Recovering deleted files...

  vaughan007 11:24 25 Mar 2003

I know this is a helpdesk. But I just could not resist the urge to dispel a bit of a myth that floats around from time to time.

And the myth is as follows :- That deleted files can easily be recovered from you hard disk. Even if you deleted them years ago.

Well, it is possible. But not always and quite often isn't possible.

Basically, when you delete a file in windows and empty the recycle bin the file is actually still on your hard disk. It is just that the computer has now been told that it can write onto the part of the disk where the file was saved. With me so far? Therefore, the file can only be recovered as long as that part of the disk is never used again.

Basically, if you delete a load of files from your hard disk and then fill up your hard disk with a load more files and delete this second lot, the original first lot of files can never be recovered because the part of the hard disk where they were stored has been re-used and had further information stored on it. So the second lot could be recovered but not the first lot.

Still with me?

In addition to this, when you defragment your hard drive. Files that have been deleted, but are still resident on the disk drive, are often scattered all over the place. Especially after a few defrags.

Think of it this way. If files can ALWAYS be recovered we should have infinite storage on a Hard drives.....which we dont.

Any comments are welcome :-)

  Tog 13:30 25 Mar 2003

Having worked on equipment containing sensitive data, I can assure you that it is possible to rebuild overwritten files on a Hard Drive, though not using the original heads.

The reason you can't have infinite storage is because it isn't a reliable means of recovery, there are physical limitations as to how much "history" can be accessed and the costs are incredibly prohibitive.

Our classified media was stripped and burnt to prevent data being reclaimed. That works a treat as it destroys the magnetic coating.

  Craneop 14:25 25 Mar 2003

click here
Gutmann's paper "Secure Deletion of Data from Magnetic and
Solid-State Memory" and they are selected to effectively
remove the magnetic remnants from the hard disk making it
impossible to recover the data.

  vaughan007 15:15 25 Mar 2003

Hello Tog,

Good to exchange messages with you again.

I am intrigued how data can be recovered from over-written files. Can you please explain more? Or is it mega-technical stuff? (which I reckon it probably is). It seems logical to me that when the same part of a disk drive is used again the magnetic image is altered and therefore removes (nearly or at least some) all of the original data that was originally stored there. Some of the data may remain, but it seems to me that rebuilding the file would require a certain amount of conjecture as some of the file would be permenantly damaged or removed.

You say there is physical limitations as to how much history can be retrieved? This leads me to believe that writing over disk space time after time would surely make very old data that had been written over several times un-retrievable, even if it can still be retrieved after the first over-write. Surely after several over-writes the data becomes so corrupted that it can no longer be understood.

I am intrigued to know more and I hope you have the time to explain a little bit more in depth.


  Tog 21:33 25 Mar 2003

When we used to set up the heads on old removable drives the size of a washing machine (256Mb), part of the setup was to insert a reference disk that had a specific pattern on each track and align the heads to give a certain pattern and phase shift between the track being read and a synch signal produce by a mechanically set ring at the centre of the disk. When the wrong disk was used you could see spikes on the rising and trailing edges. The nice instructor told us that this was caused by new writes not being exactly on top of the previous writes.

I also remember from the days of magnetic core memory (similar principle) that you can tell the previous state from the amplitude of the signal produced when a read is performed. i.e. a "1" overwriting a "0" gives a lesser return than a "1" over another "1" (Ooh, half currents, gently drifts back to the good old days..)

Ahem, I am presuming that this is why the data can be recovered.

  Tog 21:40 25 Mar 2003

Oh, and yes, if you write a certain number of times it will get allegedly get rid of the data, hence Norton uses something called a government wipe which writes patterns of data up to 39 times! However, certain destruction is ensured by physical means.

  vaughan007 00:18 26 Mar 2003

Thank you for that explanation, Tog.

You really are a true master of this forum.

From what you wrote in your last posts explaining the theory, actually retrieving data that has been written over several times may not be impossible.....just almost impossible. lol.

Thanks for that. I (at least) thought it was very interesting.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Best Black Friday Deals 2017

How modern book design was influenced by illustrated manuscripts

Best Black Friday Apple Deals 2017

Les meilleurs logiciels de montage vidéo gratuits (en 2017)