2015年2月11日星期三

Why And How Deleted Files Can Be Recovered?


There are various kinds of data recovery and undeleted tools on the market which is inexpensively priced . people with little knowledge on computer may wonder what magic they do to get deleted files back. Is it really a very complex and time-consuming process, or can anyone do it at home? To answer the question, we should first look at what Windows does when you delete a file.

How Windows Deletes Files
Files are stored as blocks of data on the sectors of a hard drive. Sectors can be placed sequentially or be scattered randomly across the drive’s surface. Sector placement depends on how free blocks were arranged at the time a particular file was being saved. If the system couldn't find an uninterrupted block of sectors big enough for saving the file as a continuous sequence, it would fragment the file and write its parts into unoccupied blocks.
Windows stores files on your hard disk, and indexes them in the file system. The file system keeps records of file names, sizes, attributes, and, most importantly, the exact location of actual data on the disk. When you delete a file (assuming the Recycle Bin is off), Windows does not actually erase, zero or otherwise alter the actual data. Instead, it just quickly changes the corresponding record in the file system to mark the file as “deleted”. Neither the actual file system record nor original file data are erased at this point.
As you can see, files aren't really erased when you delete them. Windows makes a change to the file’s record in the file system, advertising the space occupied by the file as available. While the actual data is still there, the disk space it occupies is now marked as available for use. Eventually, when the system needs space to write another file, it may claim that space and store a different file in it. This is the point at which the actual data is lost. Until then, the data still exists on your disk and can be recovered. This very behavior allows various data recovery tools to exist and do their job.
How Tools Undelete Files
If you've accidentally deleted a file and need to get it back, there are some things you should bear in mind:
You should recover the file as soon as possible: As Windows continues to write files to your hard drive, the chances of it overwriting the deleted files increases. If you want to be sure you can recover the file, you should perform a recovery immediately.
You should try to use the hard drive as little as possible: The best way to recover a deleted file from a hard drive is powering the computer down immediately after the file is deleted, inserting the hard drive into another computer, and using an operating system running on another hard drive to recover it. If you try to recover a file by installing a file-recovery program on the same hard drive, the installation process and normal use of the hard drive can overwrite the file.
Windows doesn't include a built-in tool that scans your hard drive for deleted files, but there are a wide variety of third-party tools that do this. H-Data recovery Master is a good option. H-Data Recovery Master and other utilities can scan a hard drive for deleted files and allow you to get back the deleted files.
Download:


If you run the data recovery tool in a timeframe when the file has been deleted but its disk space not yet used by another file, you will be able to get that file back. Of course, many things depend on what kind of a tool you’ll be using.
The simplest data recovery tools will look through the file system for all records marked as deleted. They will then analyze these records in an attempt to determine physical disk sectors containing the data belonging to the file. After a cross-check to make sure the disk space has not been used by another (non-deleted) file, the tool will go ahead and retrieve the content from the disk, saving the data to a new file.
Sometimes, however, this very simple approach will not work. Windows reuses file system records, making the reference to the deleted file no longer available. In this case, you won’t be able to undelete the file with a simple tool. Fortunately, there are tools that employ content-aware signature search analysis techniques to analyze the entire disk surface in order to detect the exact location of a file even if there is no record in the file system.

Solid-State Drives: The Exception

Things don’t look that rosy with SSD drives. When a file is deleted from an SSD drive, Windows will work the same way, leaving the content well alone and only marking the file system record. However, an extra step will be made: Windows will issue the TRIM command, telling the drive that disk space previously occupied by the file became available. The disk then will perform a physical erase of that space, effectively destroying the content of the file forever.



没有评论:

发表评论