Data Recovery Software FAQ

It may come as a surprise, but files you delete from your Mac or Windows computer actually remain on the hard drive. As a result, this means that data recovery is possible, but the truth is that no two data loss situations are alike; sometimes it is possible to recover the lost files from the storage medium, other times it is not. The devil is in the details and understanding how data recovery works requires some basic knowledge of how files are stored on disks.

How files are stored

Operating systems divide the physical hard drive into one or several partitions, and sometimes – such as if you format a drive using a Mac’s Disk Utility – you may need to select the partition map to be used. This is very important because this ‘map’ or ‘table’ stores information about the partitions on the disk. A typical partition structure includes hard drive service data – which is the metadata – and information about partition structures and the partition themselves. The latter of this is the “logical disk”, which includes various details such as:

• Information about the disk and the file system.
• Data constituting the stored files.

The first of these contains file records storing file names, sizes, date/times, and other technical information, including the address of the file data stored on the disk. Operating systems store this data in various ways: the FAT file system stores this information in a file allocation table (FAT), the NTFS file system stores it in a master file table (MFT), and the APFS in a GUID partition table (GPT). When a user wants to access a file, the computer checks these tables containing the data about the files and folders, searches for the record of that file, identifies its address, and then accesses the specified physical space of the disk and reads the file data.

In the majority of cases files on the disk are fragmented, occupying several non-adjacent areas. The file system plays a key role in putting the file fragments together and presenting the entire file.

What happens when you delete a file

When the user hits delete, the operating system doesn’t immediately destroy data. Some operating systems, such as Windows, will mark the file as deleted but in fact retain all the metadata about the file until it becomes necessary to overwrite it with the metadata of a new file. In contrast, macOS completely destroys the record of the deleted file, but the key takeaway is that all operating systems leave the data itself untouched until the space is needed for new data, at which point the old data is overwritten. This also means that if you don’t save new data to the disk the information that was deleted will remain there forever.

If we compare file storage to a book, the disk is the book itself and the pages are the blocks allocated to data. The ‘address’ of all the data is located in an index, and if you delete a file the index is updated to represent this change though the data itself is still there on the same original page. The catch is that since you’ll check the index first, you won’t be able to find reference to that data and it will appear to be gone.

How data recovery software functions

On launch, data recovery applications will start scouring the disk and attempt file recovery through analysis of the information about files and folders. The file system keeps two copies of this info, with the software checking the second if the first copy is damaged. Here the app will search for information about the folders and file structure and, after processing that information, try to reconstruct the original.

Another method is to search for known file types. This scenario kicks in if the first method yields no or poor results. The problem with this method is that in most cases it isn’t able to reconstruct the original file names, date/time stamps, or the entire folder and file structure of the disk. There is an advanced level of file recovery, however, which is the data recovery software’s ability to search for specific sets of file signatures.

There are things to bear in mind before running any software on a drive that has crashed, though. First, if you didn’t keep an eye on the S.M.A.R.T. status of the disk, then you won’t know whether it is logical or mechanical damage. Second, it is wise to connect the drive to another computer and first check its health before running data recovery software.

If you’ve just experienced severe data loss, don’t panic! If you have just realized that you accidentally deleted a file weeks ago, don’t panic! In most cases deleted files are still on the affected storage medium and data recovery applications can bring them back. So, simply put, yes, it is possible to recover the majority of lost files. However, we can’t stress enough how important it is to follow some critical steps to increase your chances of success. And remember, don’t panic!

Stop using the failed hard drive

You don’t have to be a tech guru to get the data back in the case of a logical failure but to increase the chances of getting those lost files back you will need to stop using or reduce the amount of times the faulty storage medium is used. This will prevent the operating system from writing data in the clusters containing the ‘lost’ data.

Download a data recovery app

Check out the reviews and download the data recovery software that best suits your needs. The free versions of these apps will scour the failed drive for data via at least two recovery methods: quick scan and deep scan.

