Hello willy41,
Thank you for your question.
Yes, indeed, deleted information is often retrievable from a hard
drive. And copies of information are also sometimes stored in places
that are not obvious, as well as you will see in just a bit.
The short explanation is that when a file is deleted on the hard
drive, what really is deleted is the "pointer" to the file and not the
actual data itself. That will remain until it is written over by a new
file. If the drive in question has lots of free space, then the
previously allocated space may not be overwritten for quite some time.
Note this article:
http://www.akdart.com/priv9.html
"Many computer users, including some who should know better, are
unaware that deleted files can be recovered (undeleted) and can yield
information which can be used against the person who deleted them.
This information can be as common as a deleted email message or as
important as sensitive business records or government transactions.
Apparently there are many people who own paper shredders who don't
know or don't care about residual information from their deleted
computer files, but there have been many people in recent history who
have learned about this issue the hard way. That is how U.S. Senate
investigators got evidence on Col. Oliver North.1 E-mail messages
that North believed to be deleted were found and used against him in
litigation.2 A total of 758 e-mail messages were sent, involving him
in the Iran-Contra affair, and every one of them was recovered.3
"Computer forensics" is the term for recovering other people's deleted
or "lost" data. This can be done as a favor to you, when your
computer has crashed, (where "favor" often means a commercially
available service which costs a lot), or it can be done by a law
enforcement agency when your computer has been seized as evidence. In
the latter case, you can be sure that anything embarrassing which is
found on your computer can and will be used against you, whether or
not it pertains to your alleged criminal conduct.
The primary hazard associated with the use of file wipers is that you
may accidentally erase a file that you wish you hadn't. Files which
have been wiped are gone. Recovery through software is impossible
after the file has been subjected to a single overwrite with other
data, and recovery through more elaborate techniques is generally
thought to be impossible after ten or twelve passes with random data
rewriting the same sector of the disk. So if you use one of these
power tools, be sure you know what you are doing..."
They continue with their list of recommended software and a great
number of useful and informative links.
There are a number of programs to recover "deleted" data and some will
recover more than others. Most will at least be able to pick up enough
fragments of files to be able to determine the subject matter, type of
file or perhaps the program that generated the file, such as a Word
document. Some of the professional data recovery services use programs
that are more "industrial strength" than those available for general
purchase, but even those can do a remarkable job.
You might wish to read about the process at professional recovery
sites such as:
Reynolds Data Recovery:
http://www.data-recovery.com/
RenewData:
http://www.renewdata.com/data_recovery.html
Programs you can purchase for this include:
RecoverMyFiles:
http://www.recovermyfiles.com/Recovery_checklist.html
ActiveUneraser:
http://www.uneraser.com/features.htm
And at least one company both provides the service and sells software
for your own data recovery:
Ontrack:
http://www.ontrack.com/
I personally have used this software with excellent results.
There are also programs designed for specialty data recovery such as
from CD-ROM's as opposed to hard drives, as these keep a different
directory structure than hard drives. Arrowkey makes an excellent
program for this called CD Rx Data Retriever:
Arrowkey:
http://www.cdrom-prod.com/software.html
I have used this program as well to retrieve medical records from
damaged CD's which is a mission critical application as retaining
these records are required by law! It rarely failed to recover enough
data to satisfy my clients.
These programs sell for anywhere from under $100 to the thousands and
sometimes the more costly will recover more than the inexpensive
programs, but that is not always the case.
Norton Utilities has a file undelete and also an option to protect
deleted files one step further with Norton File Protect. Norton
Utilities is now part of Norton SystemWorks:
Symantec:
http://www.symantec.com/sabu/sysworks/basic/
This program, Recover Data Recovery, sells for only $29.95, though I
have no personal experience with the product:
Recover Data Recovery:
http://www.tipsdr.com/recover-data-recovery.html
"Recover Data Recovery - Undelete & Recover deleted files from your
FAT 12/16/32 Hardisks
Delete some files or folders by accident, and need them back fast?
Recover data recovery program is what you need, just load it and get
your files back quickly and easily. As long as your pc can see the
disk it's on, you have a shot at recovering your data. Undelete &
Recover deleted files from your FAT 12/16/32 Hardisks, SmartMedia,
CompactFlash, MemoryStick, MicroDrive, Multimedia Card, SecureDigital
Card & Floppy Drives. Undelete and Recover your important Files such
as Word/Excel Documents, Database files, all files including Mp3s &
MPEGs as were accidentally deleted through Recycle Bin. An everyday
use tool so you never worry about your important files and folders
ever. Just install it, scan drives and it takes you to recover deleted
files within seconds. It can undelete files on any valid logical disks
visible by the host OS. Supported file extensions (all file types)
Requires Windows 95/98/ME/NT4.0/2000/XP"
There are even specialty programs for recovering data from NTFS file
systems used commonly on Windows NT and now as an option in Windows
XP:
Easy Undelete:
http://easy-undelete.com/
As you will see, the less the computer has been used since the file
deletion, the better the chance of a full file recovery.
As I mentioned early on, some things are stored or copied in
non-obvious places on your computer, as well. For example, while you
can delete cookies and history files in Microsoft's Internet Explorer,
there is a file in those directories called Index.dat that actually
keeps a small copy of visited sites. Deleting these files from
options, delete files or history in Internet Explorer DOES NOT remove
or reset Index.dat. There are utilities to do that, and it must be
done outside of Windows as the file is locked while he Windows
operating system is running. One such utility is called
IECacheCleaner, available for free download here:
http://encoderx.co.uk/freeware2.html
A simple search for "recover deleted files" will bring up many
thousands of hits for both companies offering data recovery services
as well as programs you can purchase to perform your own recoveries,
should you wish to search further.
You can also check the popular download sites to see ratings on some
of these programs. For example, searching CNET for data recovery shows
142 hits:
CNET
http://download.com.com/3120-20-0.html?qt=data+recovery&tg=dl-2001
Search Strategy:
recover deleted files
how are deleted files recovered?
I trust my research has answered your question and provided useful
links for further reading. If a link above should fail to work or
anything require further explanation or research, please do post a
Request for Clarification prior to rating the answer and closing the
question and I will be pleased to assist further.
Regards,
-=clouseau=- |
