Why is it impossible to recover data from a rewritten disk?

When a disk is rewritten, the data on it is completely erased and replaced with new data. This means that the original data can no longer be accessed or recovered. The only way to recover data from a rewritten disk is to use specialized software that can scan the disk for remnants of the original data. However, this is not always successful, as the data may have been overwritten multiple times and thus rendered unrecoverable.

What is disk overwriting, and how does it work?

Disk overwriting is the process of completely erasing data from a computer's hard drive or other storage device. It works by writing over the existing data with a series of random characters or patterns, making it impossible to recover the original information. This process can be done manually or with specialized software. It is an important part of data security and is often used in combination with other security measures such as encryption and password protection.

Can overwritten data be recovered using any software or technique?

In some cases, it is possible to recover overwritten data using specialized software or techniques. However, the success of such attempts depends on the type of data that has been overwritten and the amount of time that has passed since the overwrite occurred. Additionally, there are some cases where data recovery is not possible.

What are the different methods of disk overwriting?

Single Overwrite: This method involves overwriting each sector of the disk with a single character or byte of data. Multi-Pass Overwrite: This method involves overwriting each sector of the disk multiple times with different patterns of data. Random Overwrite: This method involves overwriting each sector of the disk with random data. DoD 5220.22-M Method: This method is a standard developed by the US Department of Defense and involves overwriting each sector of the disk three times with specific patterns of data. Gutmann Method: This method is a more secure version of the DoD 5220.22-M method and involves overwriting each sector of the disk up to 35 times with specific patterns of data.

How many times should a disk be overwritten to make data recovery impossible?

At least three times is recommended, but seven times is considered the industry standard for secure data destruction.

Why Data Can’t Be Restored After Disk Overwriting: Explanation

Author: Vladimir Artiukh
Editor: Oleg Afonin
Updated: 3.05.2024 15:14

In this comprehensive article, we’ll delve into the technology behind data loss and explain why overwritten data becomes irrecoverable. From the principles of disk overwriting to the mechanisms that render data unrecoverable, we’ll cover it all. Whether you’re a tech enthusiast or just curious about data security, understanding this concept is crucial. Read now as we demystify data loss and provide clear explanations for this common phenomenon!

Why Data Can’t Be Restored After Disk Overwriting: Explanation

Contents

PC and user data

All data storage devices, both internal and external, can be affected by various factors: physical impact, electrostatic pickup, software error, virus attack and so on. Any of these may damage the hard disk and cause massive loss of user data. Also, users may delete important data accidentally.

In this case, there is a risk of losing business and personal data alike, as long as it has not been backed up elsewhere. Often, we don’t keep several copies of our personal files, such as photo or video archives, and that is why the question of how to recover them becomes very relevant. The easiest way out is to use data recovery software. Such programs are aplenty on the Internet.

Recovering deleted data from a hard disk is usually possible, because the data doesn’t actually get removed from the disk. Instead, the operating system removes information on where the data is stored. In today’s article we will tell you how data is stored in a hard disk, what happens when files are deleted, what process formats a hard disk, and why it is impossible to recover files after they have been overwritten. We will describe the physical mechanism behind data storage, and that is necessary for understanding of why files can’t be brought back after overwriting.

How digital data is stored

All digital information is stored in bytes. Every byte contains eight bits. Every bit has a digital value, either 0 or 1. This way of storing data is known as binary system because it uses two symbols, that is, 0 and 1. Any data stored on a computer is written in a binary code which looks like a line made of 0 and 1 symbols.

How data is stored on a hard disk

Hard disks (HDD) don’t need to be powered on all the time, as they are a type of non-volatile storage, based on magnetic recording and retaining stored data even when powered off. In a magnet, there are two magnetic polarities, each of which is used to represent either 0 or 1, that is, a binary code. The surface of an HDD is covered with a ferromagnetic material and is conceptually divided into many small sub-micrometer-sized magnetic regions, referred to as magnetic domains. An HDD stores data by magnetizing the domains in a certain direction. Every magnetic domain can be magnetized in one of the two possible directions, and so it takes one of the two possible values: 0 or 1.

There are two different technologies of writing data to a hard disk. Before 2005, the hard disk drive design had the write areas oriented horizontally and parallel to the disk surface, which means that the binary code was represented by magnetizing directed left and right (Longitudal recording). Beginning about 2005, the new technology changed the orientation to perpendicular (i.e. magnetizing was now directed up and down) (Perpendicular recording). It allowed for closer magnetic domain spacing and larger storage capacities.

How data is stored in the random-access memory (RAM)

In fact, the data is stored in the same way as on a hard disk. However, any information in the random-access memory is stored and available only as long as the memory modules receive corresponding voltage. The moment your RAM loses its power supply (even for a second), all information will be lost. RAM is made up of integrated circuits which are, in their turn, built with capacitors and transistors. Every capacitor stored one bit of data. The capacitor may be charged or discharged, that is, it may have a value, either 1 or 0, and it represents the use of a binary code.

What happens when data is deleted

The organizational structure of random-access memory (RAM) is very simple. When data is removed from the memory, the actual information disappears immediately. What is more, when there is no power supply, the device capacitors discharge quickly and all the information is destroyed.

Things are completely different with hard disks, because there are two mechanisms in charge of storing data. First of all, data is stored physically on a hard disk. Secondly, all saved data is managed by the file system which creates an information table specifying the exact location of all data. In other words, the operating system marks the exact location where a certain file is stored on a hard disk. This condition is necessary as a file may include several fragments which are stored in different areas of the hard disk. Then the operating system uses this table to search for files and combine fragments into large files.

When a file is deleted, it is usually the information stored in the file system table that is removed. The physical location of data on the disk remains unchanged as it takes too much time to actually remove the file. However, when the operating system wants to store new files, it checks the master file table for where there is free disk space. Since location of the removed files was marked as free, the operating system may write new data over the old data, which will destroy this information for good.

What happens when a hard disk is formatted

The kind of formatting most users know about is the high-level format. This process initializes portions of the hard drive and creates important file system areas on the disk, while the file system is actually still empty. There are two main types of high-level format. In the first case, the hard disk is not scanned for issues and damaged sectors; the format operation just overwrites the existing file system with a simple and empty file system. This one is known as quick format. In this scenario, data on the hard disk is not removed physically while the disk is formatted. Therefore, as long as the file system and its settings are unchanged, any actual data previously saved to this disk is neither deleted nor overwritten and can be recovered later.

In the second case, the format operation resets the master file table and cleans the hard disk completely. It means that the file system is created anew, the hard disk is rearranged, and the table containing data on where files are stored is now cleaned. This one is known as regular, or full format.

What happens when data gets overwritten

When data is overwritten, magnetic domains of a hard disk are magnetized again. This is an irreversible process that physically removes any information previously stored on a disk. Still, some physical traces of changes (or evidence to confirm absence of changes) can be left behind, and it may allow for partial recovery – at least, in theory. It may involve using a magnetic force microscope or similar technologies. However, the effectiveness of data recovery with the methods we have just described still has to be proven. Therefore, there is actually no software tool or another method which can recover overwritten data – in full and with a guarantee.

What devices do you use to store data, and what methods do you prefer to recover it? Have you ever lost your files after deleting them accidentally? Feel free to share your experience in comments below this article.