Can Deleted Data Be Recovered?

In today's digital age, data is stored in various electronic environments such as computers, mobile devices, and servers.

The operations involving the composition, retrieval, and deletion of data within these environments may vary, stemming from both software elements, such as the operating system, and hardware components, including storage device architecture and device processors. Likewise, the retrieval of deleted data represents a matter that requires distinctive consideration contingent upon both software and hardware considerations. When selecting software for data recovery, these limitations should be taken into account.

Impact of Storage Device:

Computer operating systems mark deleted data within storage space, but as long as new data is not written over it, the deleted data remains in the storage space. Data within a computer is stored on a hard disk drive ("HDD") or a solid-state drive ("SSD"). Although the operating system applies similar deletion procedures for both types of storage devices, HDDs and SSDs differ in their data storage capabilities due to their respective technologies and designs. HDDs are sensitive to magnetic fields, while SSDs are less successful in long-term data storage. Therefore, the amount of recoverable data may vary between the two types of storage devices.

Impact of Device Type:

Computing systems and mobile devices embody technologies characterized by different architectures and methodologies. Storage devices, file systems, operating systems, and processor architecture are fundamental factors that influence the size and quality of recoverable data. For instance, in a scenario where access to a computer is not possible, an external disk can be subject to imaging, while in a situation where access to a mobile device is not possible, accessing the storage device is not possible unless the device's security measures are bypassed or, if accessed, may reveal encrypted data that needs decryption.

Recovery of Deleted Data:

When selecting the methodology for recovering deleted data, factors such as the operating system of the device, physical hardware components (processor, storage device type, etc.), file types, and application types desired for recovery are considered. After classifying the data to be recovered based on device specifications, the most suitable method is chosen among professional digital forensics and backup solutions, while considering the requisites of users and the intended utilizations of the acquired data hold paramount significance in the decision-making process.

Professional Digital Forensics Solutions

These methodologies stand as one of the initial approaches employed in the recovery of deleted data. Data recovery software scans areas where data has not been overwritten and attempts to retrieve any recoverable data. Some methods used in the recovery of deleted data in digital forensics solutions include the details given below.

Physical imaging

A process aiming to create an identical copy of a computer hard disk or other storage device. This process can be used for various purposes, such as data recovery, digital forensic analyses, device backups, etc. After physical imaging, artificial intelligence-assisted data interpretation software makes it possible to recover/access data, especially in categories like images, videos, screenshots. Physical imaging is a method that allows obtaining the most comprehensive data from the current state of the device.

Logical imaging

Logical imaging is a method used when an examination is not performed on deleted data or when it is preferred during mobile imaging. In logical imaging, data in the storage space can be extracted as the operating system allows. Therefore, the probability of recovering deleted data from logical imaging is very low.

Root and Jailbreak methods

This method is favored in situations where access to the information in the device is unavailable. If not applied by professionals, the device can be completely locked or vulnerable to attacks, and it may also lead to the end of the device's warranty. For these reasons, it is classified as a high-risk operation.

Live imaging

In instances where physical image acquisition is impractical, or where arises a necessity for the procurement of RAM data, the "Live imaging" method is chosen. For the acquisition of a live image, software based on either Windows or Linux Operating Systems can be utilized. During live imaging, either physical or logical imaging can be performed; however, utmost care must be exercised from causing alterations in the owner's computer throughout this process.

Data carving methods

This method is employed in digital data recovery and forensic technology to recuperate or extract data from a storage device, particularly in instances where the file system or file metadata has incurred damage or is rendered inaccessible. Data carving aims to reconstruct damaged or lost data by scanning raw data and fragmented data.

Version change with imaging

In certain circumstances, data loss may occur due to disparities in the versions of operating systems and applications. Consequently, recovery of data within the device may prove unattainable. The most suitable operating system versions and application versions for data recovery through digital forensics applications are determined. The device to be recovered is upgraded/downgraded to one of these versions, and after the data is safely copied to an external environment using digital forensics applications, the device's data is restored to the current operating system and application version.

Backup Solutions

Local backup of data

In operating systems, restore points allow the system to be reverted to its previous state. However, these restore points are not automatically created in many devices. Users must manually create device restore points at certain intervals. If access to the device is cut off, access to the local storage space would be also lost.

Backup of data to the cloud

This method is frequently used to recover lost data, especially in devices such as phones, tablets, and smartwatches. Smart devices contain much more data in their cloud backups than anticipated, but it is often not possible to recover all this data with their own cloud software. Recently, with the QR code system integrated into cloud systems, it has become possible to re-access many data through the servers of application providers. Through forensic software, a lot of backed-up data from smart devices can be quickly recovered via cloud storage.

Backup of data to an external environment

Critical data that needs to be stored for a certain period can be backed up either locally or externally. External "HDD" and "SSD" storage devices are commonly preferred for this purpose. Data is backed up to an "HDD" or a "SSD" at specified intervals from the device where it was collected. In the external backup process, in order to prevent complications and security vulnerabilities, the external disks to which data will be copied must be encrypted. As mentioned in the storage device impact section, "HDD" external storage devices are sensitive to magnetic fields, and "SSD" external storage devices may experience problems in long-term data storage. Therefore, if data is to be backed up in an external environment, it is crucial to create a minimum of one backup alongside the target external storage device, considering the climate conditions specified by the manufacturers of the external disks used for data storage to reduce potential losses during the waiting period after data transfer.

Overall, the recovery of deleted data involves careful consideration of various factors, and the selection of an appropriate methodology depends on the specific characteristics of the situation. Professional digital forensics and backup solutions pay a crucial role in maximizing the chances of successful data recovery while minimizing potential risks and losses.