When it comes to data recovery, no two situations are alike. Sometimes the process is successful and users are able to recover every lost file and the data is restored exactly as it was previously. But in other cases the process is still successful but certain aspects of the data have been lost, such as the folders and their original structure and names. Then there are those unfortunate cases where data cannot be found. All these potential outcomes lead to questions like ‘what affects the scan results?’ and ‘how do data recovery apps identify lost files?’, questions that we fully intend to answer…
File type
To answer these questions we first need to understand what is happening on a computer and how different files (and file types) are created. When a user interacts with an application and saves a file, it attributes a format to the data, a standard means of encoding the information for storage and use on a computer. For example, a document created using Microsoft Word can be saved in DOC or DOCX format, with which corresponding software created to decode the format is required to interpret and interact with the file. PNG files store data on bitmapped images using specific data compression and requires image editing software to decode.
How files are stored
By hitting the save button users hand over control to the file system, which will split the data and give a logical address to each fragment. This is due to how data storage works. Simply put, the stored data is not contiguous as the file is split into multiple pieces and saved wherever there is free space. In essence, each file is like a jigsaw puzzle and the file system places the puzzle pieces in spaces where they fit, but not linearly.
Next, the file system maps the data and its logical addresses and keeps a record of everything that is stored on the disk, so whenever a user requires a specific file the system assembles the puzzle and presents the user with the file in one piece.
Recovering file types
If something goes wrong and the user notices it in time, then a quick scan is able to scour the hard drive and request that the file system – which in our scenario is functioning – locates the addresses of the file fragments and, if it finds them, presents the file. In such cases the data recovery application is able to rebuild the complete folder structure and list its findings by file type with all the metadata intact. This is mostly possible in situations where the accidental deletion is realized very quickly or if the user stops using the hard drive after noticing the data loss.
File signature
Every file has at least one file signature and data recovery software knows how a file ‘should look’ based on the format it fits into. In other words, an MS Word file has a different file structure to that of an Adobe InDesign or MP3 file. These structures give each file a specific signature so that when the data recovery app scours the entire disk for accessible fragments it can combine them to bring the original file back to life.
But this only works when all the individual fragments can be recovered, and that requires time. This is the reason why deep scans can take days. The results, however, speak for themselves: more data can be recovered this way, but the likelihood of losing the original folder structure and file metadata is higher.
Before you jump onto any data recovery application, it’s wise to first check the features it offers to check support for a specific file type, otherwise you’ll end up shelling out money for software was never able to get your data back.
István F.
Adam B.
