A large count of data recovery tools are available on the market. Do all of them work the same way? Are they just a good old undelete.exe with flashy user interface instead of the command line? Read along to find out!
Undelete.exe
“Undelete” was the name or the file recovery tool included by Microsoft with MS-DOS 5.0 to 6.22. The command worked by simply ‘reversing’ the delete operation, marking a record in the file system belonging to a deleted file as existing or, well, undeleted. This approach was nothing more than a dirty trick that uses to work (sort of) at the time of small files, small disks and slow PCs.
With today’s multitasking operating systems reading and writing many files at the same time, this approach, if implemented, would quickly ruin the file system, rendering the disk unusable. Modern data recovery tools are based on a different approach.
The Modern Way to Recover Deleted Files
Today’s data recovery tools no longer modify the file system in order to get your files back. In fact, they try not to write anything onto disks containing the files being recovered. Simpler data recovery tools will still analyze the file system, and the file system alone, to discover records that belong to deleted files. They will then analyze those records in an attempt to figure out which sectors on the disk belong to that particular files. Then they’ll read those sectors, saving a new file somewhere else.
Tools that are just a bit more sophisticated will make an extra effort to check the entire file system, looking for records that point to those sectors on the disk. If some sectors that belong to a deleted file are used up by other files, chances to successful recovery are getting lower.
Signature Search
Finally, some of the better data recovery tools (e.g. RS Partition Recovery) will use smart algorithms that can locate deleted file even if they no longer appear in the file system. This works by performing a comprehensive scan of the disk surface in low-level mode and comparing the results with a database of supported file formats. If a signature of a known file type is detected (e.g. the “JFIF” signature for JPEG files, “%PDF%” for Adobe PDF and so on), the tool will then analyze the file header in order to calculate the file’s length. Finally, knowing the exact beginning and length of a file, the tool can determine exactly what sectors belong to a file. Of course, information from the file system will also be used in order to make a more precise decision.
Conclusion
Today’s data recovery tools went miles ahead compared to ancient “undelete.exe”. They no longer corrupt the file system, and they use sophisticated algorithms helping them locate and recover files even if they no longer appear in the file system. As a result, your chances of successful recovery are much higher today than they would have been just a decade ago.