]> TestDisk 🌐:aligrant.com

TestDisk

Alastair Grant | Sun 20 Nov 2011

Being able to undelete files has always been one of those top tasks for computer geeks when assisting friends and family recover deleted files.

When you delete a file the index for it is removed, but the content isn't. The content remains until new data is written over the top. So in order to recover the file, you just need a program that will scan the hard disk, instead of the usual file index to find files that don't have an associated index.

With flash storage things get more complicated, and I have to say I've never looked into how it works really. Data bits in flash storage can only take a limited number of writes, so in order to preserve the life of the card, modern systems will distribute the write all over the card. This gives more chance for the data to exist after deleting as writes are not sequentially put back.

Now, how one over-rides this behaviour and reads the bits off a card directly is beyond me, but I recent had to do just this.

I used TestDisk to do this. Popped the card into my laptop and let it scan through. I was astonished at how much - and how old some of the deleted data was. As with everything, some of the content was unrecoverable because it had been written over, but a lot was.

It's free to use being covered under the GPL.

Breaking from the voyeuristic norms of the Internet, any comments can be made in private by contacting me.

Related