Why It Is Impossible To Recover Data From An Overwritten Hard Drive [Technology Explained]

OverwrittenData05   Why It Is Impossible To Recover Data From An Overwritten Hard Drive [Technology Explained]Recovering deleted data from a hard drive is generally possible because typically the actual data is not deleted. Instead, information about where the data is stored is removed. In this article I will explain how data is stored on a hard drive, what happens when files are deleted, what formatting a hard drive does, and why it is impossible to recover files after they were overwritten.

The article outlines how data is stored on the physical level, which is essential to understanding why it can not be restored after being overwritten. If you are interested in the organizational structure of a hard drive, i.e. how the storage of files is managed, please read the article What A File System Is & How You Can Find Out What Runs On Your Drives. For more information on how to recover deleted files, see the resources at the bottom of this article.

How Is Information Stored Digitally?

Digital information is stored in bytes. Each byte contains 8 bits. Each bit has a value, which is either 0 or 1. This way of storing data is called the binary numeral system as it uses two symbols, i.e. 0 and 1. Subsequently, any data stored on a computer is written in the binary code, which is a string of 0s and 1s.

OverwrittenData02   Why It Is Impossible To Recover Data From An Overwritten Hard Drive [Technology Explained]

How Do Hard Drives Store Information?

Information on hard disk drives (HDDs) is stored magnetically and non-volatile, meaning no power is required to maintain the stored information. Every magnet has a plus (+) and a minus (-) pole, which equals two values and thus allows it to represent the binary code. The HDD storage unit or platter contains a ferromagnetic surface, which is subdivided into small magnetic regions, called magnetic domains. HDDs store data by directional magnetization of magnetic domains. Each magnetic domain can be magnetized in one of two possible directions and subsequently represents one of two values: 0 or 1.

OverwrittenData06   Why It Is Impossible To Recover Data From An Overwritten Hard Drive [Technology Explained]

There are two different technologies for recording data on a HDD. Prior to 2005, the recording layer was oriented parallel to the disk surface (horizontally), meaning the binary code was represented by directional left vs. right magnetization (longitudinal recording). At around 2005 a new technology was introduced and data was written by magnetizing segments vertically, i.e. up vs. down (perpendicular recording). This allowed closer magnetic domain spacing and also enabled larger storage capacities.

OverwrittenData01   Why It Is Impossible To Recover Data From An Overwritten Hard Drive [Technology Explained]

How Is Data Stored In Random Access Memory (RAM)?

Essentially, data is stored the same way as on a hard drive, i.e. in binary code. The major difference is that this type of storage is volatile, meaning any stored information is lost as soon as power is removed. A RAM is made up of integrated circuits, which in turn contain capacitors and transistors. Each capacitor stores one bit of data. The state of the capacitor can either be charged or discharged, i.e. 1 or 0, representing the binary code.

OverwrittenData04   Why It Is Impossible To Recover Data From An Overwritten Hard Drive [Technology Explained]

What Happens When Data Is Deleted?

In a RAM module, the organizational structure is very flat. When data is removed from memory, the actual information vanishes instantly. Also, when power is lost, the capacitors quickly discharge and hence all information is lost.

The situation on a HDD is completely different as information is stored in two ways. First, data is stored physically on the magnetic hard drive. Secondly, all stored data is managed by a file system, which creates an information table revealing the exact location of data, i.e. where on the hard drive a certain file is stored. This is necessary because one file can be stored in different locations across the hard drive. The operating system then uses this table to locate files and put together the pieces of large files.

OverwrittenData07   Why It Is Impossible To Recover Data From An Overwritten Hard Drive [Technology Explained]

When a file is deleted, typically only the information stored in the file system’s table is removed. Since it would take too long to delete the actual file, the physical location of the data remains untouched. When the operating system wants to store new files, however, it consults the table for available space. Since the location of the deleted files was marked as vacant, the operating system may then write new data over the old data, which terminally deletes that information.

For details on how the file system works and how it organizes and manages hard drives, see my article What A File System Is & How You Can Find Out What Runs On Your Drives.

What Happens When A HDD Is Formatted?

The type of formatting that most users are familiar with is called high-level formatting and it is the process of setting up an empty file system. Since it does not require scanning the hard drive for defects, it is also called quick formatting.

