How file recovery software works

Welcome to Hackers World!!!!!

 

Hi Friends you very well know about how to recover your data through Recovery software’s after deleting from Recycle bin. Today I will discuss how file recovery software actually works.

Files in a computer have a volume table (directory table) that contains, among other things, an entry for each file in the hard disk along with the address of the location where the file is stored. When a file is deleted, a small part of the table for that entry is modified marking the space as free. The data still remain in the disk until it is overwritten at some later time. Now two possibilities arise:

1) The table entry for a deleted file is intact. In this case, it will still contain the pointer to the file. A quick reading of volume table by the file recovery software followed by looking at the location for the file may recover data if it is not overwritten by that time.

2) The table entry itself is overwritten, i.e. some other file entry has replaced the free'd file's entry. In this case, the file recovery software uses Advance mode. In this mode, it scans the whole disk reading each block and matches the files there with entries in the table. That is the reason this option takes a long time. If the file in any block has an associated entry in the table, it means the file is still alive i.e. not deleted, and it skips to next file and its entry. If a file has no corresponding entry in the table, it means this file has been deleted and so the tool marks this as "Found".

The most important step in data recovery after a file is accidentally deleted is to make sure that the disk is immediately detached if one wants to recover the file. Otherwise, the data might get overwritten and not recoverable by such tools. It also means that just deleting a file doesn't ensure the data is gone. One needs a proper tool to erase data. Such tools overwrite the whole data in the disk with random bit patterns many times over rendering it pattern-less and non-recoverable. Hardware techniques also exist to erase data such as degaussing which basically erases data in a disc magnetically.

Thanks for Reading this article, Hope you will like……

Be a Good Hacker and Save the Nation!!!!!

Thanks & Regards

Tarun Arora

Tarora89@gmail.com