Facts and Myths
Data Recovery Facts and Myths
What is true about recovering deleted files, what is not and why honest recovery software measures instead of guessing. Written by CISSP, ISSAP and ISSMP certified forensic examiners.
Deleted files are often recoverable until their space is overwritten, so recovery is a race against the next write. But overwritten data is gone, no tool or lab brings it back and SSD recovery often fails because of TRIM. Honest recovery software reports candidates and rates them rather than promising everything.
Straight Answers
Six Data Recovery Myths, Corrected
Are deleted files gone forever?
Myth: deleting a file destroys it.
Usually not right away. On a traditional hard drive the data generally stays on the disk until something overwrites it, because deleting a file only marks its space as free in the file system. The file is recoverable until that space is reused, so recovery is a race against the next write.
Can any recovery tool get everything back?
Myth: a good tool gets it all back.
No. Recovery produces candidates, not guarantees. A file with no surviving signature is a guess, and one whose signature sits at no free location is most likely overwritten. A trustworthy tool measures and rates each candidate instead of promising a full recovery.
Can overwritten data be recovered with special, forensic or government tools?
Myth: overwritten data can be pulled back with the right tool.
No. Once data has been overwritten even once on a modern drive it is gone, and no lab, tool or magnetic-residue technique brings it back. The 35-pass Gutmann idea does not apply to modern drives. Honest tools report overwritten regions as unrecoverable.
Does SSD data recovery work like hard drive recovery?
Myth: an SSD recovers like a hard drive.
Often not. Solid-state drives use TRIM, which erases deleted blocks shortly after deletion, so deleted-file recovery from an SSD is frequently impossible. This is a real difference from a spinning hard drive, where deleted data usually persists until overwritten.
Should I keep using the computer while I decide what to do?
Myth: it is fine to keep working until you sort it out.
Stop. Every write can overwrite the data you are trying to recover, including a recovery tool saving files back onto the same drive, which is the single most common way people destroy their own data. Recover to a different drive.
Does a quick format or factory reset wipe everything?
Myth: a format or reset erases the data.
Usually not. A quick format or reset generally only clears the file table, so the data often remains recoverable. A full secure wipe or TRIM on an SSD is what actually destroys it.
Honest Recovery
Software That Measures, Not Guesses
Sherlock Forensics Recover is built on exactly these facts. It measures each candidate and rates it, it reports regions that are most likely overwritten as unrecoverable rather than offering them as intact, it is honest that SSD recovery often does not work and it will not let you save recovered files back onto the drive you are rescuing. It costs $295 one-time.
More: the data recovery overview or RAID data recovery if you lost an array.