Recovery Software
Data Recovery Software
Most data recovery program search for deleted MFT entries to undelete files (learn about MFT records here). These programs usually give a give a probability of recovery rating of 'good', 'medium' or 'poor'. What they are actually doing is locating the MFT record for a deleted file and then checking the rest of the MFT records to determine if the clusters that the deleted file occupied are being used by any other file stored on the computer. As only one file can occupy any one cluster on a hard drive, if other files are using your deleted files storage space then it is likely that the original data has been overwritten and permanently destroyed.
This recovery technique is usually relatively fast way to get data back, as all the recovery program has to do is find the deleted file entries in the MFT and then go directly to that location of the hard disk to perform the data recovery. You will see an MFT search when you execute a "Recover Files" search using Recover My Files Data Recovery Software.
However, if your MFT is corrupt, defective or has itself been overwritten, this method isn't going to help you even though the file data still remains out on the disk waiting to be found. What you need to do is search unallocated clusters.
Searching Unallocated Clusters for Deleted Files
A good data recovery program will have the option to ignore the MFT (or lack there of) and to search all the unallocated clusters to try and find and recover files. This means we need to know what a deleted file looks like. Luckily most file types have a unique file header and footer. This means that if you look inside a Microsoft Word document for example, the first characters and the last characters of the file are always the same. So therefore a data recover program can search the entire hard drive and identify files by their unique header and footers. You will see this technique used in Recover My Files Data Recovery Software when you select a 'Complete Search'. Recover My Files recognizes more than 160 different file types using this technique.
Why are Some Files Partially Corrupt after a software File Recovery?
Remember that a computer will only use as many clusters as it needs to store a complete file. This means that your original data may only have been partially overwritten. You may still be able to retrieve some of the clusters containing the file. Unfortunately, in most cases that won't be helpful, as most programs need a file to be complete before they will process it. Rebuilding partially damaged files is a another area of data recovery. It requires specialized knowledge about the particular file types one is dealing with. Some links to software for repairing specific file types are provided above.
Data Recovery from a Formatted Hard Drive
When you run the format command you are simply erasing the Root Directory Entries and FAT, or MFT. It is possible to run the format command and wipe the entire hard drive but format must be executed with special options. There are a number of tricks that data recovery programs use to recover from format commands. This includes searching for deleted Directory Entries which are in fact stored as files on the computer. If a directory entry is located, then we now know the name, starting cluster location, and size of the files. Of course you can also search the data area of a formatted drive for file header and footers and locate individual file types by this method.
What is the problem with File Fragmentation?
The problem of file fragmentation is that most of the data recovery techniques available must work on the assumption that all files are contiguous, that is, that they are stored in consecutive sectors one after the other from the beginning to the end of the file. The information to track fragmentation of a file is overwritten when the FAT or the MFT records are destroyed.
