How does data recovery software work?

Data recovery software works by reading a drive more carefully than the operating system does. When a file disappears, its contents are usually still on the disk: what is gone is the filing, the record that said where the pieces sat and what the file was called. Recovery tools either rebuild that filing or set it aside and look for the contents themselves. This page explains both approaches, why they work at all, and where they stop working.^[1][2]

What a scan actually does

Most tools start with the file system: the index the operating system keeps of every file, recording where each one starts, how long it is and which blocks it occupies. A first pass walks this index and lists entries that are marked deleted but not yet reused, which is why a file removed a few minutes ago is often the easiest to get back. CGSecurity's documentation for TestDisk describes undeleting files from FAT, exFAT, NTFS and ext2 file systems, and lists repairs such as rebuilding boot sectors and fixing the NTFS MFT from its mirror. That whole family of features works on the index, not on the files themselves.^[3]

When the index is missing, damaged or has been rewritten by a reformat, that route closes. The second approach, usually called a deep scan or file carving, ignores the filing altogether and reads the raw contents of the drive. CGSecurity states that PhotoRec, its carving tool, ignores the file system and goes after the underlying data, so it still works even if the file system has been severely damaged or reformatted. Instead of looking records up, the tool reads the drive block by block.^[2]

What it looks for is the tell-tale first bytes of known file types. CGSecurity describes PhotoRec as checking each block against a signature database that comes with the program, and states that its list of recoverable formats runs to more than 480 file extensions across about 300 file families. The same documentation names the catch: carving rebuilds a file from the data that follows a signature, and CGSecurity notes that when data is not fragmented PhotoRec can recover the whole file. A file split into scattered pieces is harder to reassemble, and may not come back intact. The tool also discards a recovered file that ends up smaller than its header specifies, preferring to lose data than to save something broken.^[2]

Why deleted files can come back at all

Deletion on a modern file system is bookkeeping, not erasure. Microsoft's storage documentation explains that deleting a file is performed as a change to the master file table only, not as an operation to all the sectors of the file, so the drive retains those sectors. CGSecurity's PhotoRec documentation says the same thing from the recovery side: what deletion loses is the meta-information, the name, the timestamps, the size and the location of the file's first block. The contents are left waiting underneath.^[1][2]

Two consequences follow from that. First, recovered files often come back with meaningless names, because the name was one of the things deletion removed; a tool that found the data by carving has no record of what it was called. Second, the window closes with use: the space is marked free, so anything the computer writes from that moment is a candidate to land on top of your data.^[2]

Where software reaches its limits

The first limit is reuse. Recovery software reads what is there; it cannot bring back bytes something has already replaced. That is why timing matters more than tool choice, and why the standing advice is to stop using the drive as soon as you notice the loss. Every boot, update and save quietly competes for the same freed space.^[2]

The second limit is solid state drives. On an SSD the drive itself is told when space is no longer needed: Microsoft states that NTFS sends the TRIM command for normal operations such as deleting a file. Once the drive has acted on those hints, the data is not waiting to be found. Microsoft warns that extents passed to its trim interface are permanently removed from the storage media. In practice, deleted files often disappear for good on an SSD far sooner than on a spinning hard disk.^[1]

SSD TRIM and deleted files: why deleted files vanish faster on a solid state drive

The third limit is encryption. If a drive is encrypted, a recovery tool sees scrambled data, and no amount of scanning turns scrambled data back into files. Microsoft's documentation for BitLocker, the encryption built into Windows, states that a drive which cannot unlock normally stays locked until its recovery key or 48-digit recovery password is supplied. With the key, a tool is working on readable data; without it, there is nothing for the tool to read.^[4]

What this means in practice

The mechanics point to a short set of habits: act early, touch the drive as little as possible, and copy anything you recover somewhere else. The guides below cover the decisions those habits raise: what free tools actually let you do before asking for money, and the situations where running more software makes a bad situation worse.

Free data recovery software: what free tiers actually allow

When recovery software makes things worse

Not sure what to do next? Answer a few questions and get a suggested first step