Home

A very common problem with all computer storage is accidental deletion of files.

On most operating systems, when a file is deleted the directory entry is marked as deleted, and the space is made available for re-use. If nothing else is written to the disk, then there is a very good chance of recovering the files.  One analogy would be if a telephone directory was torn up, it would still be possible to telephone the existing numbers.

There are two major considerations on deleted file recovery and these are overwritten files, and fragmented files.

Overwritten files

When a file is deleted, the space is made available for new files. Any new file could therefore use the space that a previous file - now deleted -  used. Depending on the file, this could render the file totally unsable, or just a section with unknown data in it.  CnW Recovery tries to detect when a file has been potentially overwritten, and recovered files will be stored in an 'Overwritten' directory.

Fragmented files

The optimum way for any operating system to write a file is as a continuous stream. As the disk gets full, or very large file are written, it is often necessary to write a file in several sections or fragments, and hence we get fragmented files. Recovery is therefore more complex.

A FAT drive stores the start of a file in the directory, but then each cluster location is stored in the File Allocation table. This table is cleared down when a file is deleted, and so no record of how the file was stored is kept. On recovery, it is often only possible to assume that the file was sequential, and on many occasions, this leads to a good recovery. On a very large file, or very full disk, the success rate drops.

NTFS disks have a major advantage over FAT disks described above in that often the first 10 or so fragments are stored in the directory, or Master File Table (MFT) block. Thus a partially fragmented file can be recovered without errors. The structure of an MFT is very complex, and in some cases and MFT may comprise of more than 10 separate MFTs, so very fragmented files can still represent major problems.

Ext4 disks - it is not possible to receover deleted file except by data carving.  All metadata is cleared when the file is deleted.