Computers are advancing, and they're having a significant increase in storage space. From internal and external hard drives, USB flash drives, memory cards and many more, we have plenty of option to store our data.
On a computer, a file is its common storage unit. Everything a computer needs to understand are contained in a file, and how these data are structured on the operating system is by using a file system.
Any computer file is stored on some kind of the mentioned storage that has a given capacity. Each storage is a linear space in which a computer can read, or both read and write. Each byte within the information on the storage has its own offset from the storage start. This is called the address. A storage can also be presented as a grid with numbered cells which each representing a single byte. Any of the saved information will take a number of these available cells.
In general, computer storages are using a pair of sectors to reference any byte of information. Although a file you see seems to be single "file", to a computer, it's essentially a collection of data. A sector is the smallest possible blocks of data in which is the smallest block the disk drive itself can read or write.
One sector consists of a group of bytes, usually 512 characters or bytes. Since it's addressable inside the physical storage, sector is used to optimize storage addressing.
Since each file occupies unused sectors so they can be read and its attributes and position known, the computer should understand where are those particular sectors are located. A computer, for example, needs to know a file's size and its name before being able to know what data it holds.
To understand this, computers use file system to structure a file's data representation. File system is also used as a set of metadata that describes the stored information. A file system is a computer's method for storing and organizing computer files and the data they contain to make it easy finding and accessing.
File system can not only serve the purposes of the whole storage but also be a part of an isolated storage segment, also called disk partition. Usually the file system operates on blocks rather than sectors.
Windows file systems
Microsoft Windows is one of the most well-known operating system. Its widely used, and as a matter of fact almost all computers at least have tasted "Windows" once in its lifetime.
Windows use two major file systems: FAT (File Allocation Table,) which is inherited from DOS and NTFS (New Technology File System) file system that is widely used. For Windows 8 and above, Microsoft has developed ReFS (Resilient File System) as a newer generation for its file system.
FAT is a standard for a file system type. As disk drives evolved, the capabilities of the file system have been extended accordingly, resulting in three major file system variants: FAT12, FAT16 and FAT32.
MacOS file systems
Apple Mac OS operating system uses HFS+ file system. This is an extension to older HFS (Hierarchical File System) file system that was common on old Macintosh computers.
HFS+ file system is applied to many Apple products, ranging from its desktop computers, Macs, iPhones, iPads, iPod and Apple X Server products. Advanced server products are also able to use Apple Xsan file system.
Linux file systems
Linus is an open-source operating system that aims to implement, test and use different concepts of file systems. For that cause, Linux is able to apply a huge amount of different file systems.
The most popular ones are: Ext2, Ext3, Ext4 which are native Linux file system (abbr: extended filesystem), ReiserFS which is an alternative Linux file system designed to store huge amount of small files, JFS (Journaled File System) and XFS and which is a 64-bit journaling file system.
BSD, Solaris, Unix file systems
The operating systems commonly use UFS (Unix File System), or FFS (Fast File System). This file system is the source of ideas for many other file system implementations.
UFS has many editions, and all of them are supported by Unix-family OS.
Clustered file systems
Clustered file systems are used in computer cluster systems. These file systems have embedded support of distributed storage.
Among them are: ZFS, Apple Xsan, VMFS, GFS and JFS1.
Know You File Deletion
Most operating system provides a security measure to prevent you from accidentally deleting files. The tools are called Recycle Bin, Wastebin or Trash. When you want to delete a file, the operating system by default prompts the computer to move the said file to a dedicated folder. Any deleted files that are placed inside this folder could be recovered exactly as they were without the need of any specialized data recovery tools.
Bypassing this security measure will tell the operating system to permanently delete a file. Emptying the Recycle Bin also does the same thing.
However, the file is yet to be permanently unrecoverable. You still have the chance to recover the file as long as you stop any activity on the given drive.
When a file is said to be permanently deleted by an operating system (not anymore inside Recycle Bin or anywhere else on the disk), the data of the file is essentially not yet deleted. What happens is that the operating system marks the directory entry for the file, which points to the list of clusters where the data is stored on the disk, empty or no longer valid.
Right after a file is deleted, most of the information about it, including the file's name, and the list of clusters that contain the data, still remains on the drive. But because the operating system has marked the directory entry to be empty, it will no longer show the file.
Any files deleted can be recovered as long as the real data is still intact and the clusters are still available with the data. Tools to recover deleted files search previous delete attempts and try to recover the directory entry and pointing it to the respective cluster.
If you're trying to recover a permanently deleted file from a storage, you may use a dedicated software to do the job. Many of these tools can do the job just right, as long as the directory entry, or the data itself aren't yet reused by other files. This is why you should stop using the storage that has the deleted files for any reason because it will decrease the chances of recovery.
You should install the tool(s) on other drive than the drive that has the deleted file. And for the same reason, you should also put the recovered files on different drive to avoid any write attempt on the storage.
If the file you want to recover is placed on the same drive as your operating system, you should stop any action immediately. Boot your computer using a bootable device and attempt the recovery there.
When choosing data recovery software, it's important to first know the file system used on the disk containing the lost data. This is because many data recovery tools are made to work with specific file systems.
Attempting To Recover Files
The more a computer is used, the more it has to do the things it has to do. The more is has to read and write new information, data becomes fragmented. As a result of this, files won't be stored as a whole fragment(s) anymore because they're divided.
Fragmentation is caused when reusable storage space appears between other files that may not be enough to hold new data. Because the file couldn't occupy the small space, the operating system has to seek different location on the disk.
When a file's data becomes fragmented, the operating system needs a longer time to read the file from the disk. Although this may not be noticeable to some extent, plenty of fragmentation can make the given storage has less empty space than it should. Furthermore, recovery for fragmented files could be a lot more difficult; especially when the directory entry has been lost as there is less information available for the file to be linked to.
Defragmentation tools aim to rearrange the fragmented clusters of data so clusters belonging to a file are put next to each other, in the right order.
Beside speeding up the process of reading files, defragmenting can also improve the changes of successful lost file recovery. But there are also changes that defragmenting will do more harm than good in terms of recovering deleted files that were deleted before the disk was defragmented.
File systems are very complex but every computers can benefit from them. File systems in general is telling how a file is stored on a computer.
While one file system is different from the next, understanding how they work can help you understand how computer's storage could be clustered, how a deleted data can be recovered and why data privacy software is needed to ensure your data's safety
But there is one major concern: not all file systems or operating systems support file recovery by common methods. Forensics-related tools and manual reconstruction of a file using HEX editors, for example, can increase the chances of recovery to some further extent.
The cause of lost files is not limited to file deletion. Files can also be lost/corrupted/inaccessible from corrupted/damaged/malfunctioned storage, operating system failure and others. Recovery of files, beside using the said drive, using its clone/ghost/image partition is also possible.
Further reading: Explaining Bad Sector And Its Solutions