File Recovery: Recovering Deleted Files

The client in this file recovery case was having a day like any other. Their PC was running just fine. Nothing on their computer’s hard drive was out of place. When their antivirus software updated itself, they paid it no mind. There wasn’t anything unusual about that. But upon browsing their Documents folder, they noticed quite a few files missing from the directory. The client was shocked. They didn’t remember deleting anything from their user profile. They thought that perhaps their antivirus software might have been responsible for deleting their data.

But regardless of why so many of their files had so suddenly gone missing, they needed those files back all the same. When you lose data, no matter the reason, playing the blame game doesn’t bring it back. Only a data recovery expert can do that. And so the client took the Hitachi hard drive out of their laptop and brought it to Gillware Data Recovery. Our deleted data recovery specialists could take a look at their hard drive and see where their missing data had gone.

---

---

What Your Computer Does With Deleted Data – How Gillware Can Recover Lost Files

When you delete a file from your hard drive, where does it go?

Well—the file doesn’t go anywhere, actually. The file you delete stays in exactly the same place—the rest of your hard drive just ignores it.

When you format a hard drive with an NTFS filesystem, each partition has a special file called the bitmap. The bitmap keeps a record of every block of space comprising the partition volume to plot out how much of the disk is used. Our engineers can use it to recover client data more efficiently. But it also sees use when dealing with deleted data. Unused blocks are tagged as usable space, whereas used blocks are strictly off-limits when you try to write new data. And so when you go to permanently delete a file, the filesystem goes into the bitmap and un-assigns the data blocks containing it as used.

The file still exists. But your hard drive doesn’t see that. All it sees is a vacant lot, on which it can build whatever it needs. Writing new data to the drive can occupy this space, permanently overwriting the deleted file. But until that happens, the file still exists, and is perfectly healthy to boot!

While the NTFS filesystem uses the bitmap, every other filesystem has a system like this for dealing with used and unused sectors. Different filesystems, such as Apple HFS+ and Linux Ext4, approach the issue with different techniques.

To recover lost files, a skilled data recovery engineer must exploit these features of the filesystem. Some filesystems make this easier than others—for example, Ext4 does not play so nicely with deleted files and does not preserve as much file metadata as NTFS or HFS+. Restoring deleted files takes two things: an intelligent and well-trained deleted file recovery expert, and exceptionally robust hard drive analysis tools. Inside Gillware’s data recovery lab, you’ll find no shortage of both.

File Recovery Results – Restoring Deleted Files With Gillware

Our deleted file recovery experts performed logical analysis of the client’s hard drive after creating a complete disk image of the device. Using the powerful analytical tools at their disposal, our skilled data recovery experts could uncover and examine the files deleted from the client’s Hitachi hard drive.

Logical analysis revealed the locations of files that still existed in the “unused” parts of the hard drive. Even though the bitmap no longer marked the blocks containing these files as used, the data was still there and waiting to be overwritten. Our logical recovery engineers, who specialize in recovering deleted files, could even recover the metadata showing which folders most of these files had lived in before they had disappeared.

To cover all of our bases, our engineers also ran a raw scan of the hard drive as well. A raw analysis sifts through every sector on the hard drive’s platters, combing for recognizable file headers. In some cases of file deletion or accidental reformatting, more logical metadata than usual might be lost, making some deleted files more difficult to recover. This is where the raw analysis tools come in. After running a raw scan, our logical file recovery engineers found even more user-created documents hiding on the client’s hard drive.

Our logical file recovery engineers managed to successfully recover the vast majority of the client’s deleted documents. Since the Hitachi hard drive had been in use after the files had vanished, some of the deleted files had been partially overwritten. This led to some file corruption, not all of which our engineers could repair. However, the results of this deleted file recovery case were still very good. We rated this deleted file recovery case a high 8 on our ten-point case rating scale.