Home

How it works

DiskDigger has two modes of operation which you can select every time you scan a disk. These modes are called "dig deep" and "dig deeper."

Digging deep

The "dig deep" mode makes DiskDigger "undelete" files from the file system on your disk. Under most file systems, when you delete a file, it doesn't actually get wiped clean from the disk. Instead, the file system will simply mark the file as deleted, and no longer show you the file when you browse the contents of the disk. DiskDigger scans the file system for such deleted files, exposes them to you, and allows you to bring them back as ordinary files again.

However, this kind of process has several limitations. Firstly, DiskDigger has to be "aware" of what file system is present on the disk. Therefore, it only supports certain types of file systems:

  • FAT — Used on floppy disks (FAT12), most USB flash drives and memory cards under 4 gigabytes, and older hard disks (FAT16).
  • FAT32 — Used on slightly older hard disks and most USB flash drives and memory cards with 4 gigabytes or greater.
  • NTFS — Used on most modern hard disks.
  • exFAT — Used on some modern hard disks and high-capacity memory cards and USB drives.

Fortunately, the above list of file systems covers the vast majority of the world's users, so this limitation is trivial compared to the next one.

After a file is deleted, the file system is completely free to overwrite the contents of the deleted file with new data. From the point of view of the file system, the deleted file is now as good as free space, ready for the taking. The next file that is saved by the file system may just be written on top of the deleted one. If that happens, the deleted file will truly be lost forever.

So, a general rule would be something like this: The undelete process is effective only for files that have been deleted very recently. Or, more precisely: The probability of successfully recovering a file is inversely proportional to the amount of time elapsed after deleting it.

Digging deeper

The "dig deeper" mode causes DiskDigger to become a powerful data carver, and carve out whatever files it can find on the disk, independent of the file system.  Data carving refers to physically scanning every single sector on the disk, and looking for traces of known file types.

This mode also has some advantages and disadvantages. The main advantage is that it's independent of the file system that's on the disk, so the disk can be formatted as FAT, NTFS, HFS, ext2, or anything else; it doesn't matter. DiskDigger scans "underneath" the file system, which gives it an additional advantage of being able to scan any free space on the disk outside of the file system, which the "dig deep" mode cannot do.

The main disadvantage of digging deeper is the time it takes to complete the scan. If you're scanning a memory card or USB drive, it shouldn't be too bad, but if you're scanning an entire hard drive, be prepared for a several-hour job.  Of course the burden of the time spent on the scan is subjective, and depends on the value of the files you're trying to recover.

Another disadvantage of this mode is that only a limited number of file types can be recovered. Since we're not aware of the file system, we have no way of knowing what types of files are present, so the only thing we have to go on are the actual bytes that we see on the disk. This means that DiskDigger has to be aware of the structure of the types of files we need to recover, and search for patterns of bytes specific to each file format.  Fortunately, DiskDigger supports a fairly wide variety of file types which should cover most cases.

The only other disadvantage of this approach is that it's not possible to recover files that have been fragmented by the file system. Since it's not aware of the file system, DiskDigger has no way of knowing whether or not a certain file has been fragmented.  So, technically, when digging deeper, DiskDigger will only recover the first fragment of a file. Most files consist of a single fragment anyway, but in some cases, the file system will choose to split a file into two or more fragments. A rule of thumb is:  the larger a file is, the more likely it is that it's been fragmented.