THIS MONTH THE DOCTOR TACKLES...

> Raw file recovery > Sub-100W GPUs > AI graphics upscale

Data recovery question

A friend recently switched from Mac to PC, and made the mistake of somehow wiping his drive because it wasn’t visible in Windows (as it had been formatted in Apple’s own APFS format). He compounded the error by creating a new Apple APFS volume over the top of the original partition in a misguided effort to undo his original mistake. I’ve run several drive-recovery tools, but while they’re able to see the drive’s previous content, none of the files appear to be recoverable, even though no new files have been written to the drive. Why is this so, and is all his data lost?

—Eric L Dumont

THE DOCTOR RESPONDS: This comes down to the fact that most of the files in question have become fragmented over time. When fragmented files are deleted, even though only the first few bytes of the file are overwritten to leave the file contents largely intact until the space is overwritten with other data, there’s no information in the file itself that records where the fragments reside.

That critical information is typically stored in the Master File Table (MFT), an area on the disk reserved for ensuring the OS can find not just where a file starts, but where it resides on the disk. This makes recovering deleted files from an existing partition a simple task, but when the partition is wiped, the MFT can be lost—this is certainly the case with older FAT/FAT32-formatted drives. NTFS backs up the MFT and stores these copies across the drive, making it easier to recover this information and improve the chances of recovering fragmented files.