Recover accidentally deleted data

[Демитрий]

Recover accidentally deleted data.

What to do if you accidentally deleted an important file? Can special services gain access to what you deleted? Today we’ll talk about data recovery.


What happens to the file after you click "Delete"? I do not mean the obvious and simple cases when a file falls into the Trash. What happens to a file that you delete completely - Yes, practically nothing!


How are files generally stored?
To get started, let's look at how files are stored before deletion. This will be needed in order to understand the recovery procedure.


The file system looks something like this:

A bunch of data written sequentially one after another, plus some system information. It can be compared to a book, and each file is a separate chapter. In the ideal case. In practice, of course, everything is much less neat


Imagine a book in which all pages are randomly arranged. It can start from page 5, then the 48th, 30th, and so on. And this is just what the file system actually looks like. This chaos is called fragmentation and it arises precisely because of the constant deletion of old files and the emergence of new ones.


When you insert the USB flash drive you just bought into the computer and write 100 photos to it, they will be written to it sequentially, in perfect order. But, if you delete a couple of pictures - suppose the 29th and 48th - and you will create the conditions for fragmentation to occur. If after that you send a text file and another photo to the USB flash drive, the data is fragmented. This is how it will happen.


First, the text file will fall on the place where the 29th photo lay. But it will take up the "free" space not entirely, but only partially, because text files weigh much less and it just does not need so much space. Then the file system will need to record a photo, and it will go look for a place for it. Most of the new photo will fall on the rest of the space from the 29th photo, and the end of the new photo will go to the beginning of the free space from the 48th. Here is such a division of the file into several pieces and is called fragmentation.


In fact, modern file systems are a little more complicated, but we do not need to consider this in more detail, because the result will be the same. I have already told you the most important and now you can move on to the interesting


<Recover Deleted Data>
How could one recover deleted photos No. 29 and No. 48 from the example above?


In fact, nothing complicated. There is a special software that analyzes the file system and looks for all the remaining pieces of deleted data in it. This is mainly garbage - pieces of data from which it is already impossible to collect anything. But, if you start recovery immediately after clicking on the "Delete" button, you are almost guaranteed to be able to recover your files. As long as the "empty" place where the pictures used to be is not occupied by anything new, it will always be possible. And even when the deleted file is partially overwritten, sometimes it can be partially restored. Let’s take a closer look.


When you just hit DELETE, the files are still completely recoverable. It will be enough to enable special software and you will see the deleted data in the same way as in the file manager. They will be available for viewing and recovery in one click. When you, as it was in the example, after deleting sent a text document to the USB flash drive, photo No. 29 becomes partially damaged. The beginning of its file is overwritten, and the middle and end can still be read. Photo No. 48 in this case is still entirely available for recovery. After sending a new photo to the USB flash drive, photo No. 29 will be permanently deleted, and photo No. 48 will be damaged.


Damaged data can also be restored sometimes, but a lot depends on the case. Some file formats are designed so that data becomes unreadable if a piece is removed from them. Others are read after that. For example, an encrypted archive definitely cannot be restored if at least a small block has been deleted from it. A photograph may be lost in its entirety, or in part - depending on which blocks will be lost. The surviving pieces of a simple text document can always be read, no matter how many percent of the file is lost.


https://i.imgur.com/4vT1HGr.png

Mac Software:
Disk Drill - yes, that one. Free Mac Data Recovery Software. Recover Files. Disk drill


Programs for recovering data from mobile:
Android Photo Recovery - although the word "Photo" is clearly highlighted in the name, the program also knows how to recover other file formats, contact list, SMS and something else. Distributed for a fee. Android Photo Recovery - Recover Deleted Photos / Videos / Music

PhoneRescue for iOS is another paid program, but for iPhone / iPad and other iDevices. PhoneRescue® for iOS - Retrieve Your Lost iPhone and iPad Data


You can connect the mobile device to the computer and use the usual data recovery program. There is nothing particularly unique in specialized reductants and here they are given more likely so that you know that they are. Perhaps they can be a little more convenient, because they have pre-prepared functions for data recovery specifically from mobile. But there are no fundamental differences, so if you do not want to pay for the recovery of one accidentally deleted photo, just use the usual free program and that’s it.


<Experimenting>
So, the test files are created, the program is loaded.

We delete everything "irrevocably" - usually for this, the combination Shift + Delete is used, unless you reconfigured otherwise. Run the program. I chose Recuva, but the interface and the principle of operation for all will be approximately the same. Except Linux, for which interfaces are not important:

Here they are, the first 4 files marked with green circles. Green circles mean that the files are not beaten and can be easily restored - it’s understandable, after all, nothing has been written on top of them yet. Below, marked with red circles are files that were deleted long ago. There is almost no information left about them and it is unlikely that they can be restored. Fortunately, we do not need them. I select all 4 files, click on the "Recover" button ...

Done! In order to demonstrate that the files were restored in their original form, I opened the picture. Everything opens, there are no changes, you can continue to use the files as before.


<To summarize>
One click on the "Delete" button is not enough if you would like to delete the file securely. If the files were deleted recently, they can usually be restored at least partially. Here is this study https://www.usenix.org/legacy/events/fast11/tech/full_papers/Wei.pdf contains statistics: even when you try to delete a file using safe deletion methods, usually 4% to 75% of the original data remains on the SSD.