Recovery of Deleted Files – Possibility and Prevention and How to Recover them

What happens when you delete a file? It goes to the Recycle Bin. What if you clear the Recycle Bin? Is the file really deleted, and cannot be recovered. If you think so, then you are wrong. It still exists at some corner of your hard disk, even when you have deleted it and even cleaned the recycle bin. You know what it means? Recovery of the deleted files by unknown and strange people, hence a breach of privacy.

If you have any confidential files, then these files can easily be recovered by other people, even if you are under the impression that you have deleted them. It is one of the most important points while disposing your old hard drive or your old computer.

What is the exact process which occurs when a file is deleted?

A pointer is created which points to where your files are located in your hard disk. This is how Windows and other Operating Systems keep a record of how your files are being organized in your hard disk. Each File and each Folder has a pointer associated with it, which informs the Operating system the beginning and the end of the data of the file or the folder.

Whenever a file is deleted, actually only the pointer of the file or the folder is removed from the record and the sector which contained the file or the folder is marked as available. From one point, the system shows to you that the file is no longer present in the system and has been deleted from the hard disk, and in actual the file is no more present for the Operating System. And it also shows that the sector which kept the File or the Folder is now free and can be used for other data storage.

But the file is still recoverable. It is recoverable until and unless some new data is overwritten at the place where the old deleted file existed. There are many recovery programs which let you to recover the deleted files, which they may perform properly if they are not replaced by some other content, and they may then successfully restore the deleted item. A partial recovery can even be made, if the partial data of the deleted file or folder is replaced by some other new data.

A Good news is that, such a case is not possible on solid state drives (SSD).

Why the delay in deleting the files?

It’s a fact to wonder. Why doesn’t the Operating System simply delete the file actually from the hard disk, instead of just removing the pointer form its records? The reason is pretty straight forward. Removing a file’s pointer from the record and marking the sector as available is much easier as faster. If compared to actually overwriting each bit of the data with something junk is a pretty hectic and time consuming process for an Operating System to perform. No matter we wonder as to why it takes hours to copy data, and only seconds to delete the same data! Take an example of deleting some 15GB’s of data from the hard disk. Removing the file pointer is much faster than replacing the bits of those 15GB’s of data. Replacing each bit of the data is like copying the file all over again, but this time simply replacing them with random bits.

This is the reason why the files are not actually erased from the hard disk, as it increases the performance and save loads of time. If you are in a need to actually delete a file from the hard disk by erasing all its bits, then go ahead and use file shredding tools available.

Solid State Drives have its own method

All the above information which you read, mostly it doesn’t apply to the Solid State Drives. The modern SSD’s have a support of TRIM, and when we use such a TRIM enabled SSD’s, the deleted files are erased from the hard disk immediately, and there are no chances of recovering the files easily. These drives have flash cells. These flash cells cannot be overwritten with data, rather you must have the contents of the flash cells to be erased completed before a new data is written on them. This is the reason, the Operating System have to erase the files at that moment itself when deleting the files so that in the future the performance is not reduced.  If the flash memory were not cleared, then before writing new data to the old flash cells, first they would be required to be erased, and then it would be possible to write the data, which would really make writing the new data on flash cells a slow process. As the time wouls pass by, the procedure might even get slower.

Recovering of deleted files: How to Prevent it?

What if you have some private and confidential data on your hard disk? What if you have got financial documents and some sensitive information on your hard disk? You will have to worry about its recovery, even after it has been deleted from the hard disk. While selling or disposing your hard disk or your computer, such a thing is quite a concern. So, what shall we do?

There are various tools available in the market which replaces the drives free space with junk data. In this manner all the deleted files bits will also get replaced, and hence the file becomes pretty much non recoverable. Tools such as CCleaner have an integrated tool named as Drive Wiper which does the above mentioned task.

Tools such as file-shredding applications make sure that none of the deleted file can be recovered. An example in this category would be a tool names as Eraser. By using such shredding tools, the file gets deleted, as well as all the data is over written by some junk in an entire manner. So, when you shred a file, recovering it would become a hard task to be performed. However, there may be cases when this might not actually work. Let us take a scenario in which the shredded file already had a copy made which was deleted earlier. This would simply mean that the original file is still lying around somewhere in your hard disk which has not been exactly been shredded.

The shredding of files takes more time than deleting a file. So it is generally recommended and followed as well only for the confidential files, which you really don’t want or let anyone else to recover them ever.

Disk wiping software, such as the Darik’s Boot and Nuke (DBAN), may be used which really prevent others from recovering the deleted data. It’s a good idea to wipe your hard disk if you are getting rid of your computer system or a hard, by either selling them or disposing them. Simply use the DBAN for the purpose. Use a CD, burn DBAN to it, and boot your computer using it. Use it to wipe the data. Remember that it will wipe everything, ranging from your personal files to useless junk data to even the Operating System Files. Use it only when you are done with your entire job with the system or the hard disk, before getting rid it.

There are several people who argue that the recovery of the files after a wipe is still possible. But, various evidence have proven that wiping the hard disk once is enough to reduce the possibility of recovery.

How to recover the deleted Files?

If you want to recover a file which you have deleted accidently, then please make a note of the below points first:

  • Reduce the hard disk usage to the minimum: One should power down the system immediately after the file is deleted, so that your chances to recover the file increases. Take out the hard disk, and use another computer system which runs the Operating system on some other hard disk, plug in the hard disk in that system, and recover the necessary files. This is the best method. The file recovery should not be performed by installing some file recovery software in the same hard disk from where you are trying to recover the data, because there are chances that the recovery software my replace the bits of the deleted file by its own files. Even the normal usage of the hard disk may replace the contents of the deleted file on the hard disk by the operating system itself.
  • Recover the files ASAP:  The hard disk is continuously used by the Operating System, and there are chances that such operations by the OS may replace the deleted files contents. The file recovery operation should be performed as soon as possible; else the file may get replaced. Hence, every moment the chance of recovering the files reduce.

A file recovery tool is not included in the Windows Operating System. But there is loads of third party software available to recover the deleted files. Options such as Recuva, which is developed by the developers of CCleaner, are good. There is many more such software which perform a scan of your hard disk to recover the files.

So, I guess this article would have pretty much cleared the mystery of deleting a file, the deleted file, its recovery and the prevention. So, before you get rid and dispose your hard disk or any computer, make sure that you perform the above recommendations to prevent the recovery of your confidential data.

One thought on “Recovery of Deleted Files – Possibility and Prevention and How to Recover them

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.