When you delete a file or folder from the drive it only removes the pointer to the file from the master file table (MFT) in use. The data is still there in the same place. There are a few options for recovering these files.
scan the drive bit by bit and look for data that looks like a file, most files have header and/or footer data that mark the beginning and/or end of a file. This can be used identify the file and to recreate the pointer to the file.
Many filesystems use a master file table (or equivalent) as well as a backup file table in case the first is somehow corrupted. You can force the use of the backup to access the files in question.
1 is slow and 2 doesn't always work as the master and backup are mostly kept in sync. Both of these methods can be thwarted but that takes time and the knowledge that file recovery is a thing.
These are not the only options but, many of the others are much more difficult and thus expensive. These methods can sometimes recover data that has been "shredded" or overwritten to hide the data that was in that location depending on the method of recovery and the method of the shredding.
He was saying that whatever they come up with will still be bullshit. It's all media propaganda that will inevitably tell us that we were wrong.
I don't think he was arguing anything about the recovery process.
Yeah, it's moot. Either way ain't nobody going to do shit. I was just unsure what the argument was about so I picked the technical side as I usually do.
Thanks! Patriot!
(post is archived)