Changes

===Accidental deletion===

===Accidental deletion===

It is not uncommon for someone to have a problem where they accidentally delete one or more files.  Many operating systems offer a "trash can" or "recycle bin" which holds deleted files in case someone changes their mind or deleted something by accident.  However, even if a file is fully deleted, it is not immediately lost.  Rather, the pointer to it in the file system is removed, and the space is marked as available.  With nothing but a shareware program, much data lost in this manner can be recovered by the user.  Some programs such as [http://www.piriform.com/recuva Recuva] and [http://www.wisecleaner.com/wise-data-recovery.html Wise Data Recovery] look for complete files marked for overwrite only, but others like [http://diskdigger.org DiskDigger] scan the disk surface to find recognizable patterns.  This results in the discovery of many partial and corrupted files, but also is more likely to locate at least a portion of the desired file(s).<ref>http://www.pcworld.com/article/2147668/how-to-recover-deleted-files.html</ref>

It is not uncommon for someone to have a problem where they accidentally delete one or more files.  Many operating systems offer a "trash can" or "recycle bin" which holds deleted files in case someone changes their mind or deleted something by accident.  However, even if a file is fully deleted, it is not immediately lost.  Rather, the pointer to it in the file system is removed, and the space is marked as available.  With nothing but a shareware program, much data lost in this manner can be recovered by the user.  Some programs such as [http://www.piriform.com/recuva Recuva] and [http://www.wisecleaner.com/wise-data-recovery.html Wise Data Recovery] for Windows look for complete files marked for overwrite only, but others like [http://diskdigger.org DiskDigger] (for Windows) scan the disk surface to find recognizable patterns.  This results in the discovery of many partial and corrupted files, but also is more likely to locate at least a portion of the desired file(s).<ref>http://www.pcworld.com/article/2147668/how-to-recover-deleted-files.html</ref>  While such options are more limited for Mac operating systems, some software (usually requiring a paid license) is also available.<ref name="lifehacker.com">http://lifehacker.com/393084/how-to-recover-deleted-files-with-free-software</ref>

<br />

<br />

If accidental deletion occurs, a user should try to avoid saving any new information to the drive until the lost file can be recovered.  Ideally, the recovery program would be run from another partition or drive, and if it was lost on the system drive, the operating system would not be running.  If read/write operations continue as usual, the accidentally deleted information may be overwritten.

If accidental deletion occurs, a user should try to avoid saving any new information to the drive until the lost file can be recovered.  Ideally, the recovery program would be run from another partition or drive, and if it was lost on the system drive, the operating system would not be running.  If read/write operations continue as usual, the accidentally deleted information may be overwritten.

===Overwritten data===

===Overwritten data===

Wanted information sometimes gets overwritten after it is marked as deleted.  Since the operating system sees it as free space, data will simply be written to that specific sector or group of sectors almost completely destroying the old information.  This prevents simple disk surface searching from finding what is wanted, but some trace of it can still exist.  This trace usually exists in the form of stronger or weaker than average magnetism on a [[Hard disk|hard disk drive]].  Such minute differences cannot be read by a conventional computer system, but specialized software can be used to detect and interpret them.  For this reason, shredding is sometimes used prevent the discovery of such traces.

Wanted information sometimes gets overwritten after it is marked as deleted.  Since the operating system sees it as free space, data will simply be written to that specific sector or group of sectors almost completely destroying the old information.  This prevents simple disk surface searching from finding what is wanted, but some trace of it can still exist.  This trace usually exists in the form of stronger or weaker than average magnetism on a [[Hard disk|hard disk drive]].  Such nominal differences cannot be read by a conventional computer system, but specialized software can be used to detect and interpret them.  For this reason, shredding is sometimes used prevent the discovery of such traces.

===Shredding===

===Shredding===

The process of "shredding" (also know as secure deletion) is designed to prevent recovery, and does so quite effectively.  Although information which is overwritten once or even twice can sometimes be recovered, a good shredding algorithm overwrites the file's disk space three to sixteen times, each time with a different randomly generated block of gibberish.  Some programs offer to run this process sixty-four times or more, but this is usually unnecessary.  Even two or three passes will usually destroy the data altogether, although some say that certain government agencies can see back up to seven overwrites.{{citation needed}} After a sufficient number of passes of this process have been completed, there is no known way to recover it.  For this reason, shredding should only be performed when the user is absolutely sure they wish to obliterate certain information. Also, shredding causes a little extra wear on the drive, which is more harmful to Flash memory than disk drives.  If shredding in not needed, it probably should not be used lest it eventually cause a malfunction.

