Get a Pentest and security assessment of your IT network.

Cyber Security

Recovering Deleted Files from Full Drives

TL;DR

Yes, you can often recover deleted data even from a full SSD or HDD, but the chances of success decrease over time and with drive usage. Stop using the drive immediately to prevent overwriting. Use dedicated recovery software – free options exist for basic recovery, while paid tools offer more advanced features.

Understanding Data Deletion

When you delete a file, it’s not actually erased from the drive right away. The operating system simply marks the space occupied by that file as available for new data. The actual data remains until overwritten. This is why recovery is possible.

Why Full Drives Make Recovery Harder

A full drive means there’s less free space to store recovered files. Also, continuous writing of new data increases the likelihood that deleted file fragments have been overwritten. SSDs add another layer of complexity due to their wear-levelling algorithms (see section 6).

Step-by-Step Recovery Guide

  1. Stop Using the Drive: This is crucial! Any further use significantly reduces your chances of successful recovery. Don’t install software *onto* the drive you’re trying to recover from.
  2. Choose Recovery Software: Several options are available, both free and paid. Some popular choices include:
  3. Install and Run the Software: Install the chosen software on a *different* drive than the one you’re recovering from. Launch the application.
  4. Select the Drive to Scan: The software will present a list of available drives. Choose the full SSD or HDD you want to recover data from.
  5. Choose Scan Type: Most software offers different scan types:
    • Quick Scan: Faster, but less thorough. Good for recently deleted files.
    • Deep Scan: Slower, but more comprehensive. Recommended for full drives or older deletions.
  6. Start the Scan: Initiate the scan process. This may take a considerable amount of time, especially with a deep scan on a large drive.
  7. Preview and Recover Files: Once the scan is complete, the software will display a list of recoverable files. Preview the files to ensure they are what you’re looking for.
    • Select the files you want to recover.
    • Choose a *different* drive to save the recovered files to. Do not save them back onto the original drive!
    • Start the recovery process.

Important Considerations for SSDs

SSDs use wear-levelling, which means they distribute writes across different memory cells to prolong their lifespan. This makes traditional data recovery methods less reliable because file fragments may be scattered and moved around the drive. TRIM is another feature that can automatically erase deleted data blocks, making recovery impossible.

Command Line Recovery (Advanced)

For advanced users, tools like ddrescue (Linux) can create a disk image of the failing drive before attempting recovery. This minimizes further damage and allows for offline analysis.

sudo ddrescue /dev/sdX /path/to/imagefile /path/to/logfile

(Replace /dev/sdX with your drive identifier, and the paths to imagefile and logfile accordingly.)

When to Seek Professional Help

  • If the drive is physically damaged (clicking sounds, not recognized by the computer).
  • If you’ve already overwritten a significant amount of data.
  • If recovery software fails to find the files you need.
Related posts
Cyber Security

Zip Codes & PII: Are They Personal Data?

Cyber Security

Zero-Day Vulnerabilities: User Defence Guide

Cyber Security

Zero Knowledge Voting with Trusted Server

Cyber Security

ZeroNet: 51% Attack Risks & Mitigation