Data Loss from Windows File Systems: What Are the Chances to Raise Those Files from the Grave?

If you’ve ever installed a brand-new internal hard drive to your Windows PC or wanted to start with a clean state by formatting your USB flash drive, memory card or external HDD, you probably know that this operating system offers several file system options. In addition to FAT, which has always been supported by Windows (even its ancient versions running on those bulky and slow machines), this OS gets along with a newer file system called NTFS, which is set up by default on all modern non-removable (and even some removable) drives. But no matter which one you’ll plump for, there is simply no silver-bullet file system solution to the problem of data loss, meaning that any moment you may bid farewell to some important files.

Given the fact that most people are incredibly persistent in neglecting backups, a data loss disaster, when it hits, can bring even the toughest of us completely undone. Bad thoughts are starting to swirl around your head and it is so easy to just get stuck in that “panic mode.” As hard as it is, you should buck up and conquer that chaos in your mind, as your panic will only fan the flames. On the bright side, Windows doesn’t actually destroy any information at once, and with the help of special software data recovery from FAT and NTFS is possible. However, there is always a fly in the ointment: in some cases, lost files can be recovered completely, while in other ones the missing files may be gone for good. But what do their chances to survive depend on?

Advertisement

In actual fact, there are numerous factors that influence data recovery chances, but they are mostly related to the exact situation that lead to data loss, what kind of files are missing and the user’s actions right after. The most typical data loss scenarios from Windows file systems include:

Accidental deletion

No matter how hard we try to avoid them, mistakes sometimes just slip through. When garbage takes over your PC or USB storage and you finally decide to get rid of those hundred-year-old documents you’ve never even opened, some important files you wanted to keep may just somehow get in the way of your flame and thus get deleted. As FAT and NTFS perform file deletion in a bit different ways, the recovery chances differ as well.

If your storage device is formatted with FAT, chances to recover a file that fell victim to unintentional deletion are not extremely high. In FAT each file is stored in one or more blocks of equal length called clusters and has its own directory entry (a record in the file system which corresponds to this file), which contains all information about it, including its name, size, attributes and the address of the first cluster. If a file consists of two or more clusters, the information about the succeeding ones can be found in the File Allocation Table. When the user deletes a file, all the clusters previously occupied by this file are marked as free and the corresponding records in the File Allocation Table get completely erased, meaning that the information about the clusters a file consists of gets wiped. However, the directory entry is just marked as unused, so the information about the name of the file, its size and the address of the first cluster still remains on the disk. Therefore, if the file itself is so incredibly small that it fits into a single cluster, it can be easily retrieved using the information from the directory entry. But if the deleted file is larger than the size of a single cluster (which is practically always the case), it is quite hard to determine which exact clusters belong to it and recover the rest of this file, as owing to fragmentation, these clusters may be just scattered around the disk. Certain heuristic algorithms allow predicting the chain of clusters and recover the entire file. Yet, if the level of fragmentation is very high, some files may be returned corrupted or fail to be recovered at all.

Advertisement

Conversely, files that were deleted from the NTFS file system have exceedingly high chances to be restored. In NTFS all file records, which contain the name of a file and all of its attributes, are stored in a single database called Master File Table. When the user deletes a file, its record gets deleted from the directory, while the corresponding Master File Table record as well as all the clusters occupied by that file are marked as unused. A data recovery utility can scan the Master File Table and locate that “unused” record together with all of the file attributes stored in it. As you may remember, some very small files are stored within Master File Table records as “data” attributes. But in contrast to FAT, even if the file is large, all pointers to clusters occupied by that file (extents) are not destroyed and remain there until overwritten. This means that files of any size, even severely fragmented ones, will be brought back.

File system formatting

There is nothing out of the ordinary in the loss of valuable data due to file system format. One may mistakenly specify a wrong disk partition, or some files may get lost during the conversion from FAT32 to NTFS without proper backup. Still and all, accidental formatting puts the user into bigger trouble than simple file deletion: during this process, an empty file system structure is created on the drive whereas the information which belongs to the previous file system gets partially overwritten with the new information of the new file system. In such cases, the chances of a favorable outcome depend on the particular file system and sometimes on the extent to which the previous and the new file system differ as to their structure. For instance, if you format your drive with the FAT file system, it will overwrite a big amount of information about the allocation of the previous files. Even if the previous file system was FAT as well, some files are very likely to be lost for good. However, if you reformat your NTFS storage with NTFS, it will keep the information about the allocation of files, directory records and file names, allowing data recovery software to successfully reconstruct the lost file system, but there is still a slight possibility of some data being damaged.

Advertisement

File system damage

If you have no idea why your files are missing as they’ve just mysteriously disappeared or cannot be accessed, your file system has probably suffered logical damage and some parts of it became unreadable. This may be caused by various reasons, from software failure or malware attack to power outage or hardware malfunction. In any of these cases you can employ data recovery software and retrieve at least some of the lost files, but the recovery result will depend a lot on the actual file system damage, its severity and the area affected. For example, when it comes to FAT, it is very important that the beginning part of the drive should remain intact, as if both the File Allocation Table and its copy are damaged, it is very difficult to recover all fragmented files.

Advertisement

Lost information about partition

The loss of information about a certain partition (its location, size) may be induced by erroneous user’s actions or when he/she is trying to solve disk problems or enhance performance using some system tools. In this case, data recovery software will scan the storage and identify the file system relying on the known file system structures. If the file system itself wasn’t damaged, the missing data can be fully restored.

Advertisement

Physical damage of a storage device

There are a great many factors that can cause a storage device failure, such as heat, water, power blackouts and so on and so forth. If you know for sure that your storage was physically damaged, don’t try to do any DIY fixes: turn the device off immediately and contact a data recovery service center, as there is practically no chance that without the needed skills you will be able to a successfully perform the data recovery operation.

Advertisement

Beyond question, the causes that lead to data loss largely determine whether the missing files can be fully recovered, yet, it’s not just that: the user’s actions that follow may ruin any chance of successful recovery, or, vice versa, positively affect this process. Among the worst things you can do are:

  • Ignoring data loss and keeping using the storage device;
  • Creating, copying or deleting any files after data is lost;
  • Employing defragmentation or other system utilities;
  • Using a drive that has been showing the signs of upcoming failure;
  • Using a drive that is running out of space;
  • Performing “zero-out” formatting;
  • Using the TRIM function on your SSD;
  • Using file shredding or other data sanitization software;
  • Employing insecure data recovery utilities.

All in all, whether you use FAT or NTFS, with quality data recovery software there is a fair chance that you will manage to restore your precious files. However, it is crucial to keep in mind that the recovery operation is to be performed BEFORE the storage space gets overwritten with new data. Once your files are overwritten, nothing will help you to bring them back to life.

Advertisement

If you want to get a deeper insight into the mentioned file systems, please, refer to A Beginner-Friendly Guide to the FAT File System and The NTFS File System: Everything a Beginner Needs to Know.

Share This Story

Get our newsletter