Deleted Data Recovery

It can be all too easy to delete your data. All it takes is one wrong click, a disgruntled employee, or a computer virus. You might not notice you’ve lost anything until days or weeks after the fact. If you don’t have a backup of your data, your missing files could be just out of your reach.

But all is not lost. If you’ve lost data due to an accidental or malicious deletion, our deleted data recovery experts here at Gillware can help.

Read on to find out more about what happens to your data when you delete a file, and what our engineers must do to get your data back:

Where Does Data Go When It Gets Deleted?

If you drag a file into your computer’s trash or recycle bin, you can still go right back in and drag it out. But what happens after you’ve emptied the bin? What if you delete something from your external hard drive? Is your data lost forever?

If somebody clicks "Yes" and you lose your company's Quickbooks file, Gillware's deleted data recovery technicians can get it back.
If somebody clicks “Yes” and you lose your company’s Quickbooks file, Gillware’s deleted data recovery technicians can get it back.

Different filesystems all handle deleted data a little differently. The most common filesystems we see at Gillware are Windows NTFS and Mac HFS+.

In the NTFS filesystem, the master file table identifies and points to the physical locations of every file on your data storage device. It’s constantly being updated and rewritten as files are created and deleted. The NTFS filesystem also has a feature called the bitmap. The bitmap keeps a little record of which spaces on the drive are being used and which are not.

When a file is deleted, the bitmap updates itself and says that the space occupied by that file is empty. The space isn’t empty, though. The filesystem hasn’t changed the sectors containing the deleted file. It has only flagged them as unused in the bitmap.

The same principle is at work in HFS+ filesystems, although the underlying mechanisms are a little different. Files are defined by the catalog and extents overflow files. The allocation table keeps a record of what parts of the hard drive are in use.

It’s important to avoid using your data storage device after file deletion has occurred. When you delete data, there’s suddenly a convenient new bit of “unused” space where your deleted file is. If you keep creating or modifying files after you’ve deleted something, you could end up writing data to that  space. This can partially overwrite or even completely destroy your deleted file.

Think of your hard drive as a city and each file as a building. Deleting a file isn’t the same as knocking a building down. It’s more like putting a big “CONDEMNED” sign on the front door. No one is allowed in, but the building is still there. Eventually, the spot gets bulldozed and a new building gets put up in its place. But until then, your data is still safe.

Some Linux filesystems, such as Ext4, handle deleted files a little differently. When a file is deleted from an Ext4 partition, the extents pointing to the file’s location are erased. Sometimes this can be undone using the filesystem’s journaling capabilities. Deleted data recovery from Linux systems can be more difficult work than deleted data recovery from Mac or Windows systems.

How Does Gillware’s Deleted Data Recovery Process Work?

There are a lot of software data recovery programs out there that say they can help you if a critical file has been deleted. We don’t trust them. We use HOMBRE, our own in-house software, for deleted data recovery.

There’s a lot of danger involved in trying to recover deleted files on your own. If you install a data recovery program, you’re already risking the integrity of your lost data. Most software tools also lack the robust suite of analytical tools our own software has. HOMBRE has been developed by our data recovery engineers, exclusively for our data recovery engineers.

The process for deleted data recovery starts with a full write-blocked forensic image of your data storage device. Our engineers have to make an exact duplicate of your hard drive, all the way down to the binary level. Your filesystem isn’t going to freely tell us where all the data on the drive lives. This is mainly because it doesn’t actually know where the deleted data lives. It can’t find those files on its own anymore.

To recover deleted files, our technicians analyze the entire device. HOMBRE’s relational database helps them sort through all of the data on the device to turn up deleted files. Our engineers can restore these deleted files and assess them for file corruption.

If a data storage device has been in use since files were deleted from it, the likelihood of some of the deleted files becoming corrupted increases. Our engineers refer to this kind of corruption as hard corruption. The overwritten sectors can’t be rolled back to their previous states. There are many situations where our data recovery technicians can overcome hard corruption and repair damaged files.

