Service

Recovery of deleted files

In most cases, loss of important information happens because of the user or other people. The data and file loss happens in the following cases:

• accidental file deletion
• complete disk formatting or logical disk deletion
• operating system reinstallation
• logical disk size modification
• file system conversion (e.g. from FAT to NTFS)
• virus action
• application errors
• surface defects (bad blocks) on the hard drive

During formatting or file deletion (recycling bin emptying), some of the information about location of files on the disk is lost, but the files usually stay on the disk. The chances of successful recovery of deleted files depends on their size, physical location on the disk, the level of disk fragmentation, and on whether any data was written on the disk after deletion.
If you have deleted the files or folders you require, in order to make sure they can be successfully recovered, you need to do the following:

• DO NOT write anything on the disk. The less information is written on the disk after the data loss, the more information can be recovered.
• TURN OFF the computer and remove the disk or the flash drive. If you have deleted the folder with files and continue to work on the computer, the operating system will gradually rewrite the clusters containing the information about the deleted files with other information.
• EVALUATE the importance of the deleted files. If the data is really important, bring the data medium to a specialized company.
• You may come to our office with your data medium for diagnostics.

What happens during data deletion
During formatting, file tables are cleaned on the disk. In this case, the data itself stays on the disk, the only thing required is to restore the structure of folders.
In FAT16/FAT32/NTFS file systems, when the files are deleted, their content is not removed, however the location where the file’s data is stored is marked as empty. The filename, the file size and the data are left intact. If you try to restore the file right after deletion, then the result will be successful.
Information recovery in Linux (ext2, ext3, etc. file systems), Mac OS X (HFS+ and ZFS) or FreeBSD (UFS2) is far more complex, but still possible.
If during the installation of the operating system a formatting of a disk partition was performed, then there is a chance that complete or partial data recovery can be done. In this case we can try to recover the documents (DOC and XLS files), images and photos (JPG files), but it’s not usually possible to restore the folder structure, because it’s fully rewritten by the new operating system.

How to recover the files on the disk on your own

• You have to buy a data recovery software application. There are many such applications: EasyRecovery, Active Uneraser, R-Studio, and so on. There are also free and shareware utilities for data recovery. But it’s important to keep in mind that to this date there is no universal software product that is capable of secure recovery of data, in each particular situation you need to choose a software application. Besides, the developers of free software applications are not responsible for the safety of your data.
• Install the data recovery software application on a separate computer.
• Connect the data medium containing deleted files to this computer.
• After the data recovery application is started, it will show the list of logical partitions and disks connected to the computer. Choose the partition containing the deleted files and perform the scan of this partition. The application will start analysing the partition, after which it will show the list of recovered files. This procedure will take some time.
• If the data recovery application has found your deleted files, you can save them on a separate data medium. After you have saved the files, you need to verify the contents of the recovered files.

Do not try to recover the files using the data recovery applications like EasyRecovery on a disk with faulty sectors. The process of hard drive surface scanning may render it inoperable.