Deleted Data Recovery Services

Where Does Data Go When It Gets Deleted?

If you drag a file into your computer’s trash or recycle bin, you can still go right back in and drag it out. But what happens after you’ve emptied the bin? What if you delete something from your external hard drive? Is your data lost forever?

Different filesystems all handle deleted data a little differently. The most common filesystems we see at Gillware are Windows NTFS and Mac HFS+.

In the NTFS filesystem, the master file table identifies and points to the physical locations of every file on your data storage device. It’s constantly being updated and rewritten as files are created and deleted. The NTFS filesystem also has a feature called the bitmap. The bitmap keeps a little record of which spaces on the drive are being used and which are not.

When a file is deleted, the bitmap updates itself and says that the space occupied by that file is empty. The space isn’t empty, though. The filesystem hasn’t changed the sectors containing the deleted file. It has only flagged them as unused in the bitmap.

The same principle is at work in HFS+ filesystems, although the underlying mechanisms are a little different. Files are defined by the catalog and extents overflow files. The allocation table keeps a record of what parts of the hard drive are in use.

It’s important to avoid using your data storage device after file deletion has occurred. When you delete data, there’s suddenly a convenient new bit of “unused” space where your deleted file is. If you keep creating or modifying files after you’ve deleted something, you could end up writing data to that space. This can partially overwrite or even completely destroy your deleted file.

Think of your hard drive as a city and each file as a building. Deleting a file isn’t the same as knocking a building down. It’s more like putting a big “CONDEMNED” sign on the front door. No one is allowed in, but the building is still there. Eventually, the spot gets bulldozed and a new building gets put up in its place. But until then, your data is still safe.

Some Linux filesystems, such as Ext4, handle deleted files a little differently. When a file is deleted from an Ext4 partition, the extents pointing to the file’s location are erased. Sometimes this can be undone using the filesystem’s journaling capabilities. Deleted data recovery from Linux systems can be more difficult work than deleted data recovery from Mac or Windows systems.

How Does Gillware’s Deleted Data Recovery Service Work?

There are a lot of software data recovery programs out there that say they can help you if a critical file has been deleted. We don’t trust them. We use HOMBRE, our own in-house software, for deleted data recovery.

There’s a lot of danger involved in trying to recover deleted files on your own. If you install a data recovery program, you’re already risking the integrity of your lost data. Most software tools also lack the robust suite of analytical tools our own software has. HOMBRE has been developed by our data recovery engineers, exclusively for our data recovery engineers.

The process for deleted data recovery starts with a full write-blocked forensic image of your data storage device. Our engineers have to make an exact duplicate of your hard drive, all the way down to the binary level. Your filesystem isn’t going to freely tell us where all the data on the drive lives. This is mainly because it doesn’t actually know where the deleted data lives. It can’t find those files on its own anymore.

To recover deleted files, our technicians analyze the entire device. HOMBRE’s relational database helps them sort through all of the data on the device to turn up deleted files. Our engineers can restore these deleted files and assess them for file corruption.

If a data storage device has been in use since files were deleted from it, the likelihood of some of the deleted files becoming corrupted increases. Our engineers refer to this kind of corruption as hard corruption. The overwritten sectors can’t be rolled back to their previous states. There are many situations where our data recovery technicians can overcome hard corruption and repair damaged files.

If our technicians notice corruption in any critical deleted files, we make an effort to repair those files. Any irreparable corruption is noted on the list of recovery results. The last thing we want is for one of our clients to unwittingly receive nonfunctional data from us.

In addition to retrieving data in cases of file corruption, Gillware is also uniquely well-equipped to assess situations where a hard drive is not recognized.

Why Should I Choose Gillware for My Deleted Data Recovery Needs?

At Gillware, we have taken steps to make the entire deleted data recovery process as financially risk-free as possible.

We start with a free evaluation of your deleted data recovery situation. We even offer free inbound shipping for any clients in the continental United States. Once our technicians have assessed the situation, we present you with a quote and probability of success. If you approve the quote, we don’t ask for payment yet. We go ahead and do the whole recovery process first.

Our deleted data recovery technicians recover as many deleted files as possible. We inspect the recovered data for corruption and repair any critical files as needed. We don’t show you a bill until we’ve successfully met your goals and recovered your critical data.

Our deleted data recovery technicians have logged thousands of hours of data recovery work over the years. They are incredibly well-acquainted with the ins and outs of data storage filesystems. Our financially risk-free service guarantee isn’t just because we hate when people give us money without getting anything in return. It’s also because we are confident in our data recovery engineers’ abilities to retrieve your deleted files.