Desktop
I am an A+ Instructor and often at a loss of words for when students ask "How is data recovered from a hard drive when someone deletes, formats or empties their recyle bin?"
I would like to know what are the techniques for this process and how isit possible to recover data even if it has been deleted or formated from the drive.
by stngfan1
Look at how dos deletes a file, or look for info on how Norton un-erase works at their website. If you would like an answer assign more points to this question.
TM
Data is stored as a one or a zero on the harddrive. The file allocation table keeps track of where on the drive the data is stored. When you erase a file, you do not over-write the files data. All that you do is change the entry in the file allocation table. So the data is really still on the drive until you need that drive space and overwrite the erased area on the drive.
Programs like Norton Unerase, look for entries in the FAT that have a tilde(~) for the first letter (erased files). You can supply the first letter of the filename and get the entry back into the FAT. You do not need to supply the correct first letter, any will do. Simplifed explaination, but should do for your students.
Don
by rmstoller
Don Christner's answer is absolutely great!
However, if you really really want a nerd
answer: Norton Diskedit or similar program,
maintenance mode, literally searches by hard sector, cluster or directory - hex or deci
or english reads. If sector hasn't been govt
-formatted or zero-written -- information can be recovered sector by sector.
This discussion is closed to new replies.
Sort by Trending