CnW Recovery can get back the files you have deleted
It is fairly well known that when the delete key is pressed on a computer, the file is not totally removed from the storage medium. What actually happens is very dependent on the operating system software, and to some extent the type of media being used. As a rule of thumb, it is normally possible to recover the files totally if no other data is written to the disk, ie the disk is shut down and sent to us for recovery.
With NTFS, the default setup for deleting files is to place them in the recycle bin. The operating system will then restore them. If the recycle bin is emptied, there is no Undelete key on the PC to restore them - but CnW normally can.
When a file is deleted, the directory entry is removed, and the space the file was using on the disk is shown as available for future storage of any new file. Typically the directory entry is just marked as a deleted entry, but again, this means that any new file placed in the same directory location could overwrite the old file name.
As long as the disk hasn’t been used too much, CnW can recover most, if not all, deleted files. One analogy for deleted files is if a telephone directory is torn up, the telephone numbers still exist, they are just difficult to find.
There are several options that can be used for deleted files recovery depending on the operating system and what has happened to the system since deletion.
- The easiest method is to search through existing directories for files that have been tagged with a ‘delete’ code. For instance on DOS disks, this means the name starts with the hex value E5. A deleted directory entry stores the a pointer to the start of a file, and so for a short file, recovery is straight forward. Long files on disks can end up being stored in several sections. ie the file is fragmented and each operating system handles the file allocation in a different way. For DOS (FAT 16, FAT32) there is a table giving the location of the next section (or cluster) of the file. When a file is deleted, these table entries are cleared and so the continuity of the file is harder to restore. Fortunately there are methods where unattached file fragments can be read, and eventually, probably manually, tied back together again. With an NTFS disk the file allocation is rather different. The directory entry has a short table of file runs. If there are only a few runs, the chances are that a file may restored very accurately. This is helped by the fact that a run can be extremely long so only when one gets to multi GB files does fragmentation become an issue.
- The next method to recover files is to scan the disk for all file control blocks. On an NTFS system, there is a record for each file within the MFT. It may be isolated from the formal directory structure but often file names and dates will be valid. In many cases, these files get restored onto subdirectories which are just numbered sequentially. The same issues of fragmentation always exist, but it can be extremely successful
- A final method that can be used for recovering deleted files, which can be rather slow, but is to scan the total media and extract all files of the correct type. Thus if it is Excel spread sheets, these can be extracted from the raw data. It is not possible to give the files names, but if all else has failed, the name of the file is not very important. For digital photos, fortunately the file name is often irrelevant.
With the CnW Recovery procedure, the disk is analysed to see where current files are. If a deleted file has been fully, or partially overwritten, this will be detected, and files will restored to different subdirectories, to indicate they may be corrupted. However, at times, a partial file is still useful, even though for files such as Word documents, text may be viewable, even though the formatting has been lost.
FAT32 deleted files
There is a major problem with some FAT32 disks. Although it is often possible to detect the file name of a deleted file, some of the information that states where the file was stored is removed when the file is deleted. However, CnW Recovery have developed routines so that most files can still be recovered. This overcomes a common problem within the world of data recovery.
Accidents will always happen but prevention is better than cure.
CnW Recovery Lewes East Sussex UK