Get a FREE fully-working copy of Steganos Security Suite 7 (worth £49.99) when you sign up to the Practical PC Newsletter. Restoring Deleted Files - Part 2
Kai Chandler delves into restoring deleted files - Part Two
In Part One of this series of three articles on restoring deleted files, we looked at the Recycle Bin and how to restore deleted files held there.
In this part, we focus on recovering deleted files even after they've been removed from the Recycle Bin.
To maximise the chance of a successful recovery you need to stop all disk activity on your system without shutting the system down.
' Don't defragment your system until lost files are recovered.
' Close all applications including e-mail and Web browsing software
You may think that emptying the Recycle Bin will delete the files but it doesn't. It just marks the disk space as free so the files will eventually be overwritten.
This means that it should be possible to restore a deleted file even after the Recycle Bin has been emptied. Also, files deleted without being saved to the Recycle Bin can potentially be restored.
It's possible to bypass the Recycle Bin when deleting files if, for example, they were deleted by:
- holding down the shift key while deleting the file
- using the command prompt
- deleting via the Command Prompt
- removing a directory
- removing by an uninstall process, etc.
Deleted files at risk
Any deleted files not in the Recycle Bin are at risk of being overwritten by Windows when it saves new temporary and permanent files. A disk defragmentation run is also very likely to overwrite deleted files.
Recovering deleted files
Windows XP doesn't have a tool for recovering deleted files so you need to look at third party utility programs.
Products such as these are best installed before you need to restore a deleted file. This is because there is a chance that installing the product may overwrite the sectors containing part of the file to be restored. Alternatively, you can install the product on another system and move the affected hard disk as a second drive to that system.
After some searching, we've come up with two that may fit the bill.
File Restore
File Restore from www.winternals.com $39 to download
Fast File Undelete
Fast File Undelete from http://www.dtidata.com $39 to download
In tests, using an NTFS drive running under Windows XP, File Restore found 3037 deleted files, while Fast File Undelete found 6005 deleted files although in both cases not all of these files could be restored. Conversely, File Restore has a clearer user interface and installs in a more consistent manner. Note that Fast File Undelete can be run from a floppy disk so no potentially damaging installation is required.
Both run under Windows XP, 2000, NT4, Me, and 98 and support FAT, FAT32 and NTFS formats.
To sum up, both products are available at a low cost and are ideally installed before you lose that critical file.
