My understanding is that when you “delete” a file on a computer, you are simply allowing it to be over-written. My first question is whether this is accurate.
My second question is whether this also applies to “deleting” pictures from digital camera memory cards.
Lastly, assuming the accuracy of the above, how difficult/expensive is it to re-acquire prevoiusly “deleted” files/pictures?
yes, the filesystem just marks the blocks occupied by that file as “available.”
yes, on any camera I’ve used. Too, “formatting” the card only (as far as I know) replaces the FAT with a new one, it doesn’t actually obliterate the data on the card.
trivial, so long as they haven’t been over-written. GetDataBack is pretty good about recovering things which haven’t been clobbered.
You don’t even need to spend any money. Just google “data recovery” or something, and about a million free programs will present themselves. As long as you didn’t touch the memory card after deleting, your chances of success are very high. I did this a while back, and I recovered more pictures than actually had space on the card!
There is an additional wrinkle when dealing with Flash memory (where the storage blocks have limited write cycles). These implement “wear-levelling”, a system to ensure that all the storage blocks on the device get used at approximately the same rate. This is to prevent busy blocks of a file system (like the FAT table and root directory entry) from using up all their write cycles while other blocks do not get used at all. This involves moving data and shuffling the physical block order underneath the file system block order. This has a variety of impacts - deleted data can get moved both to the end of the physical and logical free list, ensuring that recently deleted data is preserved longer than it might otherwise. However, the physical block reordering process may rearrange blocks so that an originally contiguous deleted file (at the file system level) is no longer contiguous (or even ordered).
I believe that there are specialist tools that can interrogate flash memory to determine wear-levelling changes as well as looking at the file system. Cetainly police technical officers have such tools for recovering data from mobile phones. Good recovery tools will also attempt to reconstruct files from fragments.
Si
Out of curiosity, I just googled recover deleted pictures. If you google that you’ll have some examples of how to do it.
Note that it depends on the file system involved and what else is going on on that particular drive (or partition).
MS filesystems like FAT and NTFS make it fairly easy to recover files in some circumstances.
Unix-related filesystems, OTOH, are usually much harder. This includes Macs and many other Apple products. With iPods, you can elect which filesystem to use in some (all?) cases. If you select FAT and connect your iPod to a MS-Windows OS PC, then life is easier if you want to recover data off a messed up iPod.
Note, though, that the OS is frequently updating things on it’s drive/partition, so any data you want to recover on the OS drive gets quickly harder to recover. One reason many people (like me) like to have separate partitions for the OS and the data.
Plug in devices like cameras and mp3 players usually don’t have any background file changes going on, so they’re easier to recover.
OTOH, if there are pictures on the camera you deliberately want to obliterate, you need to fill the card up with new stuff. If it can do video, start it recording and let it go for a while. Or you can copy junk files off your PC to the camera if it will let you.
The standard FAT file system delete was:
-mark file in directory as “deleted” change first letter of filename to “0”(?)
“Free space” on the filesystem is a chain of sectors/blocks (the fat table entry of each block points to the next block in the file or free space table). The directory entry points to the first block in the file. The lat block points to zero. So take the first block of the deleted file, take the last block of the “free space” list, and point that last block to the beginning of the deleted information. Presto! Your ex-data is now free space.
However, all but the first character of the filename can be recovered; and all the data; until your computer starts using that empy space for something else.
NTFS is, I think, similar.
Most camera cards, USB sticks, etc. are formatted FAT or NTFS.