What happens to deleted files?

What happens to deleted files?

 

I was recently asked by someone with an iPhone why, after doing a restore to their iPhone with the wrong iPhone backup, he is unable to recover the files that are now missing on his device.  After all, “that’s what the police and the FBI do”.

After all, “that’s what the police and the FBI do”.

 

When something on the device (or any storage) is deleted, the only thing that changes is that the filename is erased from the beginning of the file. The file called picture.jpg might be renamed **cture.xxx for example. That way the device knows to ignore that data. As more data is written, it will try to continue to write in the free space on the storage (space NOT PREVIOUSLY occupied by data). But once it runs out of that free space, it begins to use the space previously used by the deleted files. This is when the data is overwritten.  At that point, not only is the file marked for deletion, but portions of it become overwritten by other data.  When this starts to happen to any given file, it’s likely that you will not be able to use that file at all.  Even one bit of information (a single 1 or 0) missing from a file will make it unusable.  It’s important to understand that once you have deleted a file, you’ve told the operating system that the data is no longer important to you (obviously – you deleted it),  so it will make no special effort to preserve it.  It’s common for the device or computer not to overwrite the data until it needs it, but it wouldn’t necessarily avoid the action if software told it to write there specifically.  For this reason, if you need to recover files, it is important that you do it as soon as possible after you realize the files are missing.

it is important that you do it as soon as possible after you realize the files are missing.

In the case of a restore, this happens more quickly because the entire memory area is overwritten with the data from the backup.  In a restore, since it is restoring the entirety of the storage device, the entire area is overwritten at once.

That is why if you run data recovery, it will probably show files other than you are expecting. You are essentially looking at what your girlfriend’s storage was at the time of the backup, including her deleted files. A backup backs up everything and overwrites everything.