Deleted files

The lowdown on deleted files and photos

A large part of our data recovery service is to recover deleted or lost files and photos. This type of data loss is rarely down to hardware faults or physical damage to the hard drive or device. More often than not files are deleted accidentally or through a software error. It is distressing to discover that important files and photos have been permanently deleted, but by contacting a data recovery company it may be relatively painless to get them back.

Later we’ll explain the dangers of using free data recovery software, this is also explored in detail in our post ‘Data Recovery Software – what you need to know’.

First we’ll take a look at how files are stored and the belief that ‘permanently deleted’ files are gone for good.

How files are stored

Files are physically stored on the disk platters of a hard drive in a PC or Laptop and on NAND chips in most other devices such as USB sticks, SSD (Solid state Drives), mobile phones and Tablets. Each file is stored in a random location depending on where free space is available.

The Windows operating system uses the NTFS file system and contains a file list called the MFT (Master File Table), in which every single file stored on the device has an individual record. That record includes its physical location, its file and folder location and various other information (metadata) such as filename, creation date, file size, file type and much more.

When you view files through Windows Explorer, you are seeing details from the MFT which are just pointers to the real files. It’s just a user friendly and highly organised way to be able to view huge volumes of randomly located files on the storage device.

When a file is deleted, initially it is just marked as deleted in the MFT and permanently hidden from you and any file explorer software. That ‘deleted’ file will only be completely removed from the storage medium if it is overwritten by a newly created file.

Other file systems work in similar but unique ways. These include Mac HFS+, Linux EXT4 and older versions of Windows use FAT32.

Causes of deleted data

There are many number of reasons that files may become lost or inaccessible. In some cases the files may not have actually been deleted, they are just not visible or accessible by the software you are using.

Emptying the recycling bin

This removes the files from the recycling bin and permanently deletes them, marking them as removed in the MFT and hiding them from the file system.

Corrupt format on an SD card

If the format of the SD card becomes corrupted, photos may not be seen by a digital camera, phone or even when viewed through another operating system. If the user then re-formats the card to use it the files may be permanently erased. A ‘quick format’ will usually just hide the files, whereas a ‘full format’ will actually remove them permanently.

The MFT gets corrupted

If the MFT gets corrupted it is likely you would experience problems accessing files and folders, they may even no longer be visible, appearing to have been deleted. If corruption occurs on records that hold important windows system files, the device may slow down, keep crashing or not even boot up.

Operating system problems

A corruption in the operating system may mean that your files are no longer visible or accessible. While they may not have been deleted it may appear this way. Again, this might manifest as not booting, blue screens, crashing or abnormal behaviour.

Files deleted by a virus or malware

Computer viruses and malware programs are often designed to delete or encrypt the user’s data rendering it inaccessible. It is entirely dependent on the type of virus or malicious software as to how much data can be recovered. If you find yourself in this situation, disconnect your device from the internet and contact a data recovery specialist.

Operating system re-installation

This is an occurrence that we have seen numerous times. The user reinstalls the operating system in the belief that the data will be untouched, unfortunately this action will delete all programs and user data. On some occasions the reinstallation will format the device first.

Issues relating to cloud based synchronisation

We have encountered issues where the deleting of files on a cloud based application can result in the unwanted deletion of local copies of the files.

Device formatting

Occasionally devices are accidentally formatted, which will effectively delete all of the stored data.

Depending on the type of device and the level of formatting that has occurred, there still may be an opportunity to get some or all of the data back.

Data recovery software

There is a lot of free and paid for data recovery software available online (We discuss this in detail in our article ‘Data Recovery Software – what you need to know’) and it is tempting to try this option to recover your deleted files. The main problem is that by downloading the software you may potentially write over some of the ‘deleted’ files that you are trying to recover.

Depending on the nature of the deletion and the type of data recovery software you are using, it is still possible that some of the deleted files will not be recovered. Also, some ‘Freemium’ data recovery software will only allow you to recover files up to a certain file size, then you will need to pay to recover the larger files.

What to do if you have accidentally deleted files

The best advice is to stop using the device immediately and contact a professional data recovery company. Continued use of the device could end up writing over the deleted files. Even if you are not saving new files, the operating system still uses storage areas to save information when performing background tasks, such as a Windows update and various other management processes.

The longer you continue using the device the less chance there is of recovering your data. Once the files are overwritten there is no possibility of getting them back by any means.

What are the chances of recovery?

It completely depends on how the data was deleted and if the device has been used after the deletion occurred. Data recovery techniques might well be able to recover some or all of your files. The most important thing you can do is stop using the device immediately.

Make an informed choice about the data recovery company you choose and try to be specific in what the most important files and folders are. If you explain the nature of how the files went missing, this could increase the chances of recovery. Your chosen data recovery service provider will be able to talk you through the process and explain what the possibilities of recovery are.