Ge-adam-eek
this question is a bit stupid for the experienced ones in this forum so please excuse my ignorence :(
i have this program that can retrieve deleted data from the hard disk how does it work? and now in vista,etc.. u can easily recover data how does it work?
this is only my first semester in the university
and please dont tell me: google it!
xterm
Lets do a small test. Issue a low level format and tell me if that program of yours still work :-)
battikh
pieces of the files will be stored in different sectors of the hard disk and you have an index with the file name and where the 1st pieces of the files is located on the hard disk. when you delete a file, only the entry in the index is removed, but the actual data on the hard disk is kept (until it is overwritten by another file).
so if you catch the 1st cluster of a file and that none of the clusters have been overwritten by other files, you can recover the file by catching the 1st cluster.
also, easier, windows didn't use to delete the whole entry in the index, it just used to replace the 1st character with "_" i think. so you could easily catch these "empty" entries from the index. not sure if it's the same in ntfs now.
that's the way it is done by normal software for data recovery.
you have more advanced method, like actually reading the magnetism on the disk and read the binary data. even if a file was overwritten, you can try to guess what was the previous state of a bit.
J4D
Adam think about what was discussed today by owaijan csi 201 hard drives follow the ram policy "random access memory" :) that should make the process clear.if the hard drive wanted to delete every bit that's scattered on the hard drive using that magnetic head "ya3teek il 3afyeh" it will take forever , that's why when you delete a folder or a huge file on a computer its a matter of seconds and "you think its deleted" but rationally delete should take as much time as write since the head must change the ones on the disk to zeros and keep the zeros the same . but the random access memory policy makes the process easier by marking the deleted files indexed by a certain hex code deleted and the hard drive can simply over right them when it randomly dumps bits there :) i hope that made it clearer we can further discuss that issue at uni
Joe
I explain it in my blog. Check it out. I could use your opinion on how well it's explained.
http://www.tech-thoughts-blog.com/2009/09/foremost-quick-tool-to-recover-your.html
Ge-adam-eek
Thanks guys!!:D
Ge-adam-eek
perfectly explained!!:D thanks rahmu
rolf
- When a file is deleted, only the "index" entry of the file is deleted. The data remains, but it will be written over by new data with time.
- When a disk stops working, most often, it is the electrical printed board that is broken, by changing that, data can be salvaged off most defective disks.
- Advanced equipment can be used to recover data even when it is written over, because a "ghost image" of the data remains. That is why secure delete software will delete your file, then write and delete over it 7 times... to be sure that nothing can be recovered anymore. I don't think such recovery equipment exists in Lebanon, though.
- When the disk is formatted, a software can recover the data by analysing the disk, and finding "patterns" and using the to reconstruct the old filesystem.