We are committed to providing fast, efficient, and affordable software solutions that set new standards in the software development industry.
  • Recovery of Overwritten Data

Quite often our customers ask us if it's possible to recover overwritten data and if so, then how would one go about performing such a task.

First let's take a look at how data is stored on a data storage device. There are currently two main types of storage devices: conventional hard disk drives (HDD) and the newer solid-state drives (SSD).

Hard Disk Drives:
HDDs use magnetic storage to store and retrieve data. Their heads magnetize a thin magnetic film on rotating platters. Changes in the direction of magnetization represent 0's and 1's in stored data. When a new data is written over the old one, the direction of magnetization is changed according to the new data, and there's no way to retrieve the previous data, at least without completely disassembling the disk and analyzing the magnetic field on its platters scrupulously. All of this is beyond the skill of even a very advanced computer user.

Solid State Drives:
SSDs use another physical principle for data storage: they store electrical charges within their internal cells. Before new data can be written to a cell, it has to be discharged which means that the previous data is lost. To make the situation even more complicated, SSDs utilize a complex method for deleting and writing. You may read more about file recovery from SSD devices in our article: File Recovery Specifics for SSD devices

Although these two storage devices are different in their operating principles, they have one thing in common: once data is overwritten, it's gone. Forever.

Now let's look at how all this affects file recovery.

An overwritten file
All modern file systems store the information about the file, such as its name, timestamps, and other service info separately from its content. There are several reasons for doing it this way, flexible free space management being the main. In addition, a file may be stored in fragments for better free space utilization. Fig.1 shows a typical file storage layout on a disk:
file storage layout
Figure 1: File storage layout
Click image to enlarge

When a contemporary operating system deletes a file, it partially or completely deletes the info about the file, but the content of the file remains intact. The file can therefore be recovered even when its info is completely deleted, provided that the file is not fragmented.

If the file is overwritten, the new data overwrites the old one, such a file cannot be recovered. The new file may have the same name and size, but the content will be new. This is how file wiping programs (such as our R-Wipe & Clean and Shredder in R-Undelete) completely destroys files beyond any recovery.

An overwritten partition
An important note: Do not confuse this case with reformatted partitions, where only the info regarding files and folders is lost, whereas the content of the files remains untouched and can be recovered to some degree.

When an entire partition gets overwritten, for example, when a new operating system is installed on the wrong partition, or an image is wrongly restored, the data of the new partition overwrites the data of the previous one. Fig. 2 shows such a case.
Overwritten partition layout
Figure 2: Overwritten partition layout
Click image to enlarge

Almost always such process completely overwrites file info but may keep some data from the previous partition untouched. Some files may be recovered from the untouched area using search for known files (raw file recovery). Our article File Recovery after Re-installing Windows (Case 1. New Windows has been installed on the same and one partition on the disk) presents an example of such a recovery. (You don't have to use always R-Studio Emergency for such recovery, if you're going to recover files from an external disk, R-Studio for Windows/Mac/Linux will do the same job more conveniently)

Data Recovery Feedback
362 feedbacks
Rating: 4.8 / 5
Hi!

I used some software for data recovery on MAC, but THIS IS only one, that help me!!!

THX :)

bye
Tom from Hungary
I want to upgrade it to the technician tool.
This tool is amazing. I was able to recover 5 years` worth of lost photos by imaging 4 disks from a corrupted RAID 10 array.

It did a byte copy of the disks and then replicated the array layout and I could see the files instantly. I`d recommend it to anyone, especially at these license fees. You`ll struggle to get better for the price.
After several attempts, using various softwaretools, I wasn`t able to recover any files from my encrypted drive.
I almost had to come to terms with the darkest of dark scenarios, losing it all to oblivion and no one to blame but myself.
Then I came across the demo version of R-studio and decided to giving it a final try.
YES-yes-yes... Utterly wonderfully fabulously FANTASTIC R-Studio!
The most important files were in good condition so (the paid version of) R-Studio could recover these right away.
Unfortunately ...
I accidentally deleted several gigs worth of data from an external drive - no restore point. I tried other recovery software, but what was `recovered` was mostly junk files in randomized order. Considering the cost of professional data recovery, and given the online reviews, I decided to purchase R-Studio.

Wow. Everything - like, EVERYTHING I had ever moved to the Trash from that drive - was recovered, folder and subfolder structure intact.

I am grateful and beyond impressed at this program`s price point ...