HACKER Q&A
📣 cbracketdash

How are “deleted” files recovered?


Recently, I accidentally wiped my entire USB disk and I could not view any files with my regular explorer. However, some recovery software were able to essentially view all the "hidden" files. How does this mechanism work? And is there any open-source recovery software where I can explore this topic?

Many thanks in advance for your help and support

Kind regards


  👤 schoen Accepted Answer ✓
The basic idea is that the filesystem exposes a directory data structure, which lists file names and metadata, and somehow associates this with disk locations where the file contents are stored.

Different filesystems handle this quite differently, but it's common that deleting a file doesn't actually overwrite the contents (mostly because that would take extra time, perhaps a significant amount of extra time). In most filesystems it just involves removing a directory entry (so that the file is no longer displayed as existing), and somehow marking the disk locations where the file's contents were stored as free (so that they can be reallocated for future files).

Data recovery and undeletion can involve finding the directory entries or allocation records, or just looking for interesting data on the raw disk device without regard to its allocation structure ("carving").

The exact technical details depend a lot on your operating system and filesystem type.

https://en.wikipedia.org/wiki/File_system

But you can learn a lot with a hex editor and/or filesystem debugger, as well as the technical documentation for the filesystem type that you're using.


👤 besnn00
When files are deleted, they are not really wiped; it’s just that all links to that file are removed so there is no more a way to access that file normally. Usually you have some time until that information is overwriten by the system and until then you could theoretically use any kind of recovery software that does the job. In reality doing it yourself (without a special-purpose program) would be wasteful as you would have to check information bit by bit until you found what you were looking for.