Run quick scan and deep scan

The scanning process itself is essentially the data recovery because it’s at this point that the software algorithm will check with the file system about the deleted files, which will check the logical addresses of the old file catalog for any lost data. If you act quickly enough after the files were deleted, then a quick scan will be sufficient to bring all of them back.

If not, a deep scan – sometimes called raw recovery – will be required, which will scour the whole drive for file signatures and rebuild the files based on what it finds. If the drive has had limited use meaning that the operating system hasn’t written too much new data on it, then the data recovery application will recover all the files. However, as more and more time passes, the old file catalog will become more and more vague and therefore reduce the chances of getting all the files back.

Scan a disk image instead

Creating a disk image of a failed drive is often an added feature of some data recovery software, though there are other means of doing so. This essentially creates a copy of the entire contents of the disk drive, which can then be used to scan for whatever lost data you’re looking for.

This is beneficial because in doing so the process of scanning is quicker and the data will not be altered by the file system in any way. This means that there is no further risk of losing the lost data forever because it is a surrogate for the failed drive, meaning the latter is not being used and therefore won’t be at risk of taking further damage to the data or drive. This is more likely to work, of course, the sooner the disk image is created after the realization of lost data.

The visual representation of emptying the Recycle Bin or Trash folders – where the data just seems to disappear – is just a convention between the operating system developer (for example Apple or Microsoft) and the end user. However, this doesn’t mean that the data is gone forever, rather it’s just hidden from the user and the operating system has instructed the file system to update its catalog to reflect this change. This means that the space the data takes up becomes available for overwriting but not actually overwritten, which is why data recovery is possible.

Erasing a file

Every piece of information stored on a storage medium has a well-defined place. Hard disks have platters inside, which are divided into tracks of concentric circles. These tracks are divided into sectors that have a fixed size. When you save a file on the hard drive the operating system will assign sectors to that data and the file system will remember the logical address of it, instructing the magnetic head of the hard drive to physically move to the specified sectors to read the data whenever it is needed.

When a user deletes a file, the operating system instructs the file system to mark the used sectors as available. This means that the logical address of the file is no longer valid and the index of the files is updated with this fact.

Formatting a hard disk

Disk formatting usually involves three different processes:

• Low-level formatting.
• Partitioning.
• High-level formatting.

Low-level formatting is mostly done by the manufacturer, but what the user can do is partitioning and high-level formatting. The latter means setting up a file system on the partition or logical volume, and each new storage medium purchased in stores comes with a file system already in place.

When you read the phrase “format the drive” or “format the volume” in how-to articles, it actually means ‘re-formatting’ or quick formatting a disk since it already contains data, which could potentially be corrupted. This process is called high-level formatting because it is performed on a working hard drive to erase all of its content. In troubleshooting articles, this suggestion usually precedes one to reinstall the operating system.

Can I recover the data?

The ‘problem’ with high-level formatting is that every operating system does it differently, so there is no industry standard for how operating systems erase all data found on a hard drive. Simply put, to actually erase all traces of the data, the OS needs to completely overwrite each block of data on the pre-existing storage medium, which isn’t likely to happen through high-level formatting and is something that many utilities performing this process aren’t capable of doing. What happens in most cases is that the OS marks the area of the disk containing information as available and retains the data until it is overwritten. If the same file system is used, though, the likelihood of overwriting the data is very small.

This leads us to the obvious conclusion that data recovery is possible even after formatting the hard drive by using data recovery software. We must note, though, that you will need to run either raw recovery or a deep scan for the software to produce the best results.

Often used in smartphones, digital cameras, and action cameras as a storage medium, SD cards are a popular method of storing personal data such as photos, videos, or other file types. However, SD cards are just as prone to data loss as other storage mediums and so you might wonder if it is possible to recover data from an SD card or flash drive.

As it happens, yes, it is possible to get lost data back from such mediums, but there are several caveats. First of all, SD (secure digital) cards use solid-state storage (the same as SSDs) and don’t have any moving parts. These devices typically contain NAND flash memory chips and a microcontroller facilitating host access to the flash memory through the SD interface as a drive.

