The root directory is the place which stores the name of a file, the location of its starting cluster, and the size of the file. In order to find a file the Operating System uses this information to get to the first storage cluster of a file. It then uses a special table at the start of the disk know as the File Allocation Table or FAT to identify the remaining clusters that are used to store the file. It is important to realize that this information is stored completely separate from your file data and is why FAT data recovery is possible.

In newer OS’s the FAT and Directory Entry method has been merged and replaced by a single table known as the Master File Table or MFT. While an MFT is more complex, the principal of finding the start of a file and its subsequent storage clusters is primarily the same.

What happens when I erase a file?

Lets examine what happens when you deliberately delete a file and why it may be possible to bring that file back. When you select a file and hit the delete key on a Windows 7 PC the file is sent to the Trash. You can think of the Windows Recycle Bin as just another glorified storage folder on your hard drive. The ‘real’ deletion (for this discussion) is what happens when the Recycle Bin is emptied or the deletion goes around the Windows Recycle Bin altogether.

When a file is deleted the OS marks the file name in the MFT with a special character that signifies to the computer that the file has been deleted. The desktop now (sees the clusters occupied by that file as being empty and therefore available to store a new file. What Windows does NOT do is go out to the clusters on the hard disk where the files data is actually stored and delete the contents of the clusters. The deleted file data is still there, but the Windows XP Operating System no longer understands it exists.

This is the underlying principal of hard drive data recovery. It is about finding data that still exists on the hard drive but which currently can’t be recognized by the Operating System. If the clusters containing the data have been corrupted or physically damaged, then finding the data they once contained may be impossible.

Ok, so my data is still there, but for how long? The answer to this question is completely up to you. The only way that your removed Master File Table record or your file data itself will permanently be erased is if it is overwritten by other data. This means that any computer activity after deleting the file has the potential to permanently erase otherwise recoverable files.

If you are attempting data recovery from your disk drive, if possible connect it to another PC as the slave drive so that the OS wont be doing a merry dance over all of the deleted files when you attempt to recover them. If you use data recovery software, don’t install it on the drive on which the files were lost. Better yet, use a floppy disk or CD version if available.

Data Recovery by Searching for Deleted MFT Records

Most data recovery programs search for deleted FAT entries to undelete files or unformat drives. These programs usually give a probability fo hard drive data recovery rating of ‘good’, ‘medium’ or ‘poor’. What they are actually doing is locating the FAT record for a deleted file and then checking the rest of the FAT records to determine if the clusters that the deleted file occupied are being used by any other file stored on the computer. As only one file can occupy any one cluster on a hard drive, if other files are using your deleted files storage space then it is likely that the original data has been overwritten and permanently destroyed.However, if your Master File Table is corrupt, defective or has itself been overwritten, this method isn’t going to help you get data back even though the file data still remains out on the disk waiting to be found.