A file comes in two parts: the actual blocks of data that hold the file itself, and a directory entry with the name of the file, and the location of the first block.

When you delete a file, it only scrubs out the directory entry, and re-lists the data blocks as available for use.

Often times when you delete something off a computer, the computer simply deletes the address of the data, but doesn’t overwrite the data.

Think of a map for a city. If you delete a house off the map, you may not be able to find it anymore, but the house is still there. It’s the same for computer storage

Because as long as it isn’t overwritten it can sometimes reside in a residual way in the storage sectors on the drive, these hdd scanning software’s check through the sectors for data hiding in them some sucxessfully some not as successfully, there for some will find more or less data than others do as well.

This is why data disappears on drives as well when a physical issue causes the sectors of the drive to begin to stop working aka “bad sectors” this makes the data start to seemingly magically vanish or corrupt if it’s still operating and booting into Windows you can at times witness the data/folders and or files present in folders one moment and missing fron the OS the next, that’s an indictator often of an imminent drive failure due to bad sectors. In this scenario it get’s less likely you’ll recover the data the longer the drive is in use because more of the sectors will probably die. You want to be doing the recovery and not using the drive in Windows in this instance. I say Windows but it applies to any HDD with any OS installed really.

Because of how filesystems work. There’s basically an index that tells the OS what files are stored where on the disk. The quickest way of deletion simply removes the entry in that table. The data is still there, though. So a data recovery program would read the entire disk and try to rebuild the file allocation table or whatever by detecting the beginning and ends of files. This worked better on mechanical drives than SSDs.

On ext4 drives 5% is reserved for the system in emergencies. Since disks are getting larger over the year, 5% is a pretty big chunk. It’s possible to tell the system to use a lower reserve. It’s the only instance I know where you can seemingly gain more storage out of thin air. I’ve used it in moments of emergencies when a servers’ disk was too full to function.

it’s inefficient to really erase the data, so what happens usually is: it gets marked as deleted. the data only gets overwritten when another file is written in the same data area, which often doesn’t happen immediately. even if a drive gets formatted the empty metadata structures of the new partitions and file systems are just written on top. since they have no file entries yet, the previous data just sits there invisible and inaccessible until new files are created and maybe overwrite a bit of the old data.

IIRC: Data has not been overwritten yet; it is just shown to be open to being rewritten.

It can still be recovered with minimal corruption if the device was not used too much, where open storage would be eriten over.