So, SDs are practically using with the same technology as that used in SSDs, which means you will need to stop using an accidentally formatted SD card immediately to increase the chances of data recovery. By doing so, no new data will be saved onto the SD card and so the space containing the deleted files isn’t overwritten.

Since SD cards don’t have a recycle bin of their own, they move the deleted files to the computer’s trash can. If the computer’s trash can is emptied, then the chances of data recovery are reduced and the only option available is to use data recovery software.

Fortunately, data recovery applications are very easy to use and all of them support the most common formats: picture formats such as JPG, TIF, BMP; video formats such as AVI, MPG, MOV; or documents like DOC, TXT, PDF. The list of supported file types differs by data recovery software, so it’s important to check the supported file types before you jump into buying a license. Also, data recovery applications have a free version that allows users to check whether or not the lost data can be discovered (and therefore restored). That’s a neat option because users will know for sure whether or not the lost file(s) can be recovered before even purchasing a license.

It may sound unbelievable, but the deleted data is still there on your hard disk and it can be recovered. That’s why it’s so important to wipe a startup disk before selling a computer, because others can access your personal data and ultimately raise concerns over your personal privacy.

As you probably know by now, there is a difference between deleting and wiping a file. While the result is the same, these two actions – affected also by the type of storage drive type – essentially control how possible file recovery will be.

In order to understand why this is the case you need to have an understanding of how HDDs work. The storage device uses magnetism to store vast amounts of data and is made of a circular magnetic disk called a platter. This is divided into concentric, circular paths called tracks, which are themselves divided into sectors. It is on here that the data is written.

How data recovery works

Data management of any operating system – Windows, macOS, or any other – are all controlled by the file system, typically NTFS, FAT, or Apple’s APFS. The file system maps all data stored in these HDD sectors, knows which sectors are still unallocated, and if new data flows in it instructs the storage disk to save the data into these unused sectors.

Now, imagine that the drive is a book: the files are stored on pages of the book while the file system is the index that tracks of the location of the stored files. When a user deletes a ‘page’, its reference in the index is removed, the catch being that the information on the page is still there. On the drive this means the sector has been marked as available for overwriting but, crucially, hasn’t yet been overwritten. Overwriting data isn’t a problem for HDDs; it is normal for the drive to overwrite old data if the drive has been in use for a long time.

In other words, it is possible to recover deleted data from an HDD because data recovery software will map the drive, identify the file signatures, and be able to reindex the lost file(s). However, as times goes by, recovering a deleted file will become a harder task as the ‘page’ containing the file could get overwritten.

The same applies if the HDD is wiped. There are various ways to “secure delete” drives, but the main idea behind wiping a hard drive is to make all the data unrecoverable. If a drive hasn’t been securely deleted, then it is still possible to recover at least traces of old data.

That feeling when you realize you’ve accidentally deleted something very important from your smartphone is awful. You might search and search, but always come up empty, but is it possible to actually recover that lost data? Do iOS or Android devices have anything different that makes it harder than recovering from an HDD?

The situation is a little complicated, but the short answer is yes, you can recover the data. The catch is that you need to act fast otherwise the general hardware settings will make this impossible and the data will be lost forever, unless of course you have a backup to save the day.

Apple and Android device manufacturers use NAND flash in their gadgets, which by default lowers the chances of data recovery simply because of how they work. In essence, flash memory makes data recovery impossible once the data is overwritten.

iPhone data recovery

Acting fast to save data is imperative for iPhone or iPad owners. They have up to 30 days to access the Recently Deleted folder in their Photos app to recover a deleted photo or video. The same timeframe applies to data stored in iCloud such as notes, contacts, mail, and more; if you accidentally delete data stored here but are synchronized with your other Apple devices using the cloud service, then it will still be possible to recover the data.

An iCloud account also gives users the opportunity to automate device backups, which includes all the data on the handset. After 30 days the data will be permanently erased and there will be no chance to recover it.