Typically, data stored on the hard drive is not physically deleted during formatting. What does happen is that the file system is set up from scratch, meaning the hard drive is re-organized and the table with information where files are stored is reset. As long as the file system and its settings remain the same, none of the actual data previously stored on the hard drive is deleted or overwritten and can subsequently be recovered.

What Happens When Data Is Overwritten?

When data is overwritten, the magnetic domains on the HDD are re-magnetized. This is an irreversible process that physically removes information previously stored in this location. While some residual physical traces of the changes (or none changes) in magnetization potentially remain, which may theoretically allow a partial restore, this would require the use of a magnetic force microscope or similar technologies, none of which have been shown to recover data successfully so far [although you never know what's going on in secret government intelligence labs]. So in essence, there is no software or other technical way known to the public that can restore overwritten data.

OverwrittenData03   Why It Is Impossible To Recover Data From An Overwritten Hard Drive [Technology Explained]

Do you need to recover data that has not been overwritten, yet? Please check out these resources:

Many more great resources can be found in reply to these questions posted on MakeUseOf Answers:

What are your data storage and recovery nightmares? Did you ever lose files after accidentally deleting them?

Image credits: Sergej Khakimullin, Carlos Castilla, MilanB, TylzaeL & Luca Cassioli, Colour, Zketch, Anthonycz

The comments were closed because the article is more than 180 days old.

If you have any questions related to what's mentioned in the article or need help with any computer issue, ask it on MakeUseOf Answers—We and our community will be more than happy to help.

9 Comments -

0 votes

Mike

Great article, Tina. 

Most forensic experts report that a single wipe (random overwrite) with a proper tool is enough. Most data fragments that are recovered afterwards come from bad blocks (which are not accessible by the usual wipe tools). 
The last expert publicly saying different (2009, Alfred Demirjian) was presented with a $250.000 challenge to proof them wrong. 

As for MFM or STM microscope recovery: 
The problem is that they are too powerful and previously (over)written data will interfere with the process. Basically the microscope will read several “1″ and “0″ and the highest chance of choosing the right one is reported to be around 56%. 

If you want the whole story: 
http://www.vidarholen.net/~vidar/overwriting_hard_drive_data.pdf

0 votes

Tina

Thanks for the additional information, Mike! :)

0 votes

Bob Francis

Excellent article Tina :) Could you answer a question for me: Can a person overwrite empty space with zero information? From reading this article, I sense that a complete scan and format erases everything. Is that true?

This has always been a question in my mind since I found out that “deleted” data or “formatted” discs can usually be recovered. I thought then, as I still do, “How much information has been leaked into wrong hands?” It’s kind of scary.

I appreciate your time and I look forward to reading more articles. btw, I found the link to this page via facebook.

Thanks, Bob.

Mike’s post came out before I finished my question and then I need to change my question somewhat: Can emptied space be wiped clean without removing wanted files? thanks

0 votes

Tina

Bob,

let me rephrase your question: you want to overwrite (scramble) ‘empty’ hard drive space, i.e. space labelled empty in the file system table. At the same time data stored on the hard drive should be left alone.

This can indeed be done. The article explaining how to do this is scheduled to be published tomorrow. Great minds think alike, eh? :)

0 votes

CCM

I’ve used File Scavenger to recover lost or accidentally deleted data on a drive even after it had a Windows re-install done on it.

0 votes

Tina

As Nancy pointed out below, re-installing Windows does not mean the files were overwritten. Good to know that File Scavenger works for recovering data, though!

0 votes

Nancy

CCM  A Win-reinstall is NOT the same as over writing.  Right? There are lots of programs that can do what File Scavenger did for you.

0 votes

prett sons

Thanks Tina Sieber for making us aware about this topic- Why It Is Impossible to Recover Data From An Overwritten Hard Drive. When I did not read this article I always confused about why we cannot recover overwritten data but after reading this article all my doubts have clear. Thanks Tina Sieber for wring this article. I want to introduce software with you & all the users of makeuseof which recover deleted & formatted data without having backup named as Stellar Phoenix. It recovers almost all files types & mostly all OS like Windows, Mac, Unix, Linux. 

0 votes

Tina

How does Stellar Phoenix recover formatted data?