Why It Is Impossible To Recover Data From An Overwritten Hard Drive [Technology Explained]

September 20, 2011

By Tina Sieber Ads by Google

Photo Recovery Recover Lost Photos in 3 Steps. 100% Guarantee, Download Now!
PhotoRecoveryPro.net

Bachelor in IT Security Fast Track - eLearning - From Home. Earn Your Degree in just 15 Months!
www.actis.net

Data Recovery Tanzania Expert in Data Recovery, HardDisk, FlashDisk +255-776-000251

www.DataRecoveryTanzania.Co.Tz

Free TOEFL Practice Tests Listening, reading, speaking, and writing. Learn your score now.
www.testden.com

Recovering deleted data from a hard drive is generally possible because typically the actual data is not deleted. Instead, information about where the data is stored is removed. In this article I will explain how data is stored on a hard drive, what happens when files are deleted, what formatting a hard drive does, and why it is impossible to recover files after they were overwritten. The article outlines how data is stored on the physical level, which is essential to understanding why it can not be restored after being overwritten. If you are interested in the organizational structure of a hard drive, i.e. how the storage of files is managed, please read the article What A File System Is &

How You Can Find Out What Runs On Your Drives. For more information on how to recover deleted files, see the resources at the bottom of this article.

How Is Information Stored Digitally?

Digital information is stored in bytes. Each byte contains 8 bits. Each bit has a value, which is either 0 or 1. This way of storing data is called the binary numeral system as it uses two symbols, i.e. 0 and 1. Subsequently, any data stored on a computer is written in the binary code, which is a string of 0s and 1s.

Ads by Google

Airtel -Yatosha Wasiliana Ndani na Nje ya mtandao kwa bei moja poa. Piga *149*99#.
africa.airtel.com

How Do Hard Drives Store Information?

Information on hard disk drives (HDDs) is stored magnetically and non-volatile, meaning no power is required to maintain the stored information. Every magnet has a plus (+) and a minus (-) pole, which equals two values and thus allows it to represent the binary code. The HDD storage unit or platter contains a ferromagnetic surface, which is subdivided into small magnetic regions, called magnetic domains. HDDs store data by directional magnetization of magnetic domains. Each magnetic domain can be magnetized in one of two possible directions and subsequently represents one of two values: 0 or 1.

There are two different technologies for recording data on a HDD. Prior to 2005, the recording layer was oriented parallel to the disk surface (horizontally), meaning the binary code was represented by directional left vs. right magnetization (longitudinal recording). At around 2005 a new technology was introduced and data was written by magnetizing segments vertically, i.e. up vs. down (perpendicular recording). This allowed closer magnetic domain spacing and also enabled larger storage capacities.

How Is Data Stored In Random Access Memory (RAM)?

Essentially, data is stored the same way as on a hard drive, i.e. in binary code. The major difference is that this type of storage is volatile, meaning any stored information is lost as soon as power is removed. A RAM is made up of integrated circuits, which in turn contain capacitors and transistors. Each capacitor stores one bit of data. The state of the capacitor can either be charged or discharged, i.e. 1 or 0, representing the binary code.

What Happens When Data Is Deleted?

In a RAM module, the organizational structure is very flat. When data is removed from memory, the actual information vanishes instantly. Also, when power is lost, the capacitors quickly discharge and hence all information is lost. The situation on a HDD is completely different as information is stored in two ways. First, data is stored physically on the magnetic hard drive. Secondly, all stored data is managed by a file system, which creates an information table revealing the exact location of data, i.e. where on the hard drive a certain file is stored. This is necessary because one file can be stored in different locations across the hard drive. The operating system then uses this table to locate files and put together the pieces of large files.

When a file is deleted, typically only the information stored in the file systems table is removed. Since it would take too long to delete the actual file, the physical location of the data remains untouched. When the operating system wants to store new files, however, it consults the table for available space. Since the location of the deleted files was marked as vacant, the operating system may then write new data over the old data, which terminally deletes that information. For details on how the file system works and how it organizes and manage

What Happens When A HDD Is Formatted?

The type of formatting that most users are familiar with is called high-level formatting and it is the process of setting up an empty file system. Since it does not require scanning the hard drive for defects, it is also called quick formatting. Typically, data stored on the hard drive is not physically deleted during formatting. What does happen is that the file system is set up from scratch, meaning the hard drive is re-organized and the table with information where files are stored is reset. As long as the file system and its settings remain the same, none of the actual data previously stored on the hard drive is deleted or overwritten and can subsequently be recovered.

What Happens When Data Is Overwritten?

When data is overwritten, the magnetic domains on the HDD are re-magnetized. This is an irreversible process that physically removes information previously stored in this location. While some residual physical traces of the changes (or none changes) in magnetization potentially remain, which may theoretically allow a partial restore, this would require the use of a magnetic force microscope or similar technologies, none of which have been shown to recover data successfully so far [although you never know what's going on in secret government intelligence labs]. So in essence, there is no software or other technical way known to the public that can restore overwritten data.

Delete Data from Your Hard Drive

Lidija Davis November 16th, 2008
inShare

According to the New York Times, a basic privacy measure that is often overlooked is the proper destruction of data on hard drives.An ongoing study by British Telecom says that most people don't realize that deleting a file doesn't actually remove the data from a computer. In fact, the BT research found that only 33 percent of second hand hard drives had been completely wiped clean. To ensure your drive doesn't contain any personal data before you give it away or sell it, you need to reformat the hard drive or use digital shredding software if you want to completely eliminate all traces of data. In this post, we'll show you how.

When it comes to data stored on your computer, deleting files doesn't actually remove the data. File information is kept in a directory so that the operating system can find it. When you delete a file, all you are doing is removing it from the directory and flagging that part of the drive as being available for new data. Until that region is overwritten, the old data can be retrieved, in fact that's how you can recover lost data. It's also the way most file recovery programs work - they look for data on your hard drive that shouldn't be there according to the directory and restore it. The only way to completely remove the data is to overwrite the contents of the hard drive. You can do this by formatting the drive, or using data wiping software that fills your hard drive with random data.

A common misconception when deleting files is that they are completely removed from the hard drive. However, users should be aware that highly sensitive data can still be retrieved from a hard drive even after the files have been deleted because the data is not really gone. Files that are moved to the recycle bin (on PCs) or the trash can (on Macs) stay in those folders until the user empties the recycle bin or trash can. Once they have been deleted from those folders, they are still located in the hard drive and can be retrieved with the right software. Any time that a file is deleted from a hard drive, it is not erased. What is erased is the bit of information that points to the location of the file on the hard drive. The operating system uses these pointers to build the directory tree structure (the file allocation table), which consists of the pointers for every other file on the hard drive. When the pointer is erased, the file essentially becomes invisible to the operating system. The file still exists; the operating system just doesn't know how to find it. It is, however, relatively easy to retrieve deleted files with the right software. The only way to completely erase a file with no trace is to overwrite the data. The operating system will eventually overwrite files that have no pointers in the directory tree structure, so the longer an unpointed file remains in the hard drive the greater the probability that it has been overwritten. There are also many "file erasing" software products currently on the market that will permanently erase files by overwriting them. Recommended Reading: How to