Recovery of deleted files from Microsoft Windows
Windows operating system currently applies two file systems - FAT and NTFS. Lately released ReFS is now available for Windows 8 Server systems only.
FAT was developed for an old DOS operating system. Due to design simplicity and low reliability, it's mainly used now for memory cards such as those in digital cameras, mobile phones and other portable devices.
FAT gives rather good chances for recovery of deleted files which could be substantially reduced with file fragmentation. The more the file has been fragmented, the more difficult it is to recover. If a file is deleted on FAT by emptying or bypassing the recycle bin, the system wipes the information about its location. At the same time, the data is not deleted immediately. File recovery is possible only when it has not been overwritten. For recovery of files deleted from FAT, SysDev Laboratories offers a variety of data recovery software products, each capable of recovery from FAT.
NTFS is the major file systems applied in Windows. It's a default file system for Windows NT/2000/XP/2003, Windows Vista and Windows 7 distributions and the only file system that is supported for disk partitions over 32GB.
NTFS features one of the best data recovery chances unless the information on the disk is overwritten. The system provides a high possibility for recovery of deleted files. If a file is deleted on NTFS, its Master File Table record is marked as “unused”. The bitmap of used space is updated to release used clusters. A file entry is deleted from the directory record.
ReFS (Resilient File System) is the latest development of Microsoft for Windows 8 servers. The major purpose of this file system is to work with large amounts of data with maximized reliability and increased performance for a data storage system.
The architecture of the file system differs from other Windows file systems and is mainly organized in a form of a B+-tree. ReFS has high tolerance to failures due to new features of the system, like, the Copy-on-Write (CoW) technology: no metadata is modified without being copied; no data is written over the existing ones and into a new disk space. With any file modifications, a new copy of metadata is created into any free storage space, and then the system creates a link from the older metadata to the newer ones. As a result, a system stores older backups in different places making file recovery easy, unless this storage space is overwritten. Besides, the system is capable of constant integrity control to protect itself from the failure of all backups at once.
Another feature that contributes to overall system reliability is a checksum for metadata and optionally to user data. The checksum is automatically updated once some new data appears. This feature allows checking and even correcting errors bringing the system back into a consistent state.
Despite all these insurance mechanisms, in practice, the system can still lose data. This may happen, when, for example, the system isolates some area with corrupted data to ensure an uninterruptable volume operation. The file deletion itself modifies the metadata structure using CoW and marks the area free for writing. As mentioned above, the system stores huge amount of older backup copies providing rather good chances for complete data recovery. We recommend UFS Explorer Professional Recovery ReFS file systems with a set of all necessary tools and mechanisms to solve this data loss problem.
Note: Like any deleted data recovery, file recovery from these file systems is possible until the actual disk space is re-used for a new file.