Unallocated space analysis is one of the major principles of data recovery. Most modern recovery tools integrate the ability to analyze unallocated sectors in one way or another. Unlike the traditional data recovery approach based on looking up for deleted records in the file system, unallocated space analysis only uses the file system to determine which parts of the disk are currently unused by files, the file system and other system structures.
When recovering information from unallocated disk sectors, data recovery applications will perform some form of content-aware analysis, detecting the location of recoverable files by certain characteristics typical for each file format.
In order to perform unallocated space analysis, you will need a tool supporting the technology such as The Undelete. In order to engage unallocated space analysis, select “Comprehensive Recovery” mode (as opposed to “Quick Recovery”) from the Data Recovery Wizard. The tool will then analyze the file system, detect which disk sectors are not occupied with existing files, and attempt the recovery by scanning the available disk space.
PowerSearch
In data recovery tools sold by The Undelete, the PowerSearch algorithm is used to perform unallocated space analysis. PowerSearch uses characteristic signatures typical to certain file types (i.e. the “JFIF” signature for .jpeg files) in order to detect the beginning of a file, then analyses the file’s header in order to determine the file’s exact length.
Tools such as The Undelete employ PowerSearch to perform unallocated space analysis. However, PowerSearch can do more than just analyzing unused sectors. In tools such as HDD Recovery Pro, PowerSearch can be used to analyze the entire content of a volume or a physical device (e.g. a hard disk, pen drive or memory card), looking for missing data everywhere – even if no file system is available. PowerSearch allows recovering data from formatted and repartitioned disks with empty file systems, as well as devices that have damaged or corrupted file systems.
