Overwritten Data

Overview

Overwriting data means to replace the data that has previously been stored on a hard disk or any other drive with other data. It can be done accidentally or intentionally with a predestined pattern of meaningless data. Recovering overwritten data is not an easy job, and there is no guarantee that the data would be successfully recovered. Recovering data in this manner depends on many factors like the amount of data that has been rewritten and the period of last de-fragmentation performed on the drive.

Data is recorded in the form of a pattern of ones and zeros on any magnetic media. These patterns are then read and inferred as individual bits. 8 of these bits together make up a character or byte. For instance, ‘A’ in the binary form is represented as ‘01000001’. If suppose this data is overwritten with a pattern like ‘11111111’, then the read/write heads of the drive will read the new pattern only and the previously written data is considered to be deleted.

Can overwritten data be recovered?

If the head position system isn’t precise, the new data that will be written to the drive will not be written to the exact same location as the original data. As a result of this misalignment, traces of data can be identified from the previous magnetic patterns along with the current track. It is believed that the patterns of data, which have not been completely overwritten, can be read using an electron microscope. However, this is practically not possible.

There are 4096 bits in a single sector of 512 bytes and more than 200 thousand sectors on a 100 MB hard disk. This means that there are over 820 million bits of data to be read. If suppose data can be recovered at 1 bit per second then its take more than 25 years (9259 days) to recover a 100MB hard disk data which has never been overwritten. In case you attempt to recover the traces of data which has been written previously, most likely recover a maximum of 35 to 40 percent signals. However, this doesn’t mean that only 35-40 percent of the data will be retrieved, but that 35 to 40% of individual bits in each character will be restored.

Thus, it is claimed that from any drive 50% data can be successfully retrieved at the bit level. However, if the entire surface of the hard drive had been overwritten with 1s and 0s then most of the bits would not be correct and hence no data will be successfully retrieved. Therefore, complete error free recovery of overwritten data is not possible through existing laboratory technique or drive technology.

Retrieving Overwritten Data

If you want to retrieve previously written data from a reformatted or repartitioned drive, then there is a need to scavenge the entire drive for getting track of all possible data. Successful salvaging of good data is dependent on few things like condition of the FAT, MFT or Inode Tree, the quantity of the new data written on the drive, as well as on the last time the concerned drive was de-fragmented. If a drive has been freshly de-fragmented before the corrupted or crash, it may still have 95% working files. A drive which had never been de-fragmented before may have 95 percent corrupted files. In both cases, the scavenging procedure has to be carried out in order to retrieve any usable data.