Deleted Data Specialists.
0871 977 2999
Affordable Data Recovery.
Professional Services and Facilities.
Click Below for:-
Here at Datlabs we use specialist software, methods and procedures to rescue deleted files, folders, mail, texts etc., from digital data storage devices such as Computers, Laptops, IPads , Mobile Phones, CCTV Systems and Digital Cameras.
Recovering Deleted Data.
When you delete a file or folder from a computer, media or communications device, what you are actually doing is removing the operating systems means of referencing the data. Having removed this reference the file location is then available to be over-written by new data created by your operating system applications. Deleted data can in the majority of cases be rescued as long as it has not been overwritten by any newly created data, defrag or formatting activity.
When a file or folder is deleted from your system most popular operating systems such as Windows, Mac and Linux do not actually remove/delete or destroy the file, the filesystem will simply remove the index to these files and mark the data area as available rather than in use.
If this data area is then not used by the filesystem then the file will remain and with the correct procedure can be recovered, something to keep in mind when you have deleted sensitive information. With this in mind to ensure the best possible chance of recovery we recommend that the computer is shut down and you give our trained staff a call. When the system is booted, start-up processes are capable of creating new data in update , gathering mail and text etc that could potentially overwrite unallocated data storage areas.
Our Deleted Data Recovery Process.
Here a Datlabs we deal with deleted data cases on a daily basis and have a stringent process in place to ensure our customers have the best possible chance of recovery. Firstly we clone the hard drive which has arrived at our recovery lab to undergo a deleted data process, this creates a perfect copy of the hard drive to allow our technicians to begin work. The cloning process is undertaken using a write blocker to prevent any information being written to the clients drive and so avoiding your data being damaged. Once we have a clone of the drive we use our specialist in-house recovery software to scan over the entirety of the drive, this software is not available on the Internet and is created specifically for the various filesystems in use today. This software will locate all the data on the drive this includes both the existing data and the deleted data, which will hopefully include the data our customers are looking for.
Windows Deleted Data Recovery.
Microsoft Windows is currently the most popular operating system in use today. This OS typically utilises the NTFS filesystem type and fortunately this is one of the best filesystems for deleted data recovery. This filesystem compared to the more advanced journaling filesystems is relatively simple in how it handles data. Meta data for each file is located in a filerecord within the $MFT, this is the catalog for the entire drive and is used to locate details of the files including details such as creation date, modified date etc.
When a file is deleted from the NTFS filesystem 2 things occur, firstly a small 2-byte area of the 1024 byte filerecord is changed. This 2-byte area is used to inform the OS if the file is active or deleted.
00 01 – The File is active
00 00 – The File is inactive (Deleted)
The next procedure is to free up the clusters which were allocated to the file within the $Bitmap. The bitmap is a special file used by NTFS to keep track of which clusters are currently in use and which can be used for new data. This is a very simple process and one that works very well. When a cluster is in use the bitmap will mark this with an ‘F’ to identify this area is now in use and then ‘0’ if it is free. When a file is deleted the bitmap will change for the data area for this file, changing from ‘F’ to ‘0’, thus not over writing it, simply marking the clusters as free for new data. Now the file has been deleted and the clusters available for use the file will still reside on the disk until these clusters are used for more data.
If a DIY deleted data recovery operation is conducted or the system is in use for an extended period of time these cluster storing your critical data could be chosen to store new data, this could be a special photo or video erased forever.
Macintosh Deleted Data Recovery
Modern Apple computers use a filesystem called HFS, the most modern one being HFS+. HFS+ is the most common filesystem our technician’s encounter these data used upon data storage devices connected to Apple devices.
Unlike the more popular NTFS filesystem HFS+ can cause various problems when a deleted data recovery is required. These issues arise due to the use of b-tree data structures used to store the file meta data which are used to describe the name and block allocation (where the file is stored). This b-tree is instantly updated when a file is deleted and can cause mass overwrites destroying meta data to maintain consistency.
This destructive process can cause difficulties when deleted data is required, however our data recovery technicians understand the HFS+ filesystem in-depth and can in most cases recover your deleted data as long as the data has not been overwritten by newer data.
Linux Deleted Data Recovery
Linux is now a very popular alternative to Windows and here at Datlabs we are seeing more drive arrive for deleted data recovery using the typical Linux EXT filesystem. Linux is open source and as a result this is often used in modern NAS devices, again something Datlabs technicians are seeing more and more of.
EXT comes in many flavors, however the most common these days are EXT3 and EXT4, unfortunately changes to these versions have made deleted data recovery much more difficult than older versions or NTFS.
When a file is deleted the OS will as a minimum perform the following:
- Mark the blocks as unallocated
- Mark the Inode as unallocated
- Mark directory entry as unallocated
In EXT2 this minimalist approach would ensure deleted data recovery would be relatively easy using the correct approach because the Inode would still contain the block address or pointers to where the file was stored meaning the file could be found and recreated. In EXT3/4 a new step was introduced which now removes or clears this block address and file size from the Inode. The data is at this point still on the hard drive, however EXT3/4 has now deleted the primary details of where pieces of the file are located. Whilst this does not mean the data is unrecoverable, it certainly makes things harder for our technicians.
As with all deleted data cases we recommend that the system be powered down and you call our team. As with all filesystems the area where your precious data once is now marked as free and could be overwritten at any point.