A file mysteriously disappeared while I was working on a project. My first challenge was whether fighting to recover the lost information would help or hurt the situation. Taking a break from working on the computer, I learned about what goes into trying to recover lost files
What I did before trying to recover
The first smart thing I did was to stop using the drive that the file was on (the one it had been stored on). New downloads, web browsing and application updates could overwrite deleted files as much as the ordinary use of the computer’s operating system.
I would not want to install any recovery software onto the system drive that the file was lost on either, because the safest way to recover the file would involve me using another computer or booting from a flash drive. I could shut down the computer and recover the file while it was not in use, keeping the drive from being unnecessarily written to while recovery was attempted.
This was important because of how deletion usually works. Usually a file is not deleted from the physical medium it is stored on immediately upon being deleted. The operating system only updates its index of files and their locations, marking the space the file occupied as empty. This is why deleting large files does not take appreciably longer than deleting small files: there is no actual copying of data involved in deletion, beyond renaming and updating indexes.
Until fresh data is written into the empty space a deleted file occupied, its old data can still be recovered
That is why recovering deleted files is usually more about searching for recoverable data rather than undoing a deletion process. The software that recovers deleted files searches for recoverable data and attempts to rebuild it. If the file system’s indexes have not been overwritten with new information, the software can recover the file it was pointing to as well. The name and location of the file may be recoverable too depending on how much writing to the drive has happened since the file was deleted and where exactly on the drive the file was stored before being deleted.
Files that have been partially overwritten will have less predictable results. A file may be recovered in a usable form or may have corrupted data if the data storage blocks that had contained its information had been partially reused. It may be possible to recover a deleted file, but the file may not be completely recoverable if it has been partially overwritten.
Why the storage changed the outcome
The next thing I learned was how deletion worked on different kinds of storage media. Hard drives will usually keep the data on them until it is needed somewhere else. This also generally applies to memory cards and USB flash drives, which is why a user may be able to recover a photo that was deleted days ago from a digital camera.
Solid state drives are more likely to have their storage cells wiped as soon as a file is deleted. This is usually done by the operating system issuing a TRIM command to the SSD, which causes it to mark some storage cells as needing to be wiped when convenient, which generally happens when the storage cells have finished being written to. When this happens, recovery software has nothing to recover from a hard drive, and the file may be unrecoverable from a laptop SSD hours or days after being deleted.
I realized that file recovery is more of an emergency measure than a routine procedure. Making a regular automated backup of the folders where deleted files are found is preferable to trying to recover deleted files when they are lost. It is less time- and resource-consuming and it has more predictable results.
I would revise this conclusion if new information came out that showed that modern solid state drives’ files could be recovered with a greater degree of reliability after being deleted, or that the use of the drive after deletion has not reduced the chance of successful file recovery.