To recover deleted files you need to know as soon as possible that the file was erased and you need to recover it...
Recover deleted files? Yes and No, how is that for a Catch 22?
You can Undelete files if you are quick enough, that is you realize the mistake and use the tool before anything is written to the drive.
The easiest way with a Windows Operating System is to open the Recycle Bin, find your file and use the 'Restore' file option.
But what if you had deleted or someone else deleted the file some time ago and now you need it?
And you don't have a
Well recovering the file will depend on how full the drive is, if the MFT
(Master File Table) and the area on the hard drive were written to.
Note: This is where using the Windows Quick Format comes in handy. A Quick format only formats the first 20% or so of the drive (depending on the size) and then formats the drive as it fills up. The file system doesn't start filling in 'holes' where deleted files are located until the drive reaches
If your drive is quite full and it has been some time since the file was deleted the chance of
recover deleted files decreases to the point of not recoverable.
Add another hazard to a deleted file: Defragmenting the drive, this will
asuredly over write where the file was...
Before I get in to the tools you can use to recover
deleted files I will tell you that using a service such as Ontrack to
recover deleted files from a hard drive is very expensive, they go
by time not number of files recovered and the process is quite involved.
Sometimes they will want you to ship the drive to one of their facilities for
further testing/recovery options.
That would mean you would have to copy the data you have to another
drive/device then take it out of the computer and ship it to them. Their
advertised recovery rate is about 80% and they want most of the cost up front.
There is a small utility that comes with DOS [There he goes again about DOS - 'DOS is Dead'. Ummmm, not yet] called undelete.exe that comes with each version. With Windows
NT the undelete.exe was in the C:\Windows\Sysem32 directory until it was removed with Windows 2000.
Of course with with the DOS undelete.exe you will need DOS on bootable floppy, usb, or external hard drive (See
Self Computer Repair Unleashed 2nd Edition Manual for instructions on creating DOS boot devices.)
There are a lot of 'Free', Shareware, and pay for programs that will recover files some are pretty good some aren't. Some are easy to use (easy to use is a relative term when it comes to file systems by the way) some are so convoluted I just uninstall them and delete the source files.
Other than the old DOS undelete.exe, the GetDataBack (do a search for it), Recover from the Recycle Bin, and Ontrack are the only file recovery programs or services I have used
with success in my short 25+ career as a Computer Tech.
These programs search the MFT of the drive/directory/sub-directory you select for files that were deleted, then it will go to the area that the MFT points to for the deleted files.
The program will list all the files that were deleted, you then select the file/files you would like to recover.
Always select a different drive to write the recovered files to.
Once the program has recovered what it can of the file you can 'view the source' with some programs, others you will have to trust that the program recovered all or most of the file.
There is always a chance that all you will get is the file name and a few parts.
Before paying for a program or a service I would suggest you take the hard drive out of service until you can figure out what you need to do, this would lower the chance of someone or a program writing to the drive.
My first choice would be the old DOS undelete.exe because I know it works (personal preference here) and it is free.
If you have a reliable strategy for backing up your data then those options are not necessary, even Ontrack will ask you when you call them for help "What is your backup strategy?"
So to recap:
The odds of recovering a deleted file depend on two things:
- Time (how long the file has been deleted)
- Storage (was the drive written to before the deletion of the file was discovered?)
Your best bet is to have a data back up strategy that will backup your data to
a separate source not on your computer such as a network drive or an external
drive that you remove after the backup.
A word about backups: If you use a proprietary program to backup your data
you have to use that program to restore the data. Manual backups do not require
anything but a file system that can see the files.