TigerPaw's response was (as usual) first rate. The magnetic information on the disk is read and translated to digital form in the drive electronics on a standard disk. But if the platter is removed, and a different head, with different electronics, is used to read the tracks, then the analog information about previous write operations can usually be recovered. I worked with a military team who were able to recover 5 layers of data from a drive using this technique, kind of like uncovering the seven cities of troy... These techniques can usually recover even data that has been 'shredded' using commercial programs.
Standard formatting creates disk 'blocks' which are containers for 512 bytes of data (other block sizes are possible but 512 is standard for PC systems). Each block also contains address and checksum information so that if there are failures in the magnetic medium, the data can still be read by performing a mathematical operation on the readable data, then applying the error correction codes. Some systems have track level error correction. Some SCSI drives also automatically map 'bad blocks' to new good blocks, and the user never knows that a block has gone bad. CPQ uses this as a part of their pre-failure warranty - if the rate of generation of bad blocks is high, or the number of blocks is over a threshold, then cpq will replace the drive even though it is still fully functional, thus avoiding data loss.
When a file is deleted, the file itself is not changed - none of its blocks are altered in any way. Instead, directory information about the file is changed, to make the 'containers' available for new contents.
This is a complex and fascinating topic, if you are interested we can continue in more depth via PM. |
