Data Recovery

549
data recovery software

Chances for Data Recovery of Deleted Files:

In the process of any file deletion, no matter intentional or accidental, the operating system acts to release storage space for new files marking the space used by previous files as free. Luckily, the storage space actually remains occupied by the previous file until the moment of its overwriting with a new one, thus leaving hope to retrieve deleted files.
Chances to successfully recover deleted files depend much on the file system, as each file system performs differently to delete files. Besides, you can increase data recovery chances by yourself in that you choose efficient, safe and reliable data recovery software.

Windows file systems

Read more about understanding File Systems..

Major Windows file systems include FAT (with FAT32 extension), NTFS and newly developed ReFS for Windows Servers. It's worth emphasizing that data recovery from these file systems – like from any other systems – is possible until the moment of files overwriting.

File system: FAT/FAT32

  • File deletion: Directory record is marked as 'unused'. Clusters are marked as 'free' that destroys chain of clusters, used by file.
  • Recovery of non-fragmented file: File name, size and on-disk position remain inside of directory record increasing file recovery chances up to almost 100%.
  • Recovery of fragmented file: Chain of file clusters is destroyed leaving no information about file fragments. Known remain file name, file size and start position. Using heuristics it's possible to guess fragments locations, however, without any guarantees as for correct guess.

File system: NTFS

  • File deletion: Master File Table record is marked as 'unused'. Bitmap of used space is updated to release used clusters. File entry is deleted from directory record.
  • File recovery: File name, size and on-disk position remain inside Master File Table record increasing file recovery chances up to almost 100%.

File system: ReFS

  • File deletion: metadata structure is modified with CoW operation marking the area as free for new entries.
  • File recovery: the system stores huge amount of older backup copies that makes data recovery possible with recovery result up to 100%.

MacOS file systems:

Apple Mac OS applies HFS+ file system as a major file system for their Mac computers, iPhone, iPod etc. It's worth emphasizing that data recovery from HFS+, like from any other systems, is possible until the moment of files overwriting.

File system: HFS+

  • File deletion: The file system wipes data from B-Tree metadata records for the file and updates map of free space.
  • File recovery: File name, size and on-disk position are wiped, however, file system journal still may contain this information that allows to recover good files. Using IntelliRAW™ enhances chances to recover lost information. Nevertheless, file name information can be lost.

Linux file systems

Modern Linux operating systems use Ext2, Ext3 and Ext4, XFS, ReiserFS, JFS (JFS2) file systems.

File system: XFS

  • File deletion: XFS clears a part of information about file node and updates tree of free blocks. Information about file name is unlinked from directory entry.
  • Recovery of non-fragmented file: Using heuristics, it's possible to find file name and file size and position rounded to block. Chances for recovery are near 100%; whereas chances to retrieve real file name are near 80%.
  • Recovery of fragmented file: File name, size and fragments chain can be retrieved using heuristics. If file data is not damaged, file recovery chances are near 100%. Chances to get real file name are near 80%.

File system: Ext2

  • File deletion: Ext2 marks file node as free and updates map of free blocks. Information about file name is unlinked from directory entry. File name to node reference is wiped.
  • Recovery of non-fragmented file: Information about file start and size could remain on disk. Analysis of nodes can help recover good files. At the same time, information about file name is lost.
  • Recovery of fragmented file: The same as for non-fragmented files.

File system: Ext3/Ext4

  • File deletion: The file system wipes file node and updates map of free blocks. Information about file name is unlinked from directory entry, yet it references the right node.
  • Recovery of non-fragmented file: Information about file start and size is destroyed permanently. Nevertheless, it may remain in file system journal. The link between file name and on-disk location lacks. Heuristics and journal analysis make possible to recover good files even with real names.
  • Recovery of fragmented file: Usually, information about the first 12 blocks of a file lacks. There also remains no information about file name and size. Chances for recovery of a deleted file are quite poor, however, information about most recently deleted files may still remain in file system journal that increases chances to recover a file with real file name up to 100%.

File system: ReiserFS

  • File deletion: The system updates its S+-tree to exclude a file and renews the map of free space.
  • Recovery of non-fragmented file: S+-tree node may remain on disk (a copy in file system journal and an old copy, created with copy-on-write). In this case file recovery chances could be up to 100%.
  • Recovery of fragmented file: The same as for non-fragmented files.

File system: JFS (JFS2)

  • File deletion: JFS updates the counter of object uses and releases inode in inode use map. The directory is rebuilt to reflect changes.
  • Recovery of non-fragmented file: File inode remains on the disk increasing chances of files recovery up to almost 100%. Recovery chances are low for file name.
  • Recovery of fragmented file: The same as for non-fragmented files.

BSD, Solaris, Unix file systems

These file systems commonly use UFS and UFS2 file systems.

File system: UFS/UFS2

  • File deletion: UFS clears file node and updates map of free blocks. Information about file name is unlinked from directory entry.
  • Recovery of non-fragmented file: The information about file start and size is destroyed permanently. The link between file name and on-disk location lacks. Heuristics methods make possible to recover good files of known file type. At the same time,you will rarely come across non-fragmented files on UFS due to the specifics of its Soft Updates algorithm.
  • Recovery of fragmented file: The information about the first 12 blocks of a file lacks. There also remains no information about file name and size. Chances to recover deleted file are quite poor, yet possible.

Clustered file systems

SysDev Laboratories LLC offers data recovery from such file systems as Apple Xsan (CentraVision file system, StorNext file system), RedHat Linux Global File System (GFS), VMware ESX Server Virtual Machine File System (VMFS) as logical data recovery services. If you need to recover data from any of such file systems, feel free to contact us and request remote recovery service.