Comment on How is it possible for the IT experts to recover data that was erased from a hard drive when the storage of said hard drive appears empty?

zeppo@lemmy.world ⁨3⁩ ⁨months⁩ ago

Because of how filesystems work. There’s basically an index that tells the OS what files are stored where on the disk. The quickest way of deletion simply removes the entry in that table. The data is still there, though. So a data recovery program would read the entire disk and try to rebuild the file allocation table or whatever by detecting the beginning and ends of files. This worked better on mechanical drives than SSDs.

source
Sort:hotnewtop