Data on a hard disk may be (a) deleted (b) overwritten or (c) lost. It is possible to recover data on a hard disk under many circumstances. Often recovery may only be partial.
Key Terms:
- Disk Forensics
- Data Recovery
- Disk Doctor
- Disk Sector Editor
- Low Level Undelete
- Disk Analysis
Deleted Files
Zero Byte Files
A data file might not necessarily be deleted, but might be empty suddenly due to a program crash. Programs may leave files in an open state, especially data files, and as the result of a crash the file might be emptied yet still exist. An undelete utility is of no use in this scenario.
A program called "Disk Investigator" can help you to recover lost data. Display the true drive contents by bypassing the operating system and directly reading the raw drive sectors. View and search raw directories, files, clusters, and system sectors. Verify the effectiveness of file and disk wiping programs. Undelete previously deleted files.
Over Written Data
Lost Files