Quite often our customers ask us if it's possible to recover overwritten data and if so, then how would one go about performing such a task.
First let's take a look at how data is stored on a data storage device. There are currently two main types of storage devices: conventional hard disk drives (HDD) and the newer solid-state drives (SSD).
Hard Disk Drives:
HDDs use magnetic storage to store and retrieve data. Their heads magnetize a thin magnetic film on rotating platters. Changes in the direction of magnetization represent 0's and 1's in stored data. When a new data is written over the old one, the direction of magnetization is changed according to the new data, and there's no way to retrieve the previous data, at least without completely disassembling the disk and analyzing the magnetic field on its platters scrupulously. All of this is beyond the skill of even a very advanced computer user.
Solid State Drives:
SSDs use another physical principle for data storage: they store electrical charges within their internal cells. Before new data can be written to a cell, it has to be discharged which means that the previous data is lost. To make the situation even more complicated, SSDs utilize a complex method for deleting and writing. You may read more about file recovery from SSD devices in our article: File Recovery Specifics for SSD devices
Although these two storage devices are different in their operating principles, they have one thing in common: once data is overwritten, it's gone. Forever.
Now let's look at how all this affects file recovery.
An overwritten file
All modern file systems store the information about the file, such as its name, timestamps, and other service info separately from its content. There are several reasons for doing it this way, flexible free space management being the main. In addition, a file may be stored in fragments for better free space utilization. Fig.1 shows a typical file storage layout on a disk:
Figure 1: File storage layout
Click image to enlarge
When a contemporary operating system deletes a file, it partially or completely deletes the info about the file, but the content of the file remains intact. The file can therefore be recovered even when its info is completely deleted, provided that the file is not fragmented.
If the file is overwritten, the new data overwrites the old one, such a file cannot be recovered. The new file may have the same name and size, but the content will be new. This is how file wiping programs (such as our R-Wipe & Clean and Shredder in R-Undelete) completely destroys files beyond any recovery.
An overwritten partition
An important note: Do not confuse this case with reformatted partitions, where only the info regarding files and folders is lost, whereas the content of the files remains untouched and can be recovered to some degree.
When an entire partition gets overwritten, for example, when a new operating system is installed on the wrong partition, or an image is wrongly restored, the data of the new partition overwrites the data of the previous one. Fig. 2 shows such a case.
Figure 2: Overwritten partition layout
Click image to enlarge
Almost always such process completely overwrites file info but may keep some data from the previous partition untouched. Some files may be recovered from the untouched area using search for known files (raw file recovery). Our article File Recovery after Re-installing Windows (Case 1. New Windows has been installed on the same and one partition on the disk) presents an example of such a recovery. (You don't have to use always R-Studio Emergency for such recovery, if you're going to recover files from an external disk, R-Studio for Windows/Mac/Linux will do the same job more conveniently)
