There is lot of talking about how a deleted file is recovered and why it is not possible to recover some files at all. You might have noticed that some lost files can be recovered entirely from a disk, including original file names and folder structure and some times files and data may be recovered, but the file names, date/ time stamps and folder paths all jumbled.
To help users, in this article we will take a high level look on how file recovery works in Windows system. For that we need to have basic understanding of how the files are stored in the disk and how they can be recovered. Learning will help you to choose the right data recovery software in data lost cases.
How files are stored in the disk
In DOS/Widows operating system the entire hard drive is divided into several independent parts called as “logical disks” commonly known as “partitions”. Each logical disk is labeled as one letter such as C: D; etc… Each partition is formatted with its own file system type, such as NTFS or FAT32 for Windows. In the beginning of the hard drive itself the information about partition is saved, which further divided in two parts one store info about the disk (folder structure, file system, etc.) and the other stores the data that comprises those files. This division allows users to have better disk management, in turn faster operations and enhanced reliability.
The disk service information contains all info about the partition size; file system type, etc. while info about files and folders contains file account such as file names, sizes, date/times and other technical aspects. This information is backed up on the drive itself, in case original copy becomes corrupted.
File systems have their different way of storing the data, for instance FAT store this info in a File Allocation Table (FAT), whereas NTFS stores it in a Master File Table (MFT).
How computer reads info
When computer needs to access some info it first goes to the info about files and folders and searches for the record of that file. Then, it looks up the address of the file, goes to the specified place on the disk, and then reads the file data.
Some files in disk may be fragmented i.e. they occupy several non-adjacent disk areas. But in Windows Explorer, it is always represented as single file because of the file system that does the task of piecing together the fragments behind the curtains. The info about files and folders stores the addresses of each fragmented piece of data so they can be quickly and reliably retrieved when the computer needs to read the file.
When you delete a file
A deleted file is not vanished immediately from the computer, instead, computer makes some modification to the info about files and folders to designate that the file has been deleted. Windows simply mark the file as deleted, retaining all the data of the file until it become utterly necessary it with data of a new file. That means the file data remains untouched until it becomes necessary to allocate that disk space for another file.
“If no files are going to be written in the disk, then may be the data info about the file and its data may remain forever”.
This practice of Windows has made possible to recover files even after deletion and the portion of the disk that stores the file data also contains a backup copy of the info about files and folders puts additional input that requires for Windows files recovery.
It’s important to note one thing:
If the data on the disk is overwritten, then the old data is gone. No program or commercially available data recovery method can recover it.
This is why it’s of the utmost importance that no new files are written to a disk prior to attempting a data recovery.