Hi,

I am no Expert here and have not gone through any serious forensic investigation of lost data. However I think I know some of the basics. So I am sorry for providing no solutions. However I have got a question:

Nihil said that the data is recoverable if all the clustes are cross related. Well, I am not sure but I think this is what the statement means:

Since the data is spread over the hard disk in fragments (in most of the cases), the files whioch actually act like a liner set of bytes split into smaller data units more like a linked list are spread all over the disk (randomly). This makes the pointer of each unit to point to the next cluster where the next chunk of data from the same file resides on the disk.

Is this what is meant by cross related?

One more question: I am not sure about the I/O faculty of the different OSes on earth but is there a chance that an OS will prefer to split a 10 MB file into small chuncks and place them in the GAPS created by deletion of files thus frangmenting the 10 MB file or should it prefer to place it on the disk where the 10 MB of space is free in series so that the file remains contiguous.