Start-Up Data Recovery and the HFS+ filesystem
Data recovery start-up is answer to a student nightmare | Money | The Guardian.
Given how competitive and well developed the data recovery market is, with many DR companies offering a discount for students, the addition of such a company does not seem to be the left-field supplement to the industry that the Guardian writer might think it is.
Regarding their quote:
“Deleting a file doesn’t mean it’s actually deleted. Whether you’re using a Mac or Windows, your operating system keeps a record of where your files are stored. When you delete a file, your operating system purposefully forgets where that file is located, but in fact the contents remain stored.”
My comment to this would be both “Yes & No”. Dealing with deleted data from a PC based NTFS filesystem and a Mac-based HFS+ filesystem are altogether different beasts. NTFS being a rather tame one, HFS+ being all the more fearsome. That is, trying to recover deleted data from an HFS+ partition, still with its original folder structure and file names, is extremely challenging and in most ‘real life’ situations not possible as the owner of the computer will have often used the computer for many minutes/hours after the deletion.
The difficulty with recovering deleted data on Apple Mac hard disk drives is because a file deletion action on an HFS+ volume wipes data from B-Tree metadata records for the file and updates map of free space. The file name, size and on-disk position are wiped (however file system journal still may contain this information that allows recovering good files). Compare this with a PC based NTFS filesystem where a deletion of a file with result in the Master File Table record marked as ‘unused’. The bitmap of used space is updated to release used clusters for new data to be written to the physical area of the HDD. The file entry is deleted from directory record. The file name, size and on-disk position remain inside of Master File Table record so file recovery chances are near 100%.
Let’s hope that when the students delete their coursework and send the data to Zibit DataLab that they have done it on a Windows-based PC and not a Mac.