Image courtesy of Enokson
We’ve all lost a file or deleted something on a computer only to realize a few minutes later we really need the information. The process of getting that file back into a format that can be read and used again is known as file recovery. The process can be simple or complicated, depending how badly the file was damaged in the first place. As most people are aware, computer files are fundamentally a compilation of data bits. Deletion of the file information can take place in a number of ways, each one progressively making the file damage harder to recover from. Fortunately, the most common loss is the easiest to repair.
Stage #1 repair: Recycling
At the most basic stage, a file deletion in most modern computer file systems simply transfers the “deleted” file to what is now known as a recycle bin. This process and folder destination is an automatic cut-and-paste function that occurs when a computer user initiates a basic deletion in a standard computer operating system. Even in databases, some safety sequence is usually built in to allow easy recovery of a simple deletion as long as a recycled copy exists. Recovering the file is a simple matter of finding it in the recycle bin folder and restoring it to its original state. Most programs include this feature.
Stage #2 repair: Finding hidden files
The next level of deletion involves an actual change of the file name to a semi-unusable format. Usually, the file name is truncated during the delete action so it can’t be found as a regular file. The data still exists, but the name won’t appear on usable files. That said, it hasn’t been erased yet. Instead, the space the file inhabits on a storage drive has simply been flagged as usable again. With a basic recovery program, such “hidden” deleted files can be found and restored by giving them a valid name again. The recovery software will give a user this option when the file is found and recovered. Renamed, the file can again be used in its original format as long as data wasn’t saved over the same space on the drive.
Stage #3 repair: Forensic rebuild
The third level of damage is an actual modification, loss of integrity or damage to the file itself. This is a much harder level from which to recover. Most standard private user tools are unable to recover a truly damaged file. These instances take the skill of a computer expert to reconstruct the file and recover the partial data available. In many cases, the file can only be recovered as text or in a partially usable state. That may still be beneficial as the majority of data files are either word processing or spreadsheet documents.
The recovery process of a truly damaged file typical involves isolating the file on the drive and reconstructing it far enough it can be again seen in its native software program. This can take extensive work and an expert’s understanding of the inherent file coding. In many cases, the process can be expensive and prohibitive for most former file owners. However, industries like law enforcement commonly pursue this path to obtain electronic evidence in a case assumed by a suspect as lost.
The above said, in the large majority of instances seriously damaged files tend to be impossible to recover in any functional state. Some text version may be the only result at best. This is usually the case where the storage drive itself has been badly damaged via a malfunction or externally caused destruction.
The best way to avoid having to deal with any of the above options for file recovery is to always use a backup procedure on data files. Even when files are deleted by mistake or accident, the backup version allows fairly close file recovery at minimal cost if files are backed up regularly.
