The concept of Data Recovery

 What's the difference between delete and overwrite? To understand this better, we need to know how our data is getting stored. Digital information is stored in the form of bytes. Each byte contains 8 bits, and each of these bits have 1 or 0 value.  This way of storing is called binary numeral system. Any data stored on the computer is in the form of such a system.

Each magnet has a positive (+) or a negative (-) sign., which equals two values. HDD disks contains ferromagnetic surfaces, which are subdivided into small magnetic domains. HDD stores data by directional magnetization of these domains. 

When a file is deleted, the information is not immediately removed from the disk. Instead, the file system simply updates the database and tracks the files on the disk to confirm that the file is no longer needed, then hides the files from being visible. 

The information will only be removed if the operating system decides to use this space to store another file. This may be in a few minutes, or weeks, depending on how the computer is used. Until then, data can still be restored by using a data recovery program. 

How to overwrite Data: 

In computer, there are two ways to overwrite data.

1) Overwrite Texts: The default behavior of most Word processors is to insert the character where the cursor is, and you can change the standard behavior from insert to overwrite by selecting the original words and then typing.

In insert mode, when you enter the new text, the text just displays there. While in overwrite mode, the text you enter will replace the information you selected.

2) Overwrite files: we can also replace data by replacing old files with new ones. If saving a document with the same file name as an already existing, then the old file gets overwritten by the new one.

What is FAT32?

FAT32 stands for File Allocation Table. FAT32 is an extension of previous file systems in which data is stored in chunks of 32 bits. FAT32 is an upgraded version of FAT16 designed to overcome the limitations of FAT16 and support larger media. 

Advantages: efficiently works under partitions of 200Mb, provides compatibility with different operating systems, frequently used as a partition on multiboot systems.

However, any partition under 200mb can degrade the performance.

What is NTFS?

NTFS stands for New Technology File System. First introduced in 1993 , it is used in newer versions of operating systems such as Windows NT 2000 and other NT versions. NTFS is a more robust, high-performance logging file system with multiple user access controls. It includes characteristics such as data recovery, multi-streaming, fault tolerance, UNICODE names. NTFS, however, is not feasible due to its data structure overhead, but a greater file size limit than the standard FAT32 system is needed. 

Advantages: highly secure as it prevents unwanted access, performs well with partitions of size more than 400 mb, less susceptible to fragmentation.

Characteristics	FAT32	NTFS
Structure	Simple	Complex
Maximum number of characters supported in a file name	83	255
Maximum file size	4GB	16TB
Encryption	Not encrypted	Encrypted with Encrypting File System (EFS)
Security	Network Type Only	Both local and network type
Fault tolerance	No provision for Fault Tolerance	Automatic troubleshoot is present
Compatibility with Operating Systems	Windows 95/98/2000/2003/XP	Windows NT/2K/XP/Vista/7/8/10, macOS X, Linux
Compression	Compression is not allowed	Supports file compression
Accessing speed	Low	Relatively higher than other File Systems
User-level disk space	Not present	Present
Conversion	Allowed	Not allowed

 

Hard drive recovery is generally performed through hard drive recovery software. Logical errors such as accidental deletion and data corruption can be fixed by using hard drive recovery software that can extract all data, except where it has been overwritten in the disk sector.
Hard drive recovery can also be performed manually by connecting the hard drive to another computer using a SATA, ATA or USB interface. Moreover, hard drive recovery also involves recovering and copying data from dead drives and repairing physical damage to a hard drive.
Hard drive recovery for physically damaged drives requires repairing and replacing faulty component(s)/part(s). In this scenario, the data is not deleted or corrupted but requires the hard disk to be in physically operational form before data can be accessed from it.