Hard Drive Data Recovery

Table of contents

Hard Data Recovery: How It All Works

The first step in HDD data recovery is diagnosing whether or not the drive itself is at fault. This is because if the HDD has a physical flaw, software will be unable to attempt data recovery.

If the hard drive has a physical problem, data recovery might be quite costly because experts will need to disassemble the drive and use specialized equipment to fix it. The process is typically carried out in a "clean room," an environment free of dust and other impurities (Note: the following explanations apply only to data recovery from traditional HDDs, not SSDs).

Having a fundamental understanding of how data is stored on a hard drive is essential for any data recovery endeavor.

Having a hard drive formatted is the first step in using a file system to store data in an orderly fashion. Disks have partitions that further split the magnetic storage capacity. Standardizing on the size of 512 bytes for the smallest storage unit, "sectors" are specified.

The operating system reorganizes these sectors into blocks, or "clusters," to improve the hard disk's performance. The ability of the operating system to manage huge storage media depends on the cluster idea.

Files can be fragmented on a hard drive if they are spread out across multiple clusters, which can happen if a file is written to multiple locations. File restoration can be hampered by fragmentation's complexity. Defragmenting the hard drive at set intervals is thus recommended.

What is the process for retrieving lost information from a hard drive?

The main directory, which is a list of files and subdirectories, serves as the disk's administrative hub. The following data can be found in this primary index:

the file's name, size in bytes, last-modified time, and cluster number in ascending order

The operating system will start looking for the file using the first cluster. If the file is spread across multiple clusters, the system will utilize the information included in the disk's initialization sector, namely the so-called File Allocation Table (FAT), to determine which cluster the file should be written to next.

This leads to the following notation for file locations: Cluster 0 is retrieved from the system's primary directory. From the file allocation table, we get the following cluster numbers.

Therefore, the file's data is not kept in the same place as the file information in the file allocation table. With this, the file allocation table can be retrieved its data.

The file allocation table FAT and the root directory have been combined into a single entity called the Master File Table in more recent operating systems (Windows NT and beyond) (MFT). This is a file system that is also known as NTFS (NT File System). Although the specifics of how data should be distributed between the initial start cluster and subsequent clusters in a master file table can vary widely, the underlying notion has stayed the same.

Where does information go when it is deleted?

In Windows, the 'Recycle Bin' is where deleted files go to wait for deletion permanently. Windows' "Recycle Bin" is, conceptually, no different from any other folder on your computer. Once the recycle bin is empty or the file is deleted without going through the recycle bin first, the file is permanently removed.

When a file is destroyed, the operating system appends a special character to the file name in the master file table MFT. This character serves as a reminder to the computer that the file has been erased. The OS will now recognize this group as empty space. Therefore, new files can be created in this freed up space in memory. It's important to note that the OS does not actually delete the contents of the individual clusters; instead, it only marks them as "free" for the OS and does not actually destroy them.

That means data recovery software can retrieve files that the operating system can no longer find because they are still there in the "released" clusters. Recovery may not be possible, however, if the afflicted clusters are corrupt or physically damaged. Most data restoration software presupposes that data is kept in sequential clusters. The real fragmentation, i.e. the distribution of information on the hard disk and the position of the file, is kept in the file allocation table FAT and the master file table MFT, and if these tables are damaged or deleted, this information is also lost. The question now is how long the deleted file will remain in the system.

Overwriting the old file with a new one is the only method to make sure that the deleted MFT data and its contents are gone for good. This means that even minimal file storage and use after the data loss could make recovery extremely difficult, if not impossible.

Data recovery from a hard drive should begin on a secondary drive. Otherwise, the OS can replace the lost files when attempting data recovery. Since the destroyed files are always stored on a different hard drive, the data recovery software should never be installed on the same drive. It also supports CD and other external storage device startup (external hard disk, USB stick, etc.).

Recovering lost data by searching through MFT files

When trying to recover files, the majority of data recovery applications look for MFT entries. All of these things happen automatically: Once the location of the MFT entry for a deleted file has been determined, the additional clusters that were once used by the file that has since been destroyed can be inspected. This process verifies whether or not these clusters have been overwritten by the new data in the file.

Considering that one file's data can only fit in a single cluster, if a different file starts using that cluster, the data from the lost file can never be restored. Since just the MFT entries and clusters need to be reviewed in order to recover personally identifiable information, the process is quite quick. However, even if the file information is still on the hard disk, this method cannot recover any data if the file allocation table is faulty, defective, or rewritten. Without the MFT records, searching for unassigned files is the only option.

Trying to identify deleted files that have not yet been assigned a use

In order to find lost files, you need data recovery software that lets you bypass the MFT and look in every free space. As such, it is necessary to be familiar with the state a file takes after being removed. Thankfully, each file format has its own set of headers and footers. Using this arrangement, the program is able to scan the entire disk in search of the missing data. However, this takes a lot more time than just looking through the MFT entries.

For what reason do some recovered files remain incomplete?

Operating systems only use as many disk clusters as a given file requires, as was covered in earlier chapters. Depending on how much data was erased, this may mean that just a subset of the original file is recoverable.

However, even this isn't always enough, as the vast majority of programs need unaltered files to show them. Partial file corruption recovery is yet another niche field of data recovery that necessitates expert-level familiarity with the various file formats.

Recovering Deleted Files from a Formatted Drive

Drive formatting typically just removes the root directory and the file allocation table (FAT) or master file table (MFT) from the disk. It is possible to completely format the hard drive and remove everything from it. This, however, requires the prior selection of additional configuration settings.

When a hard drive is formatted, there are a number of tactics that data recovery tools can utilize to salvage the data. You can do things like look for old versions of files that used to be directories that were accidentally removed. After discovering such a directory entry, you can extrapolate information about the file, including its name, initial cluster, and size. The data recovery program may also scan the disk's data area for the file's headers and footers, allowing the user to pinpoint the exact location of any lost data.