It may come as a surprise, but files you delete from your Mac or Windows computer actually remain on the hard drive. As a result, this means that data recovery is possible, but the truth is that no two data loss situations are alike; sometimes it is possible to recover the lost files from the storage medium, other times it is not. The devil is in the details and understanding how data recovery works requires some basic knowledge of how files are stored on disks.
How Files Are Stored
Operating systems divide the physical hard drive into one or several partitions, and sometimes – such as if you format a drive using a Mac’s Disk Utility – you may need to select the partition map to be used. This is very important because this ‘map’ or ‘table’ stores information about the partitions on the disk. A typical partition structure includes hard drive service data – which is the metadata – and information about partition structures and the partition themselves. The latter of this is the “logical disk”, which includes various details such as:
- Information about the disk and the file system.
- Data constituting the stored files.
The first of these contains file records storing file names, sizes, date/times, and other technical information, including the address of the file data stored on the disk. Operating systems store this data in various ways: the FAT file system stores this information in a file allocation table (FAT), the NTFS file system stores it in a master file table (MFT), and the APFS in a GUID partition table (GPT). When a user wants to access a file, the computer checks these tables containing the data about the files and folders, searches for the record of that file, identifies its address, and then accesses the specified physical space of the disk and reads the file data.
In the majority of cases files on the disk are fragmented, occupying several non-adjacent areas. The file system plays a key role in putting the file fragments together and presenting the entire file.
What Happens When You Delete a File
When the user hits delete, the operating system doesn't immediately destroy data. Some operating systems, such as Windows, will mark the file as deleted but in fact retain all the metadata about the file until it becomes necessary to overwrite it with the metadata of a new file. In contrast, macOS completely destroys the record of the deleted file, but the key takeaway is that all operating systems leave the data itself untouched until the space is needed for new data, at which point the old data is overwritten. This also means that if you don't save new data to the disk the information that was deleted will remain there forever.
If we compare file storage to a book, the disk is the book itself and the pages are the blocks allocated to data. The ‘address’ of all the data is located in an index, and if you delete a file the index is updated to represent this change though the data itself is still there on the same original page. The catch is that since you'll check the index first, you won't be able to find reference to that data and it will appear to be gone.
How Data Recovery Software Functions
On launch, data recovery applications will start scouring the disk and attempt file recovery through analysis of the information about files and folders. The file system keeps two copies of this info, with the software checking the second if the first copy is damaged. Here the app will search for information about the folders and file structure and, after processing that information, try to reconstruct the original.
Another method is to search for known file types. This scenario kicks in if the first method yields no or poor results. The problem with this method is that in most cases it isn't able to reconstruct the original file names, date/time stamps, or the entire folder and file structure of the disk. There is an advanced level of file recovery, however, which is the data recovery software's ability to search for specific sets of file signatures.
There are things to bear in mind before running any software on a drive that has crashed, though. First, if you didn't keep an eye on the S.M.A.R.T. status of the disk, then you won't know whether it is logical or mechanical damage. Second, it is wise to connect the drive to another computer and first check its health before running data recovery software.
Best Data Recovery Software of 2020
Best Data Recovery Software for PC
|Editor's Choice 2020|
Best Data Recovery Software for Mac
|Editor's Choice 2020|
- Can I Recover All My Files?
- Can I Recover Data From a Formatted Hard Drive?
- Can I Recover Deleted Data From My Flash Drive or Memory Card?
- Can I Recover Deleted Data From My HDD?
- Can I Recover Deleted Data From My iPhone or Android Smartphone?
- Can I Recover Deleted Data From My SSD?
- Can You Recover Corrupted Files?
- How Do I Get All My Files Back With Their Names Intact?
- How Does Data Recovery Work?
- How Is Information Stored on a Computer?
- How Much Does Data Recovery Cost?