Undelete Files

The word ‘delete’ when applied to data on a computer system is a slight misnomer.

When a user deletes a file, whether accidentally or intentionally, the actual data is not destroyed, but the computer system now regards that data as no longer required.

When data is stored on a hard disk drive, the computer stores pieces of the document in random areas of the magnetic media on the hard disk surface. It does this to speed up the time taken to ‘write’ the data. Where ever the ‘heads’ happen to be when the save command is received, they ‘write’ data to the magnetic media.

Because bits and pieces are stored in different areas, the computer system requires an index or map to be able to put the bits back together again, in the right order, to reconstitute the file. The index is stored in a ‘File Allocation Table’, or similar structure.

When one deletes a file, the entry in the table is removed, telling the computer that those areas that previously contained a part of a file, are no longer required, and are available for new data to be stored. The computer does NOT go and ‘over-write’ the original data, so it remains in place until another set of data is randomly stored there.

As long as the ‘deleted data’ has not been overwritten by new data, it can be found, reconstituted and recovered.

Once deleted data is over-written by new data, it is virtually impossible to recover it. This is certainly the case on a hard disk drive produced in the last 10 years.

Palmer Data Recovery has an extremely good chance of recovering ‘deleted data’ as long as you avoid it being overwritten. Therefore, the quicker you can get the affected hard disk drive to us, the better your chances of receiving 100% of your deleted data back again.