DATA SECURITY

Mike Bedford investigates recovering files from damaged disks and how to make sure that what you delete is gone for good.

I ncreasingly, one of the most valuable commodities is information. But this isn’t just for big business – most of us have data that is valuable in one way or another. So, preserving that data is important, because the consequences of failing to do so can range from inconvenience to financial hardship. And as we’re all well aware, there can also be severe consequences if our data falls into the wrong hands. Here we address the two inter-related themes of data recovery following accidental deletion or hard disk failure, and secure deletion so that, when you do delete data, nobody else can recover it. Mostly we’re considering traditional magnetic hard disks, but we also look at the different challenges that apply to SSDs (see Solid-State Drives boxout below).

Check your bin!

Sometimes the obvious gets overlooked; that obvious measure is to restore the file from the Rubbish Bin (Trash if the language is set to American English), the special folder that stores files that have been deleted. Do bear it in mind. After all, magically restoring your friend’s files might just promote you to hero status. If you deleted a file using the rm (remove) command in the terminal, that file will have been genuinely deleted, as opposed to being dispatched to the Rubbish Bin, so the trivially simple method of recovering the file won’t work. If the file was deleted in the file manager – as will almost certainly be the case with your non-technically minded friend – there’s a good chance it’s residing in the Rubbish Bin. Certainly, that is what happens if you select a file and hit the Delete key, although Shift+ Delete bypasses the Rubbish Bin. It’s also possible, permissions depending, to delete a file or send it to the Rubbish Bin by selecting the appropriate option having right-clicked on a file.

So how do you recover ‘permanently’ deleted files? We put that word in quotes because, although it’s often thought of as such, files can still often be recovered. That’s because, when a file is deleted, the data it contained isn’t actually deleted – in the sense of it being overwritten with zeros or ones – but, instead, the reference to the file in the filesystem is marked as deleted, with the result that the space it occupied on the disk becomes available for reuse. Sounds like deleted files ought to be recoverable, therefore, and while that is often true, some guidance is called for.

Here we’re going to consider the worst case scenario of not noticing immediately that you’ve used the rm command inadvisably. If you do notice immediately, though, other options might be available to you if the file is still open in some application. We’re going to be looking at some tools that enable you to recover deleted files, but first we have some important advice. Remember that deleting a file makes the space it occupied available for reuse. If your disk is large enough, and has enough free space, it’s quite possible that the data in your deleted file will remain untouched for a considerable time, but there are no guarantees, so avoid saving files to disk. This includes installing new software, of course, so do make sure you have the necessary tools for undeletion installed on your PC before you need them, although several such tools are pre-installed on some distros. Remember also that background processes can write to disk, so if you just avoid saving files yourself, you might still lose any chance of recovery. The safest thing to do, therefore, is to close down your system as soon as you notice your error and then start it from a bootable CD or USB drive to attempt recovery. Needless to say, this means you need to be prepared. You could do worse than using the Ultimate Boot CD (www.ultimatebootcd.com), which is available as a download in ISO format and, in addition to the operating system, has diagnostic and data recovery tools already installed.