Understanding File Recovery Process

File recovery process can be briefly described as drive or folder scanning to find deleted entries in Root Folder (FAT) or Master File Table (NTFS) then for the particular deleted entry, defining clusters chain to be recovered and then copying contents of these clusters to the newly created file.

Different file systems maintain their own specific logical data structures, however basically each file system:

Has a list or catalog of file entries, so we can iterate through this list and entries, marked as deleted
Keeps for each entry a list of data clusters, so we can try to find out set of clusters composing the file

After finding out the proper file entry and assembling set of clusters, composing the file, read and copy these clusters to another location.

However, not every deleted file can be recovered, there are some assumptions, for sure:

First, we assume that the file entry still exists (not overwritten with other data). The less the files have been created on the drive where the deleted file was resided, the more chances that space for the deleted file entry has not been used for other entries.
Second, we assume that the file entry is more or less safe to point to the proper place where file clusters are located. In some cases (it has been noticed in Windows XP, on large FAT32 volumes) operating system damages file entries right after deletion so that the first data cluster becomes invalid and further entry restoration is not possible.
Third, we assume that the file data clusters are safe (not overwritten with other data). The less the write operations have been performed on the drive where deleted file was resided, the more chances that the space occupied by data clusters of the deleted file has not been used for other data storage.
Also if your hard drive is almost to capacity there is more of a chance the cluster where the deleted file is will be written over. On a drive with a lot of free space there is a better chance any file being written to the drive will be written to a cluster where there is not any deleted data is stored.

Important

PROTECT THE DRIVE LOCATION WHERE YOU HAVE ACCIDENTALLY DELETED FILES.
Any program that writes data to the disk, even the installation of data recovery software can spoil your sensitive data.

DO NOT SAVE DATA ONTO THE SAME DRIVE THAT YOU FOUND ERASED DATA, WHICH YOU ARE TRYING TO RECOVER!
While saving recovered data onto the same drive where sensitive data was located, you can spoil the process of recovering by overwriting table records for this and other deleted entries. It is better to save data onto another logical, removable, network or floppy drive.

IF YOU HAVE AN EXTRA HARD DRIVE, OR OTHER LOGICAL DRIVES THAT ARE BIG ENOUGH, CREATE A DISK IMAGE.
A Disk Image is a single-file mirror copy of the contents of your logical drive. Backing up the contents of the whole drive - including deleted data - is a good safety precaution in case of failed recovery. Before you start recovering deleted files, create a Disk Image for this drive.

Visit our Help and Tips Forum to ask any troubleshooting questions.

Visit our new Repairspot FAQs Page.

Back to Computer Repair

Back to Help and Tips

Looking for a book on computers?

Search at abebooks.com!

Need some software to help you recover your files or your operating system?

Here is some recovery software found on Ebay!