Why It Is Impossible To Recover Data From An Overwritten Hard Drive [Technology Explained]

Ads by Google

recover data from overwritten hard driveRecovering deleted data from a hard drive is generally possible because typically the actual data is not deleted. Instead, information about where the data is stored is removed. In this article I will explain how data is stored on a hard drive, what happens when files are deleted, what formatting a hard drive does, and why it is impossible to recover files after they were overwritten.

The article outlines how data is stored on the physical level, which is essential to understanding why it can not be restored after being overwritten. If you are interested in the organizational structure of a hard drive, i.e. how the storage of files is managed, please read the article What A File System Is & How You Can Find Out What Runs On Your Drives. For more information on how to recover deleted files, see the resources at the bottom of this article.

How Is Information Stored Digitally?

Digital information is stored in bytes. Each byte contains 8 bits. Each bit has a value, which is either 0 or 1. This way of storing data is called the binary numeral system as it uses two symbols, i.e. 0 and 1. Subsequently, any data stored on a computer is written in the binary code, which is a string of 0s and 1s.

recover data from overwritten hard drive

How Do Hard Drives Store Information?

Information on hard disk drives (HDDs) is stored magnetically and non-volatile, meaning no power is required to maintain the stored information. Every magnet has a plus (+) and a minus (-) pole, which equals two values and thus allows it to represent the binary code. The HDD storage unit or platter contains a ferromagnetic surface, which is subdivided into small magnetic regions, called magnetic domains. HDDs store data by directional magnetization of magnetic domains. Each magnetic domain can be magnetized in one of two possible directions and subsequently represents one of two values: 0 or 1.

recover deleted files

Ads by Google

There are two different technologies for recording data on a HDD. Prior to 2005, the recording layer was oriented parallel to the disk surface (horizontally), meaning the binary code was represented by directional left vs. right magnetization (longitudinal recording). At around 2005 a new technology was introduced and data was written by magnetizing segments vertically, i.e. up vs. down (perpendicular recording). This allowed closer magnetic domain spacing and also enabled larger storage capacities.

recover deleted files

How Is Data Stored In Random Access Memory (RAM)?

Essentially, data is stored the same way as on a hard drive, i.e. in binary code. The major difference is that this type of storage is volatile, meaning any stored information is lost as soon as power is removed. A RAM is made up of integrated circuits, which in turn contain capacitors and transistors. Each capacitor stores one bit of data. The state of the capacitor can either be charged or discharged, i.e. 1 or 0, representing the binary code.

recover deleted files

What Happens When Data Is Deleted?

In a RAM module, the organizational structure is very flat. When data is removed from memory, the actual information vanishes instantly. Also, when power is lost, the capacitors quickly discharge and hence all information is lost.

The situation on a HDD is completely different as information is stored in two ways. First, data is stored physically on the magnetic hard drive. Secondly, all stored data is managed by a file system, which creates an information table revealing the exact location of data, i.e. where on the hard drive a certain file is stored. This is necessary because one file can be stored in different locations across the hard drive. The operating system then uses this table to locate files and put together the pieces of large files.

computer file system

When a file is deleted, typically only the information stored in the file system’s table is removed. Since it would take too long to delete the actual file, the physical location of the data remains untouched. When the operating system wants to store new files, however, it consults the table for available space. Since the location of the deleted files was marked as vacant, the operating system may then write new data over the old data, which terminally deletes that information.

For details on how the file system works and how it organizes and manages hard drives, see my article What A File System Is & How You Can Find Out What Runs On Your Drives.

What Happens When A HDD Is Formatted?

The type of formatting that most users are familiar with is called high-level formatting and it is the process of setting up an empty file system. Since it does not require scanning the hard drive for defects, it is also called quick formatting.

Typically, data stored on the hard drive is not physically deleted during formatting. What does happen is that the file system is set up from scratch, meaning the hard drive is re-organized and the table with information where files are stored is reset. As long as the file system and its settings remain the same, none of the actual data previously stored on the hard drive is deleted or overwritten and can subsequently be recovered.

What Happens When Data Is Overwritten?

