How file recovery works
This is a very basic description of how file recovery works; it is purely intended to describe the concept and refers generally to a Windows operating system since the majority of devices are produced in a FAT format. File recovery in reality is a very complex subject but at least here you will get an appreciation of what goes on.
A computer operating system describes all data as essentially one long string of bytes. So in order to keep this data in one comprehensible piece it has to create a container for it or a data file. Now to store this information away on any storage device or USB stick it has to be wrapped up with more data to describe what it is, how large it is and of course its filename and physically where it resides on the storage device. Some of this information will be stored in something called the file allocation table or FAT, which is simply a file in a special / hidden area of the storage device. It keeps track of what data is stored where and what file owns it.
So in order to delete a file, Windows being predictably lazy, simply changes the first character of the filename to a non-printing character and from then on the operating system knows to ignore the file and make the space available for re-use, it doesn't actually delete your data.
So to recover a file all you have to do is look for the hidden files with the non-printing character as the first character, put a normal character in its place and your deleted file is magically recovered. So now you know why if you delete a file you should try and recover it straight away, because if you don’t the operating system will soon write over where your old data is so reducing your chances of recovering the file.
How do you choose a file recovery program.
Well different types of files have certain predefined structure, that’s how a particular program knows how to decode a JPEG file for instance. Now the simpler file recovery programs simply try to reconstruct the file by joining the pieces of the file referred to by what’s left in the file allocation table. Unfortunately if a piece of data is not identified, a section of your file may be missing which could make it unrecoverable.
The more intelligent file recovery program knows what the file structure is and can use this information to reconstruct your deleted file by looking for a certain type of information in spare areas of the storage device your file was located on. A bit like knowing the shape and content of the next piece of the jigsaw puzzle, it’s just a case of finding it
Good luck
John
- admin's blog
- Login or register to post comments



