Deleted Data Recovery

It can be all too easy to delete your data. All it takes is one wrong click, a disgruntled employee, or a computer virus. You might not notice you’ve lost anything until days or weeks after the fact. If you don’t have a backup of your data, your missing files could be just out of your reach.

But all is not lost. If you’ve lost data due to an accidental or malicious deletion, our deleted data recovery experts here at Gillware can help.

Where Does Data Go When It Gets Deleted?

If you drag a file into your computer’s trash or recycle bin, you can still go right back in and drag it out. But what happens after you’ve emptied the bin? What if you delete something from your external hard drive? Is your data lost forever?

Different filesystems all handle deleted data a little differently. The most common filesystems we see at Gillware are Windows NTFS and Mac HFS+.

In the NTFS filesystem, the master file table identifies and points to the physical locations of every file on your data storage device. It’s constantly being updated and rewritten as files are created and deleted. The NTFS filesystem also has a feature called the bitmap. The bitmap keeps a little record of which spaces on the drive are being used and which are not.

When a file is deleted, the bitmap updates itself and says that the space occupied by that file is empty. The space isn’t empty, though. The filesystem hasn’t changed the sectors containing the deleted file. It has only flagged them as unused in the bitmap.

The same principle is at work in HFS+ filesystems, although the underlying mechanisms are a little different. Files are defined by the catalog and extents overflow files. The allocation table keeps a record of what parts of the hard drive are in use.

It’s important to avoid using your data storage device after file deletion has occurred. When you delete data, there’s suddenly a convenient new bit of “unused” space where your deleted file is. If you keep creating or modifying files after you’ve deleted something, you could end up writing data to that space. This can partially overwrite or even completely destroy your deleted file.

Think of your hard drive as a city and each file as a building. Deleting a file isn’t the same as knocking a building down. It’s more like putting a big “CONDEMNED” sign on the front door. No one is allowed in, but the building is still there. Eventually, the spot gets bulldozed and a new building gets put up in its place. But until then, your data is still safe.

Some Linux filesystems, such as Ext4, handle deleted files a little differently. When a file is deleted from an Ext4 partition, the extents pointing to the file’s location are erased. Sometimes this can be undone using the filesystem’s journaling capabilities. Deleted data recovery from Linux systems can be more difficult work than deleted data recovery from Mac or Windows systems.

How Does Gillware’s Deleted Data Recovery Process Work?

There are a lot of software data recovery programs out there that say they can help you if a critical file has been deleted. We don’t trust them. We use HOMBRE, our own in-house software, for deleted data recovery.

There’s a lot of danger involved in trying to recover deleted files on your own. If you install a data recovery program, you’re already risking the integrity of your lost data. Most software tools also lack the robust suite of analytical tools our own software has. HOMBRE has been developed by our data recovery engineers, exclusively for our data recovery engineers.

The process for deleted data recovery starts with a full write-blocked forensic image of your data storage device. Our engineers have to make an exact duplicate of your hard drive, all the way down to the binary level. Your filesystem isn’t going to freely tell us where all the data on the drive lives. This is mainly because it doesn’t actually know where the deleted data lives. It can’t find those files on its own anymore.

To recover deleted files, our technicians analyze the entire device. HOMBRE’s relational database helps them sort through all of the data on the device to turn up deleted files. Our engineers can restore these deleted files and assess them for file corruption.

If a data storage device has been in use since files were deleted from it, the likelihood of some of the deleted files becoming corrupted increases. Our engineers refer to this kind of corruption as hard corruption. The overwritten sectors can’t be rolled back to their previous states. There are many situations where our data recovery technicians can overcome hard corruption and repair damaged files.

If our technicians notice corruption in any critical deleted files, we make an effort to repair those files. Any irreparable corruption is noted on the list of recovery results. The last thing we want is for one of our clients to unwittingly receive nonfunctional data from us.

Why Should I Choose Gillware for My Deleted Data Recovery Needs?

At Gillware, we have taken steps to make the entire deleted data recovery process as financially risk-free as possible.

We start with a free evaluation of your deleted data recovery situation. We even offer free inbound shipping for any clients in the continental United States. Once our technicians have assessed the situation, we present you with a quote and probability of success. If you approve the quote, we don’t ask for payment yet. We go ahead and do the whole recovery process first.

Our deleted data recovery technicians recover as many deleted files as possible. We inspect the recovered data for corruption and repair any critical files as needed. We don’t show you a bill until we’ve successfully met your goals and recovered your critical data.

Our deleted data recovery technicians have logged thousands of hours of data recovery work over the years. They are incredibly well-acquainted with the ins and outs of data storage filesystems. Our financially risk-free service guarantee isn’t just because we hate when people give us money without getting anything in return. It’s also because we are confident in our data recovery engineers’ abilities to retrieve your deleted files.

Still not convinced? Check out some of these case studies for our deleted data recovery services...

Hard Disk Failure Recovery Case Study: Deleted and Dropped

The client in this data recovery case had a problem. And soon enough, that problem turned into two problems. Their first problem was that they’d accidentally deleted a bunch of their documents from their Samsung external hard drive. Their second problem was that, before they could unplug the drive from their computer, it slipped off […]


Deleted Photo Recovery Case Study: How We Recover Lost Files

The client in this data recovery case came to us after 34 gigabytes of photos had been deleted from their laptop. Once they had realized the amount of data they’d lost, they removed the solid state drive from the computer and sent it in to Gillware. This was a job for our deleted photo recovery […]


File Recovery Case Study: Recovering Deleted Files

The client in this file recovery case was having a day like any other. Their PC was running just fine. Nothing on their computer’s hard drive was out of place. When their antivirus software updated itself, they paid it no mind. There wasn’t anything unusual about that. But upon browsing their Documents folder, they noticed […]


SanDisk SD Card Recovery Case Study: Deleted Photos

The client in this data recovery case came to us for our SanDisk SD card recovery services. They had accidentally deleted the contents of their camera’s 8 GB microSD card. Unfortunately, accidentally deleting your data is all too easy in our digitally-dependent world. And unlike when you delete files off of your computer, when you […]


Deleted File Recovery Case Study: Western Digital RAID-1 Mirror

This client had two 500 gigabyte Western Digital WD5003ABYX-01WERA1 hard drives linked together in a RAID-1 array. Important database files had been erased from the array, and the client needed our deleted file recovery services. A RAID is a “redundant array of independent disks”. Hard drives are put into RAID arrays to provide greater capacity, more […]