When data is overwritten, the magnetic domains on the HDD are re-magnetized. This is an irreversible process that physically removes information previously stored in this location. While some residual physical traces of the changes (or none changes) in magnetization potentially remain, which may theoretically allow a partial restore, this would require the use of a magnetic force microscope or similar technologies, none of which have been shown to recover data successfully so far [although you never know what’s going on in secret government intelligence labs]. So in essence, there is no software or other technical way known to the public that can restore overwritten data.

recover data from overwritten hard drive

Do you need to recover data that has not been overwritten, yet? Please check out these resources:

Many more great resources can be found in reply to these questions posted on MakeUseOf Answers:

What are your data storage and recovery nightmares? Did you ever lose files after accidentally deleting them?

Image credits: Sergej Khakimullin, Carlos Castilla, MilanB, TylzaeL & Luca Cassioli, Colour, Zketch, Anthonycz

Join live MakeUseOf Groups on Grouvi App Join live Groups on Grouvi
Windows Troubleshooting
Windows Troubleshooting
160 Members
Technology Explained
Technology Explained
155 Members
Comments (9)
  • prett sons

    Thanks Tina Sieber for making us aware about this topic- Why It Is Impossible to Recover Data From An Overwritten Hard Drive. When I did not read this article I always confused about why we cannot recover overwritten data but after reading this article all my doubts have clear. Thanks Tina Sieber for wring this article. I want to introduce software with you & all the users of makeuseof which recover deleted & formatted data without having backup named as Stellar Phoenix. It recovers almost all files types & mostly all OS like Windows, Mac, Unix, Linux. 

  • Nancy

    CCM  A Win-reinstall is NOT the same as over writing.  Right? There are lots of programs that can do what File Scavenger did for you.

  • CCM

    I’ve used File Scavenger to recover lost or accidentally deleted data on a drive even after it had a Windows re-install done on it.

    • Tina

      As Nancy pointed out below, re-installing Windows does not mean the files were overwritten. Good to know that File Scavenger works for recovering data, though!

  • Bob Francis

    Excellent article Tina :) Could you answer a question for me: Can a person overwrite empty space with zero information? From reading this article, I sense that a complete scan and format erases everything. Is that true?

    This has always been a question in my mind since I found out that “deleted” data or “formatted” discs can usually be recovered. I thought then, as I still do, “How much information has been leaked into wrong hands?” It’s kind of scary.

    I appreciate your time and I look forward to reading more articles. btw, I found the link to this page via facebook.

    Thanks, Bob.

    Mike’s post came out before I finished my question and then I need to change my question somewhat: Can emptied space be wiped clean without removing wanted files? thanks

    • Tina


      let me rephrase your question: you want to overwrite (scramble) ‘empty’ hard drive space, i.e. space labelled empty in the file system table. At the same time data stored on the hard drive should be left alone.

      This can indeed be done. The article explaining how to do this is scheduled to be published tomorrow. Great minds think alike, eh? :)

  • Mike

    Great article, Tina. 

    Most forensic experts report that a single wipe (random overwrite) with a proper tool is enough. Most data fragments that are recovered afterwards come from bad blocks (which are not accessible by the usual wipe tools). 
    The last expert publicly saying different (2009, Alfred Demirjian) was presented with a $250.000 challenge to proof them wrong. 

    As for MFM or STM microscope recovery: 
    The problem is that they are too powerful and previously (over)written data will interfere with the process. Basically the microscope will read several “1” and “0” and the highest chance of choosing the right one is reported to be around 56%. 

    If you want the whole story: 

Affiliate Disclamer

This review may contain affiliate links, which pays us a small compensation if you do decide to make a purchase based on our recommendation. Our judgement is in no way biased, and our recommendations are always based on the merits of the items.

For more details, please read our disclosure.
Affiliate Disclamer

This review may contain affiliate links, which pays us a small compensation if you do decide to make a purchase based on our recommendation. Our judgement is in no way biased, and our recommendations are always based on the merits of the items.

For more details, please read our disclosure.
New comment

Please login to avoid entering captcha

Log In