The process of "shredding" (also know as secure deletion) is designed to prevent recovery, and does so quite effectively.  Although information which is overwritten once can sometimes be recovered, a good shredding algorithm overwrites the file's disk space three to thirty-two times, each time with a different randomly generated block of gibberish.  Some programs offer to run this process sixty-four times or more, but this is usually unnecessary.  Even two or three passes will usually destroy the data altogether<!--, although some say that certain government agencies can see back up to seven overwrites{{citation needed}}-->.  It has been shown that using Magnetic Force Scanning Tunneling Microscopy (Which is generally used to test and improved read/write heads) can detect "shadows" of the previously stored bits can be detected, even though this process would take years to complete.<ref>http://www.nber.org/sys-admin/overwritten-data-gutmann.html</ref><ref>https://www.usenix.org/legacy/publications/library/proceedings/sec96/full_papers/gutmann/index.html</ref> However, after a sufficient number of passes have been completed, there is no known way to recover it.  For this reason, shredding should only be performed when the user is absolutely sure they wish to obliterate certain information. Also, shredding causes a little extra wear on the drive, which can be more harmful to [[Flash memory]] than disk drives.  Additionally, due to wear-leveling algorithms employed by flash memory storage, shredding is nearly impossible with any certainty.<ref>http://www.pcworld.com/article/261702/how_to_securely_erase_your_hard_drive.html</ref> If shredding is not needed, it probably should not be used lest it eventually cause a malfunction.

===Malfunction===

===Malfunction===

For hard disk drives, the disk itself is most vital part.  If the shell and all other components are destroyed, there is a chance some information can be recovered by reading it from the disk using a different head.    However, some of the circuitry on each hard disk is specialized for that specific device.  While it may be possible to recover information without it, this will be more difficult.  Also, this makes it nearly impossible to simply place on disk into another enclosure and use it as-is.

For hard disk drives, the disk itself is most vital part.  If the shell and all other components are destroyed, there is a chance some information can be recovered by reading it from the disk using a different head.    However, some of the circuitry on each hard disk is specialized for that specific device.  While it may be possible to recover information without it, this will be more difficult.  Also, this makes it nearly impossible to simply place on disk into another enclosure and use it as-is.

===Optical disks===

===Optical disks===

For optical disks, the foil is most important.  The most common damage to optical disks is the scuffing and scratching of the plastic covering, which prevents the read laser from being refracted properly, making the information difficult to access.  This problem can be easily resolved by resurfacing the disk, polishing it, or applying a sort of transparent wax. Since these methods are so effective, other methods are hardly needed.  however, due to the simplicity of optical disks, the foil could theoretically be transferred to another shell.  This may be necessary if the disk becomes warped and cannot be flattened.  However, if the disk is broken, little can be done, since the so many bytes are lost at the point of separation.  Not only are the contents themselves corrupted, but also the file system is damaged.

For optical disks, the foil is most important.  The most common damage to optical disks is the scuffing and scratching of the plastic covering, which prevents the read laser from being refracted properly, making the information difficult to access.  This problem can be easily resolved by resurfacing the disk, polishing it, or applying a sort of transparent wax. Since these methods are so effective, other methods are hardly needed.  however, due to the simplicity of optical disks, the foil could theoretically be transferred to another shell.  This may be necessary if the disk becomes warped and cannot be flattened.  Alternatively, there is the option for scratched disks of using software to use a "best guess" approach of recovery.<ref name="lifehacker.com">http://lifehacker.com/393084/how-to-recover-deleted-files-with-free-software</ref>  While not an ideal option, it can be cheaper and easier than actually repairing the disk.

 

However, if the disk is broken, little can be done, since the so many bytes are lost at the point of separation.  Not only are the contents themselves corrupted, but also the file system is damaged.

==Notes==

==Notes==

*If one or more files have been lost but have backups exist, those should be checked first!  Not only is it easier to retrieve it/them this way, but there is also less risk of file corruption.  Even if a recovered file seems intact, it can still be slightly damaged.

*If one or more files have been lost but have backups exist, those should be checked first!  Not only is it easier to retrieve it/them this way, but there is also less risk of file corruption.  Even if a recovered file seems intact, it can still be slightly damaged.

*If information is lost, the partition on which it was lost should not be used until recovery may be attempted.

*If information is lost, the partition on which it was lost should not be used until recovery may be attempted.

*Excluding physical damage, disk drives usually fail based on how long they have been running, while flash memory tends to fail based on how much data it written to it. The potential need for data recovery can be reduced if users try to reduce the most impactful kind of wear to their devices.

*Excluding physical damage, disk drives usually fail based on how long they have been running, while flash memory tends to fail based on how much data is written to it in its "lifetime." The potential need for data recovery can be reduced if users try to reduce the most impactful kind of wear to their devices.

    

    

==References==

==References==

{{reflist}}

{{reflist}}