Deleted Data Recovery
0800 008 6638
Hard Drive + Laptop + RAID + Mobile Phone.
Free Courier Collect Unrivaled Success Rates Express Service Available Prices Start @ £95 ex VAT Deleted Data Experts
Deleted Data Recovered from Hard Drives.
Here a Datlabs we deal with deleted data cases on a daily basis and have a stringent process in place to ensure our customers have the best possible chance of recovery. Firstly we clone the hard drive which has arrived at our recovery lab to undergo a deleted data process, this creates a perfect copy of the hard drive to allow our technicians to begin work. The cloning process is undertaken using a write blocker to prevent any information being written to the clients drive and so avoiding your data being damaged. Once we have a clone of the drive we use our specialist in-house recovery software to scan over the entirety of the drive, this software is not available on the Internet and is created specifically for the various filesystems in use today. This software will locate all the data on the drive this includes both the existing data and the deleted data, which will hopefully include the data our customers are looking for.
Deleted Windows Data Recovery.
Microsoft Windows is currently the most popular operating system in use today. This OS typically utilises the NTFS filesystem type and fortunately this is one of the best filesystems for deleted data recovery. This filesystem compared to the more advanced journaling filesystems is relatively simple in how it handles data. Meta data for each file is located in a filerecord within the $MFT, this is the catalog for the entire drive and is used to locate details of the files including details such as creation date, modified date etc.
When a file is deleted from the NTFS filesystem 2 things occur, firstly a small 2-byte area of the 1024 byte filerecord is changed. This 2-byte area is used to inform the OS if the file is active or deleted.
00 01 – The File is active
00 00 – The File is inactive (Deleted)
The next procedure is to free up the clusters which were allocated to the file within the $Bitmap. The bitmap is a special file used by NTFS to keep track of which clusters are currently in use and which can be used for new data. This is a very simple process and one that works very well. When a cluster is in use the bitmap will mark this with an ‘F’ to identify this area is now in use and then ‘0’ if it is free. When a file is deleted the bitmap will change for the data area for this file, changing from ‘F’ to ‘0’, thus not over writing it, simply marking the clusters as free for new data. Now the file has been deleted and the clusters available for use the file will still reside on the disk until these clusters are used for more data.
If a DIY deleted data recovery operation is conducted or the system is in use for an extended period of time these cluster storing your critical data could be chosen to store new data, this could be a special photo or video erased forever.
Modern Apple computers use a file system called HFS, the most modern one being HFS+. HFS+ is the most common file system our technician’s encounter these data used upon data storage devices connected to Apple devices.
Unlike the more popular NTFS file system HFS+ can cause various problems when a deleted data recovery is required. These issues arise due to the use of b-tree data structures used to store the file meta data which are used to describe the name and block allocation (where the file is stored). This b-tree is instantly updated when a file is deleted and can cause mass overwrites destroying meta data to maintain consistency.
This destructive process can cause difficulties when deleted data is required, however our data recovery technicians understand the HFS+ file system in-depth and can in most cases recover your deleted data as long as the data has not been overwritten by newer data.
Deleted Linux Data Recovery
Linux is now a very popular alternative to Windows and here at Datlabs we are seeing more drive arrive for deleted data recovery using the typical Linux EXT filesystem. Linux is open source and as a result this is often used in modern NAS devices, again something Datlabs technicians are seeing more and more of.
EXT comes in many flavors, however the most common these days are EXT3 and EXT4, unfortunately changes to these versions have made deleted data recovery much more difficult than older versions or NTFS.
When a file is deleted the OS will as a minimum perform the following:
- Mark the blocks as unallocated
- Mark the Inode as unallocated
- Mark directory entry as unallocated
In EXT2 this minimalist approach would ensure deleted data recovery would be relatively easy using the correct approach because the Inode would still contain the block address or pointers to where the file was stored meaning the file could be found and recreated. In EXT3/4 a new step was introduced which now removes or clears this block address and file size from the Inode. The data is at this point still on the hard drive, however EXT3/4 has now deleted the primary details of where pieces of the file are located. Whilst this does not mean the data is unrecoverable, it certainly makes things harder for our technicians.
As with all deleted data cases we recommend that the system be powered down and you call our team. As with all filesystems the area where your precious data once is now marked as free and could be overwritten at any point.