Everyone knows that when you delete a file— it goes into the recycle bin. Now what happens when you delete the file from there. Well that’s when it’s really gone right? There are services that claim that they can retrieve deleted files from your computer. Is that legit. If so how is that possible. Well to get a better understanding of how all this works we need to discuss how files are stored on the computer. To start different file type or even folders all look the same to a computer; they all are streams of data. These streams of data have a “header” which provide metadata about what type of file it is, and a “footer” which lets the computer know were the file ends. When a file is stored on the hard drive it is stored in one or many compartments which are called sectors and sectors are grouped into blocks. The determining factor of how many blocks are used is the size of the file. If the blocks are 1MB and the file is 10MB you would need 10 blocks. This all works well until the user tries and deletes a file.
So—what happens when you try and delete a file?
Now, this a simplistic view but lets say you have 10 files on your hard drive listed in the following blocks
Block #: 1 2 3 4 5 6 7 8 9 10 (The data)
Files: A B C D E F G H I J K (Pointer to the data)
They are going to be written sequentially for the most part. Now the Operating System OS (which is analogous with computer as far as this article goes) assigns pointers with the file name and the block location so when the user requests the file, the OS will be able to fetch it. If the user were to “delete” file 'E', what is really happening is that the pointer is removed not the actual data. Since the pointer is removed then the OS cannot find the data even though its still on the hard drive. Think of it as a piece of mail. If the address is removed from the envelope, there is no way a mail person can deliver the mail even though the contents still exists. So even though the data exist there is no way to get to it. So what happens when you create a new file 'L'. It may look like this
Block #: 1 2 3 4 5 6 7 8 9 10 11
Files: A B C D F G H I J K L
If the pointer is missing how can the data be retrieved
Data recovery folks charge a lot of money and state that they can pull data out of a hard drive and sometimes they can. What is the determining factor in the success rate? Since there is no longer a pointer to block 5 it is available to be written over. If the OS has written new information to that block the data is gone. If it has yet to be written over there is still a chance the data can be recovered. There is no way to really tell if this has happened unless you attempt data recovery. That is why you should smash your hard drive before you throw your PC away: ) Hope this wasn’t to dry and boring. Happy computing!