How to Recover Deleted Files

in #security8 years ago

disc-1085276_1920.jpg


When you delete a file from your computer, it doesn't actually get deleted. In most operating systems you have a trash can, or something like that, the file goes here first. After you delete it from the trash can, it is still recoverable, due to the nature how hard disk storages work.

The first part of the deletion is usually putting the file into a segregated space like a trash can, or on Linux sometimes it makes it hidden, but it still remains there. Nontheless even if you find the file afterwards and delete it, it still remains on the disk.

Hard disks work like a net of data, every single bit is next to eachother, and what we call "files" or "partitions" are just a logical unit of data, whereas you have a pointer that selects the address of the file and points to it as being an integral file. When a deletion happens, the pointer gets erased, but the data still physically remains on the disk.

The pointer tells to the computer that that zone is used, to not accidentally overwrite the file, but after the pointer is removed, the file could still remain there, until it's overwritten. And that could take a lot of time until every single bit of free space on your hard drive gets overwritten.

If you have accidentally deleted some files, and you want to recover them, it is very easy, given that they haven't been overwritten completely. If they were a little bit then it's still recoverable with some damages to a file, like for example if you deleted a family photo 1 month ago, and you want to recover it, it may still be recoverable, but there is a good chance that it might be pixelated, or some parts of the photo unreadable.

For example if the photo you accidentally deleted 1 month ago was this:

family-557108_1280.jpg

It could be damaged by the time you recover it:

ERR.jpg

So it is important to recover it as fast as possible, usually files recovered within 1 hour should still be intact, but there are no guarantees. Obviously you should carefully delete files that you might want to recover later.

The disk constantly gets read/write signals, so the free space gets overwritten eventually, that is why time is the key.




HOW TO RECOVER

On Linux:

  • Install PhotoRec, it's very easy to recover files with it:

sudo apt-get install testdisk
sudo photorec

On Windows/Mac:

http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step


It's a command line utility but it's very easy to use, you can recover all forms of partitions with it (NTFS,FAT, EXT3,EXT4,...) , and supports more than 480 file formats. Good luck, it should be easy to use, but time is the essence, the faster you recover it, the higher the chances that the recovery will be successful.


Upvote, ReSteem & bluebutton



button2x
Sort:  

Nice tutorial; upvoted.

Once you have a data loss after accidentally format your device, you can recover from your backups. Backup is always the first choice and best way to recover files. You should have backups first, no matter on the computer, external hard drive or the third-party tools.

Wonderful solution Windows Data Recovery software which can easily recover corrupt and deleted as well as permanently deleted files from corrupt Windows partition or recover deleted data from a PC. Supports data recovery from FAT16, FAT32, and NTFS file systems. No matter how you’ve lost your data, i.e. due to accidental deletion, formatting or corruption, this software is smart enough to provide you excellent data recovery results in the shortest possible time.