Recuva: a Free, Easy Undelete and File Recovery Tool

I keep a small collection of useful tools for various system-maintenance and troubleshooting tasks.

For the longest time, I didn’t have a file undelete utility — not because there aren’t good ones, but because I never really got comfortable with any of the ones I tried. I just wasn’t comfortable recommending any.

Then I discovered Recuva. It’s free, easy to use, from the same people that bring you CCleaner, and it’s what I use myself when the need arises.

Deleting files 101

Normally, when you delete a file in Windows File Explorer, it isn’t really deleted, but moved to the Recycle Bin.1 In most other cases, Windows “permanently” deletes the file.

When you permanently delete a file, the contents of that file are not necessarily lost. Instead, the space it previously occupied on the hard drive is marked as “free”, making it available for use the next time data is written to the disk. Only when that happens are the previous contents of that space — the file you “permanently” deleted — overwritten.

As long as that doesn’t happen, there’s a chance you can recover the file.

Unfortunately, it’s rarely black and white. For example, if you delete a large file, and then write a small file, only portions of the large file might be overwritten. While you can no longer recover the entire deleted file, you may be able recover part of it. When you delete folders, things get even more complex, because it’s the information kept by the folder that identifies just where all those files and parts of files are.

This is where Recuva comes in. It scans the space marked as “free”, as well as the overhead information on the hard disk, to identify files or parts of files that might be recoverable and allows you to do so.

Using Recuva

By default, Recuva starts with a Wizard.

Click Next, and you’ll be asked what file types Recuva should look for.

If you know what type of file you’re looking for, you can select it here, or just leave the default as “All Files”. Click Next, and you’ll be asked which disks or folders Recuva should scan.

If you know where to look, select it; otherwise, leave the default as “I’m not sure” to let Recuva look everywhere. Click Next, and Recuva will confirm that it’s ready to start looking for whatever it might be able to recover.

The option “Enable Deep Scan” can be left unchecked initially. File recovery can be very complex, but Recuva’s initial pass (without Deep Scan enabled) looks for the most common ways files can be successfully recovered. As the text in the message indicates, if you can’t find what you’re looking for quickly, you can return and select “Enable Deep Scan” for a more thorough but time-consuming attempt.

Click Start and the scan begins.

After some time, Recuva will present you with a list of what it has found.

There’s a lot of information here, but the single most important — besides the filename and path that identifies the file you’re examining — is the red/amber/green indicator at the beginning of each.

• Green: file can likely be completely recovered.
• Amber: file may be recovered, but is likely to have damage or be only partially recoverable.
• Red: file is unlikely to be recoverable.

There’s still uncertainty in each of those options, simply because the disk is probably still in use and file systems are complex.

Be sure to scroll the list horizontally; you’ll find additional useful columns of information.

Recovering a file

To attempt to recover a file, check the box in front of file you want in the list, and click on Recover. You’ll then be asked for a destination to which the recovered file should be placed.

Ideally, that destination would be on a different drive. Since any writing to the disk being examined has the potential to overwrite the very data we’re attempting to recover, it’s best to write elsewhere if you can. If you can’t, you’ll be warned.

Recuva will then recover the file or files and present a message.2

When do you need to “Recuva”?

There are several scenarios where Recuva is useful. The two most common are:

• Accidentally deleting a file permanently, and not having a backup some other way. If a file is deleted into the Recycle Bin, look there first, of course. If you can restore it from there, you don’t need Recuva. If you can restore the file from a backup, you don’t need Recuva. But if the only copy of a file was permanently deleted — explicitly or otherwise — or it’s just missing, scanning with Recuva can sometimes locate and recover the file before it’s overwritten.
• Disk corruption. Sometimes, when a disk fails or software crashes, files go missing. Running CHKDSK can fix underlying problems, but can also cause “collateral damage” in the form of missing files. Recuva can scan for what might still be salvageable.

There are two additional scenarios worth being aware of.

• It’s rare, but thieves can use utilities like Recuva to recover files you’ve deleted. The only prevention is to use some form of secure delete or free space wipe regularly.
• Computer forensics is frequently all about data recovery, and knowledgeable law enforcement staff sometimes use Recuva, or similar tools, to recover information thought to be deleted.

Don’t delay

The moment you believe you might need to recover a file using Recuva, stop using that computer, or at least use it as little as is possible.

The problem is a simple one: the more you write to the disk, the more deleted information will be overwritten, lowering the chances of recovering deleted or damaged files. Even leaving the machine running idle can still cause problems, as Windows itself also frequently writes to the hard disk. Unfortunately, rebooting is even worse.

The best advice I can offer is to install Recuva before you need it, and use it without delay when you need to recover something.

For that all-too-common-case of trying to recover a deleted file, Recuva is now my choice.

Podcast audio

Download (right-click, Save-As) (Duration: 6:59 — 3.3MB)

Subscribe: RSS

I recommend it.