, the client confirmed that we had successfully recovered enough of their deleted photos to meet their needs. We rated this successful deleted photo recovery case an 8 on our ten-point scale.