How can data be recovered from your hard drive after it’s been deleted?

A person buys a stolen prototype gadget that was found in a bar and takes pictures and video of it.  After publishing them on the Internet their house is raided and their computer equipment is confiscated.

Luckily for them, they erased all of the data regarding the gadget so they’re safe, right?

Right?

Not necessarily.

Today’s Question of the Week appeared on Superuser.com courtesy of Jerry when he asked how detectives in the Casey Anthony trial had recovered keyword searches for evidence that had been manually deleted from a computer.

When people think of recovering data that has been deleted, generally they think about their operating system’s built in solution like the Recycle Bin in Windows.

It’s true that this is a place that the police could potentially recover deleted data, but as users get more advanced they are more likely to empty the Recycle Bin or bypass it and delete things completely in the first place (Shift+Delete does this in Windows).

So how could someone recover data that’s been deleted completely?

This is possible because of how a hard drive stores data.

A conventional hard drive uses one or more magnetic platters to store data. These look like a CD that has been dipped in silver and have a mirror surface.

To store data, the hard drive uses a tiny magnetic write head at the end of an arm to change the properties of the platter. Think of a freely moving record player on a much smaller scale.

The way it keeps track of all of the data on it’s platters is by using a File Allocation Table.

To visualize this table, I’d like you to imagine a library in 1970.

You have all of the rows of shelves that are filled with books and you have drawers with cards that tell you where the book you’re looking for is located.

On a hard drive, you have a table (the drawers) that’s separate from the files (the books).

Your computer references this table when it needs to find data. It then goes to the location of the book with it’s read head reads the data there.  SSDs work the same way, they just use a different technology to store and read data.

When you decide to delete a file the computer just erases the contents of the table for the location where the file was stored.  This basically puts a blank card for that file in the table. Because it would take more time and power for the computer to go to each location and actually erase the file every time something is deleted, it just leaves it there until another file is saved that overwrites the original.

Then, because the book is still physically in the library, even though it’s not on their records, it’s possible to read all of the books and find out what’s recently been deleted. (As long as it hasn’t been overwritten since then!)

With this knowledge, companies have created software that can scan the parts of the hard drive that are labeled as free space to see what they once contained.

Here’s an example of Piriform Recuva running a scan for recently deleted software.

Note that it finds some files that have been partially overwritten and are unrecoverable.

This free software and other programs like it are good if you accidentally erase something at home or work, but government and law enforcement have more sophisticated tools that they can use when they’re conducting investigations.

If you want to make sure your data is erased, you can download programs that are designed to wipe the drive clean.  They do this by filling the data parts of the hard drive with zeroes or ones.

To use the analogy above, that’s like running a program that goes to each book that isn’t on file and replaces all of the text with repeating zeroes.

If you have suggestions for good file recovery and free space wiping programs, please mention them in the comments!