Log in

View Full Version : recovering deleted items


Tobyjohno
18th Feb 2009, 03:58
Can you recover deleted items from windows that have been deleted.
These items have been deleted from the recycling bin.

Any help on this one would be much appreciated.

Jofm5
18th Feb 2009, 04:11
Assuming you have already checked the trash can on the desktop...

Recovery of deleted files all depends on a number of things.

Firstly, if the method of how the disk was formatted is important. If its FAT32 then you stand a good chance of recovery. If it is formated with NTFS then it is next to impossible.

To find out your file system type right click on the drive the files were on and select properties - the file system type will be displayed there.

As the space that those files occupied is now marked as free space you must not copy/save anything to the drive the files were on or you could overwrite some of the contents.

If the file system is FAT32 you can download some utility software from Software Download: Undelete Fat32 (http://www.sharewareconnection.com/titles/undelete-fat32.htm) to aid recovery.

Whilst some applications claim to be able to recover NTFS I would be dubious of this as NTFS has passed the US Governements C2 certifcation on security.

If those files are on an NTFS disk and you cant seem to recover then a specialist computer forensic company should be able to recover them - but that wont come cheap - it depends on how valuable those files are to you to persue to this level.

Finally, we cant have this discussion without mentioning regular backups - once you have been caught out once you can appreciate fully the requirement to back those files up that are important to you - just make sure you do it to a seperate drive to the one the original files were on in case of disk failure.

Good Luck

Cheers

Tobyjohno
18th Feb 2009, 04:41
Thanks

Thats awesome

Shunter
18th Feb 2009, 06:14
If it is formated with NTFS then it is next to impossibleSorry, but that's nonsense. It's perfectly possible and I've done it many times. NTFS is quite a limited filesystem, and doesn't have things like purge-on-delete or datashredding unlike more mature filesystems. The most important thing if you want to retain a good chance of recovery is to stop using the drive before the operating system decides to reuse the space vacated by the file deletion, then you're well and truly hosed.

Removing the drive and slaving it off another PC is the usual way to address such issues, and there are quite a number of products available. The GetDataBack products from Data Recovery Software - Hard Drive Recovery - RAID Data Recovery (http://www.runtime.org) are well regarded, and provide a demo version which will show you whether your particular files can be recovered. If they can, buy a license and recover them.

Tarq57
18th Feb 2009, 07:15
And the prize goes to #4.
It is surprisingly easy to recover deleted files, if they haven't been overwritten. The biggest problem, in my experience, is sorting through the HUGE list of files able to be recovered, to locate the ones you want.
Couple of programs that work quite well: Info about "recovery" (+link) by Brian Kato (http://www.aumha.org/a/recover.php), and Recuva, brought to you by the makers of (http://www.recuva.com/)Ccleaner. (http://www.piriform.com/ccleaner)
[edit] Oh, btw, they're both free. The former also contains a secure file shredder.