Android data recovery

Compared to Apple’s strict privacy policy – which blocks user access to the hardware’s root level – Android smartphones can be rooted. However, if you find that important data has been deleted, then again you will need to act very fast otherwise the data will be overwritten and it cannot be restored. It is possible to retrieve data via recovery software, but you will need to root your device. Rooting means you get complete access to everything in the operating system and such permission allow you to change anything. Alongside this power, however, you will also open the handset up to viruses, which isn’t sensible for the privacy-conscious user.

If you don’t manage to recover files manually, then pick a data recovery application and run it on the device. It may be of help, unless the file you are searching for is unrecoverable. Don’t expect too much from these third-party apps, however, it is rather better to focus on regular backups.

It is wise to save the data from an iOS or Android handset to an external drive, such as on your computer or in cloud backup storage. Apple’s iCloud or Dropbox works fine for this, but you will also need to consider the cost of cloud storage. If that isn’t worthwhile, then iTunes can do the backup for you, but you need storage space on the computer selected to maintain the iOS backup. Android device owners can use either Google’s own solutions or third-party apps to keep an up-to-date copy of their data.

Compared to their older brother hard disk drives, SSDs (solid-state drives) are relatively new to the market, however both consumers and techies praise them for their speed and reliability. SSDs have no moving parts and are less prone to failure, but there isn’t yet enough data out there to prove this theory of their long lifecycle. While the theory certainly does sound good, the logic – of no moving parts and therefore less risk of breakage – isn’t always correct, hence the question: can you recover data from a failed SSD?

Before moving on to data recovery, just a quick note about how SSDs are subject to the same stresses that HDDs are, since they directly replace the latter. As a result, the manners in which they failure are similar to HDDs, excepting only mechanical failure.

When an SSD fails, there isn’t much you as a consumer can do to recover data from it. The same goes for deleted files, especially if they have been cleared from the trash. The explanation can be found in how SSDs work and how the TRIM function addresses their wear level. While data recovery is still possible because the remnants of files are still there, special equipment is required for it to be successful.

SSDs use flash memory to store user or system data. This is divided into pages and blocks. When a user deletes a file, the system eventually moves the deleted data to another random location until, at some point in time, the SSD decides to finally overwrite it. A group of engineers at the University of California have found that it is quite difficult to erase data from an SSD after they were able to recover data from their test drives.

Consumer-level software applications are not yet smart enough to make SSD data recovery possible. While some apps offer guaranteed recovery, this only works after the software has been installed on the machine and protects and monitors changes to the file system.

Otherwise, you will need help from a professional, who will take your SSD apart, remove the chips, and copy the content to a folder on another computer. At this point, data recovery companies – particularly those who work with mechanical failures – see SSD data recovery as a challenge since the cost of recovery is more than double that of HDD data recovery. And if the SSD was encrypted, then chances are that no data will be restored.

The reason is simple: if a data recovery service looks for the partition table found at the first logically addressable sector and managed to find it, then the chances of successful data recovery are high. But if it doesn’t, their efforts will be to no avail.

In other words, you could purchase a third-party data recovery software to try and recoup deleted data from an SSD, but it is likely that you won’t be able to recover anything. But if the lost data is of high importance and you don’t mind spending thousands of dollars to recover it, then yes, it is possible to recover data from an SSD.

Various factors can damage the data stored on your hard drive, not to mention how it is also possible to lose data by accidentally deleting or formatting a volume or drive. But don’t panic! It is possible to prevent data corruption and if an unpredictable situation has kicked in, then you can still get your files back intact.

The most common reasons for data corruption vary from voltage spikes and malware to hardware failures and improper system shutdowns, but these are just a few of the complete list of potential reasons. What’s more important is what can be done to prevent data corruption and how you can deal with the situation.

Recognizing a corrupted storage device gets harder as technology evolves. In the early days of gramophone records or VHS tapes, the warning signs were visible on the storage mediums themselves: records became muddy and tapes became grainier. Nowadays it is much harder to see the warning signs of file corruption.

