Why Today’s Data Recovery Tools
are Better than Undelete.exe
Data recovery software has come a long way since the “unerase” tool was introduced in Norton Utilities 1.0 in 1982. A few years later, Microsoft added “undelete.exe” was added to MS DOS 5. Both tools relied on the properties of the file system (FAT16 at the time) to retain information about deleted files in its directory structures.
Years passed, but the way these early data recovery tools worked remained the same. These tools attempted to locate directory entries that belonged to deleted files, reversing the “delete” operation by simply changing a flag in the file system. This approach often resulted in unusable files and corrupted file systems. Needless to say it was less than perfect. Years after, drives grew from 360 KB diskettes to hard drives as large as 2 TB.
Today, no respectable vendor of data recovery tools will use this approach. The file system still gets scanned, but even the least sophisticated the tools will not directly write to the file system in an attempt to “reverse” the deletion. Instead, the tools will attempt to read sectors previously occupied by the deleted file, reconstructing the file and saving it elsewhere (preferably onto another disk or USB flash drive).
This approach still relies on information kept in the file system after the file is deleted. But what if the file was deleted a long time ago, and its record is no longer available in the file system? Or what if the file system itself is no longer available after disk format or repartition operations? Finally, what if the partition itself is unreadable, corrupted or inaccessible?
Some of the better tools such as Hetman Uneraser went even further, offering additional means to locate deleted files besides reading the file system. A new range of algorithms was designed to analyze the entire content of the hard drive, looking for files still sitting on the disk. Available under a range of proprietary trade names, these methods are commonly referred to as “signature search” algorithms because they’re using characteristic signatures of known file formats to locate the beginning and calculate the length of each file.
Finally, the most advanced tools (Hetman Uneraser included) can combine both approaches, using information from the file system as well as data collected from the disk surface in order to see the full picture. By combining information from both the file system and the actual disk, these tools can handle pretty much any problem – from deleted files to formatted, corrupted and inaccessible disks.