Modern Algorithms for Recovering Deleted Data in User and Enterprise Systems

Abstract

In this article  analyze existing algorithms for recovery of deleted data in user and enterprise systems. Data loss — regardless of cause (unintentional deletion, software failure, clearing or formatting of storage media, malware activity) — can result in economic losses and undermine the reputation of organizations. The objective of the study is to provide a systematic review and comparative analysis of existing algorithmic approaches to resuspension of deleted file system objects in domestic and enterprise environments. This review takes into account the internal structure of the file system (cluster allocation tables, journaling mechanisms and metadata) and the specifics of different classes of storage media (conventional hard disk drive (HDD), solid-state drive (SSD) with various wear-leveling strategies, hybrid solutions etc.). Attention focuses on two fundamentally different methods: recovery based on analysis of file system artifacts (service records, indices and journals) and signature-based file carving aimed at searching the raw disk space for characteristic header and footer patterns of files. For each method a critical evaluation is performed according to several criteria: completeness of extraction, processing speed, robustness against fragmentation and false positives, as well as the impact of storage media characteristics (for example the operation of the TRIM command on SSD). Based on the identified limitations, hybrid algorithmic strategies are proposed, combining the responsiveness of service analysis with the depth of byte-level scanning — which allows achieving a balance between accuracy and efficiency.

The practical significance of the work is manifested in the formulation of specialized recommendations for information technology (IT) engineers, system administrators and software developers aimed at enhancing the reliability of data recovery procedures.