If our technicians notice corruption in any critical deleted files, we make an effort to repair those files. Any irreparable corruption is noted on the list of recovery results. The last thing we want is for one of our clients to unwittingly receive nonfunctional data from us.

Why Should I Choose Gillware for My Deleted Data Recovery Needs?

At Gillware, we have taken steps to make the entire deleted data recovery process as financially risk-free as possible.

We start with a free evaluation of your deleted data recovery situation. We even offer free inbound shipping for any clients in the continental United States. Once our technicians have assessed the situation, we present you with a quote and probability of success. If you approve the quote, we don’t ask for payment yet. We go ahead and do the whole recovery process first.

Our deleted data recovery technicians recover as many deleted files as possible. We inspect the recovered data for corruption and repair any critical files as needed. We don’t show you a bill until we’ve successfully met your goals and recovered your critical data.

Our deleted data recovery technicians have logged thousands of hours of data recovery work over the years. They are incredibly well-acquainted with the ins and outs of data storage filesystems. Our financially risk-free service guarantee isn’t just because we hate when people give us money without getting anything in return. It’s also because we are confident in our data recovery engineers’ abilities to retrieve your deleted files.

Still not convinced? Check out some of these case studies for our deleted data recovery services.

Purgatory: Where your files go when they die

Deleted Photo Recovery Case Study: How We Recover Lost Files

The client in this data recovery case came to us after 34 gigabytes of photos ...

Deleted File Recovery Case Study: Western Digital RAID-1 Mirror

This client had two 500 gigabyte Western Digital WD5003ABYX-01WERA1 hard drives linked together in a ...

Why choose Gillware for Deleted Data Recovery?

Gillware’s data recovery services are affordably priced, technologically innovative and completely secure.


Best-in-class engineering and software development staff
Gillware employs a full time staff of electrical engineers, mechanical engineers, computer scientists and software developers to handle the most complex data recovery situations and data solutions

Strategic partnerships with leading technology companies
Gillware is proud to be a recommended provider for Dell, Western Digital and other major hardware and software vendors. These partnerships allow us to gain unique insight into recovering from these devices.

RAID Array / NAS / SAN data recovery
Using advanced engineering techniques, we can recover data from large capacity, enterprise grade storage devices such as RAID arrays, network attached storage (NAS) devices and storage area network (SAN) devices.

Virtual machine data recovery
Thanks to special engineering and programming efforts, Gillware is able to recover data from virtualized environments with a high degree of success.


SOC 2 Type II audited
Gillware has been security audited to ensure data safety, meaning all our facilities, networks, policies and practices have been independently reviewed and determined as completely secure.

Facility and staff
Gillware’s facilities meet the SOC 2 Type II audit requirements for security to prevent entry by unauthorized personnel. All staff are pre-screened, background checked and fully instructed in the security protocol of the company.

We are a GSA contract holder.
We meet the criteria to be approved for use by government agencies

GSA Contract No.: GS-35F-0547W

HIPAA compliant
Our entire data recovery process can be handled to meet HIPAA requirements for encryption, transfer and protection of e-PHI.


No obligation, no up-front fees, free inbound shipping and no-cost evaluations.
Gillware’s data recovery process is 100% financially risk free. We only charge if the data you want is successfully recovered.

Our pricing is 40-50% less than our competition.
By using cutting edge engineering techniques, we are able to control costs and keep data recovery prices low.

Instant online estimates.
By providing us with some basic information about your case, we can give you an idea of how much it will cost before you proceed with the recovery.

We only charge for successful data recovery efforts.
We work with you to define clear data recovery goals for our technicians, and only charge you upon successfully meeting these goals and recovering the data that is most important to you.

Gillware is trusted, reviewed and certified

Gillware has the seal of approval from a number of different independent review organizations, including SOC 2 Type II audit status, so our customers can be sure they’re getting the best data recovery service possible.

Gillware is a proud member of IDEMA and the Apple Consultants Network.

SOC 2 Type II Logo
GSA Contract Logo
Cleanroom Certification Logo
Top Ten Reviews Logo
Apple Consultants Network Logo