"You would need to take it to someone who can retrieve it.
It's not possible by a lay person on a pc at home.
It is possible. It is very easy
How dare you contradict me! Tell us how then.... C'mon."
Hope you don't mind me butting in but I thought I'd answer this.
There are various tools available that can be used for home use, e.g. Recuva, PhotoRec, FileRestorePlus, etc... These have certain limitations which mean they're not destined for computer forensic use, but for a home user trying to salvage their MP3s or digital photos they are fairly straight-forward to use.
As has kinda been mentioned in this thread already, the way that an operating system handles deleting files isn't actually how most people think it works.
Briefly, when a file is deleted by a user (this is different to put in the Recycle Bin) all that really happens is that the operating system makes the space that was previously allocated to that file available for other files to use - but it doesn't really delete the contents it just makes it available so it can be overwritten.
As long as the file hasn't been overwritten, it can quite easily be retrieved. Even if part of the file has been overwritten, it can, with varying levels of success, be retrieved and depending upon what the file was, can sometimes be still accessible.
For this reason, it's recommended to not use a hard drive you're trying to restore data from so as to minimise the chances of the files being overwritten and to increase your chances of successfully retrieving the data. That's why when we confiscate a user's PC at work if they're suspected of doing something illegal and will clone it exactly as it is, and then work from the cloned machine.
*** Feel free to stop here if you're bored already ***
A hard disk is made up of cylinders, platters, tracks and sectors. Each hard drive has multiple platters, which are referred to as a cylinder. Within each platter there are tracks which are concentric circles placed on the surface of each platter, much like the rings of a tree. Within each track there are tiny sectors which are used to store the data that make up your files, and each sector is 512 bytes in size. Because hard disks are now measured in gigabytes and terabytes, there are tens of millions of these sectors on your hard drive.
Different operating systems use slightly different methods for writing data to the sectors, e.g. Windows uses the NTFS file system, which itself uses things called 'extents' to manage which sectors are used and to try to eliminate fragmentation of the hard drive (where a file is randomly scattered across many different sectors) in an attempt to improve performance. The HFS+ file system on Apple Mac works in a similar way it just implements it slightly differently, as do the various file systems used on Linux, e.g. ext3, ext4, ReiserFS, etc...
All operating systems, however, keep a record of which sectors of the disk are allocated, i.e. have already been written by files that need to be kept, and which are not allocated and can be written to. In Windows (or rather the NTFS file system) this is called the MFT, or Master File Table. Previous versions of Windows used something called a File Allocation Table, or FAT. The HFS+ file system uses something called an Allocation File and a Catalog File to do the same thing.
When a user deletes a file, as already mentioned, the file isn't really deleted - it's just the reference to that file in the MFT or the Allocation & Catalog Files that gets reset. There can also be other changes, for example, in FAT32 file systems, when a file is deleted the operating system also changes the first character of the filename with the hex byte E5.
Essentially, the "undelete" applications work by ignoring what the operating system says should be stored on the hard drive and instead interrogate each sector themselves and try to piece together what the contents are, and then allow you to take a copy of any deleted files and restore them to another volume.
Blimey, that ended up being a lot longer than I had anticipated. I'm not really a nerd though - honest |