Users can prepare for the worst in two ways:

1. Perform regular backups.
2. Keep an eye on disk health alerts by using the S.M.A.R.T. monitoring tool.

The reason for keeping a backup copy of every important file is simple: if a drive fails or the data is corrupted by a sudden system shutdown (such as by a power blackout), then you just switch the computer on and restore from any backup, perhaps even a full system restore if necessary. This can be done through manual backups, via a backup of your choice, or the extremely handy Time Machine tool for Apple owners.

The S.M.A.R.T. monitoring utility will signal ahead of a drive failure about to kick in, so you’ll have time to purchase a replacement storage medium.

If none of the above applies, then you still have one more powerful option: data recovery software. These apps, such as Disk Drill or Stellar Mac Recovery, use specially designed algorithms to recover more than 200 file formats. They may be able to reconstruct the file in its original form, but that’s the hardest part.

Since every file type is actually a piece of code and a data recovery app reconstructs them bit by bit during a raw recovery or deep scan, it is essential to find every piece of the binary information otherwise the file will become useless or parts will be unreadable by the operating system. To address such problems, there is a wide range of utilities available on the web, because data recovery apps can’t always ‘repair’ the corrupted files. As one example: if you happen to have a corrupt MOV or MP4 file try using VLC, a highly popular and free multimedia player, to fix it.

Whenever a user empties the Recycle Bin or Trash, they are actually instructing the file system to update its data index and remove the reference to the ‘deleted’ file(s). The data is still there, but hidden from the user. This means that the clusters containing the data will be overwritten at some point, but only if the file system needs that free space. That’s why data can still be recovered on a hard drive.

Restoring data with original file names

However, the only way to get all those files back with their original names is by acting fast after noticing the data loss. It’s important to avoid using the storage medium for any purposes other than data recovery because the file system may overwrite the ‘lost’ data on it, especially if it is running low on free space.

To restore the data, connect the storage medium to another computer (if necessary) and launch your preferred data recovery app to initiate a scan. The data recovery app will check the logical disk’s information about files and folders when first run. This section of the logical disk – the file allocation table (FAT) or the master file table (MFT) – contains records storing file names, sizes, date and time, as well as other information about the stored data. This is what the operating system updates when you choose to delete a file.

If the damage to the HDD is only light – as in the data loss is fresh and only the file references have been updated to reflect the change – then a data recovery application will be able to restore all data, including the original file names, folder structure, and contents.

If the damage is more serious, a long time has passed since the accidental deletion, or the storage medium has been in use, then the chances of recovering the original file names are very low. A data recovery application could still be able to get the data back – likely without the original file names – but in this case you will need to run a deep scan which, depending on the storage medium’s size, can take days.

Much like physical objects, digital data requires storage space. The difference is that objects have a physical mass, whereas data is maintained digitally as pieces of information called binary digits or bits. It’s interesting how a logical organization of binary digits (zeroes and ones) can present a website article or an image to a user, but that’s another story.

What is important is that when you save a file, you are actually saving strings of code, because the information has to be translated into a language that the computer understands: binary code. For example, what you see as a capital ‘A’ in a text file, the computer will see as 0100 0001, or eight bits, which is equal to one byte. In other words, in a Notepad file each character takes up one byte of digital data, so the more text you have, the bigger the binary string is and ultimately the size of the resulting file. Pixels of an image are also represented by binary code so that the computer can understand which color information needs to be displayed in every single pixel of the image.

Data stored on a hard drive

Each operating system uses a file system that defines the minimum number of bytes that can be stored in a block of data, or the size of the allocation for units or clusters. On a hard drive, file systems include a file allocation table, which include the logical address(es) of a file. When you save a Word document, the operating system will instruct the file system to check whether there are free clusters and, if there are, to allocate some of them to the file.

If the size of a file is bigger than 4096 bytes (the minimum size of a cluster), then more clusters are allocated, but this doesn’t mean that the information will be stored contiguously (as in clusters that are each located adjacent to one another). That’s why the file system needs to keep a table containing the logical addresses of the stored files, so it can instruct the magnetic head that reads the digital data on the physical hard drive to move to the correct physical location of the file.