Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

From what I understand even if I delete file, format disk and many times write different files in the same place(there are applications that do that) the file can still be undeleted.

If that is true why there are no applications that use that to make disk bigger?

Even if undeleting takes some time it could be used as archive. so I could have 1000 10GB games on 200GB disk and choose to undelete/unpack one of them and play it.

Why nobody has done it? Are files not as recoverable as they seem to be?

share|improve this question

migrated from programmers.stackexchange.com Nov 3 '11 at 6:34

This question came from our site for professional programmers interested in conceptual questions about software development.

3  
The problem is that when deleting a file you do actually send it into another dimension, so to be able to play your games you must jump into that dimension first. Although technically possible, to send a person to another dimension is still a lot more expensive than buying a few extra teras of disk space. –  Yannis Rizos Nov 3 '11 at 5:49
3  
Because these 'undelete' techniques are not 100% successful. There's a chance you may get the files back. Do you really want to store your files and only have a 50% chance of being able to open them the next day? –  Rob Nov 3 '11 at 6:28
add comment

2 Answers

up vote 5 down vote accepted

A 1TB disk is designed to store 1TB. This means that its physical storage can hold 1TB.

On the logical level (OS, file-system) there are some mechanisms which may obfustace this fact:

  • Compression: If the OS support file-compression, the physical storage size needed to store files can be smaller than the actual file size.
  • Mark-as-deleted: Usually when a file is being deleted, the region on the disk where the file is stored is not cleared. Instead, it is only marked as free, and as long as this region was not reused - the file may be recovered - just by indication that there is a file stored in this region.

Once a physical region of the disk is rewritten, it is impossible to restore the previous data using software. However, in mechanical disks, head positioning system is not exact enough. New data written to a drive may not be written back to the precise location of the original data. This track misalignment is argued to make possible the process of identifying traces of data from earlier magnetic patterns alongside the current track.

Electron microscope based hardware were built to probabilistically restore data based on this fact. Note that it would require to dismantle the drive in a clean-room environment.

The following study shows that for modern drives, although there is a good chance of recovery for any individual bit from a drive, the chances of recovery of any amount of data from a drive using an electron microscope are negligible.

share|improve this answer
1  
+1 for using electron microscope based hardware in a phrase... –  Yannis Nov 3 '11 at 7:53
    
Why programs like Data Destroyer overrides deleted data 3 times? why not just once? –  IAdapter Nov 3 '11 at 9:24
2  
@Iadapter: For each override the track misalignment will by different. This decreases the probability of restoration using an electron microscope. –  Lior Kogan Nov 3 '11 at 9:45
add comment

When you delete a file, it doesn't actually sit down as delete every byte from your hard drive. It simple marks the file as "deleted, overwrite as necessary." When your computer writes more data, it may or may not decide overwrite that part of your hard disk to store the new file.

Think of a book. Each page is a file. When a file is no longer required, you write DELETED across it. When you read the book, you know deleted pages are no longer relevant. If you do need the file back, you can rub out the word DELETED and read your file again. If the book is full and you need to write a new file, you find a page marked DELETED, rub out everything there, and write your new file. You can no longer recover the deleted file.

So in your example of reformatting a hard disk, you can undelete a file that has by chance never been overwritten.

share|improve this answer
    
Files can still be recovered once they have been overwritten, but it's not gauranteed to work –  Rob Nov 3 '11 at 6:27
    
@Rob - it's also not really achievable by normal consumer-grade tools. AFAIK recovering overwritten data relies on being able to resolve head misalignment in the magnetic patterns on the platter itself — not something you could do with an upgraded driver :P –  detly Nov 3 '11 at 7:26
    
Why programs like Data Destroyer overrides deleted data 3 times? why not just once? –  IAdapter Nov 3 '11 at 9:24
    
@IAdapter, for exactly the reasons in the comments above. If you really want it deleted, overwrite it several times so not even a professional data recoverer can get the data back. It's good for destroying company secrets when you dispose of your computers. –  Hand-E-Food Nov 3 '11 at 22:24
    
Not all file clusters may be overriden at same time so it's possible to restore parts of the file in remaining clusters. –  Magno C Jan 23 at 12:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.