Before my power supply blew, I’d deleted a huge folder of pictures and subfolders of pictures to the Recycle Bin. After I retrieved my computer from the shop, the folder was emptied from the Bin. So, I performed 2 system restores, which I later found doesn’t restore files. Then, I downloaded data retrieving software which allowed me to look at my deleted data.
In deleted data, I can see my current folders in “pictures” and the files I deleted from them, and I can see one deleted folder from “pictures”. The one deleted folder is an earlier version of the huge folder the computer shop deleted, but not the exact folder they deleted.
It’s been exactly 5 days since I’ve had my computer back. Even if some of the pictures in it were overwritten, some still wouldn’t be, right? The software doesn’t list ANYTHING which was in that folder (or the folder itself) …and at least 400 pictures were in there.
Why can’t I see that folder, or other folders I’ve deleted from pictures? Why can I see only the earlier version?
Given the scenario you’ve described, I’d honestly be surprised if you found any pictures at all.
It’s easy to view undelete utilities a little too optimistically. We should be surprised when they work, not the other way around.
Let’s look at why your scenario is so problematic, and what steps I’d take in a last-ditch effort to retrieve your data.
Become a Patron of Ask Leo! and go ad-free!
- Stop using the drive.
- Undelete success relies on how Windows deletes files.
- A repair shop may have inadvertently overwritten the deleted files by performing routine maintenance.
- Try a couple of different undelete utilities.
- Start backing up.
Stop!
First things first:
STOP USING THE DRIVE!
Every moment you continue to use the drive for anything unrelated to data recovery, you severely decrease your chances of success.
If it’s your only drive, that means even booting and running your machine will likely impact your ability to recover data. To maximize the chances for recovery, you should remove the drive and attach it to a different computer as a secondary or external drive until you’re done with the recovery process.
How undelete works
Undelete utilities work on the principle that so-called “deleted” data is not physically erased, but rather marked as “not used”. The data is still on the hard disk until it’s been overwritten by other activities.
For example, if you write to file B, and then erase file A, the contents of file A might still be available. On the other hand, if you erase file A and then write file B, A might not be available, because it might have been overwritten by file B.
That’s a gross oversimplification, but demonstrates the principle.
Repair shop operations
My first question is simply What else did that repair shop do?
Technically, there’s no reason for them to empty your Recycle Bin when replacing your power supply. Since they did, it makes me wonder what else they did. My guess is that they probably had good intentions, and performed some additional routine maintenance on the machine while they had it. They may have installed other software, or run diagnostics, or just generally “cleaned up” your machine for you.
Unfortunately, if they did anything that wrote to the hard disk, it’s likely that they did, in fact, overwrite the files that had been deleted.
In my oversimplified example of how undelete works, we had the implicit assumption that if you delete a file and then write a file, the write would naturally happen on top of the file just deleted. In reality, it’s not even close to that simple. Where data is written on a disk depends on many other factors, including, not surprisingly, the type of file system: NTFS, FAT32, or something else.
That’s why any disk activity puts your deleted data at risk of being unrecoverable. You simply don’t know what action might cause the disk to overwrite your data.
It’s also possible that defragmenting your hard disk would overwrite your deleted files. Defragmenting has the potential to write to your hard disk a lot, potentially overwriting all the deleted data and making it inaccessible to the recovery utilities. And defragging is something your computer shop might have done for you as part of that routine maintenance.
Undelete utilities
Because of the various ways files can be stored and the various ways things can be overwritten, there’s no single or “right” way to undelete. Particularly when files and folders have been partially overwritten, different tools use different techniques to scour the hard disk for possible file and folder fragments from which more files and fragments might be found.
And, of course, some tools are just better than others.
Years ago, I used GetDataBack from Runtime Software when I had an issue. It recovered about a third of the files I was looking for; the rest were lost.
I also regularly recommend Recuva, from the folks who make CCleaner. I’ve used it on occasion and have had some luck getting files back.
My recommendation would be to try a couple of undelete utilities from different, reputable sources — particularly those with free trials — and see if they turn up anything more than you’ve already seen.
Learn a lesson
I’d be remiss if I didn’t harp on what is ultimately the only foolproof solution: prevention.
Had you backed up your data regularly, you wouldn’t be having this issue at all. You would simply restore the data you lost from your most recent backup and move on with your life.
Now would be a good time to invest in a good backup solution so as to avoid this issue in the future.
Do this
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
I'll see you there!
Great article, Leo. Most people have *very* valuable data on their drives, but have absolutely no data protection plan in place. A perfect recipe for disaster, if there was one!
So, backup * regularly*, and also have a file recovery program installed on your PC at all times. The latter is important if you want to recover accidentally deleted files that were modified after the last backup. It is easier to recover such files without having to hunt for a solution after the deletion, and risk overwriting the file.
Regular backups + file recovery software = peace of mind + data protection.
Good Article Leo,
I’ve had to recover data a few times for my clients and usually its been a great success. The tools you can get are varied and i used GetDataBack on one occasion to good effect but its the amount of ‘passes’ over the data your fighting against. Far as i understand from an article i read on how to ‘destroy’ data, overwriting sectors (zero pass) as many times as possible is the best way to lose information
The software i usually use is R-studio, which i use more often then not with really good results, my experience with data recovery has usually been really good, even with things like head crashes on HDs, its a long process when theres a hardware fault but it recovers the good parts. Formatted disks have also been a part of the success.
I honestly think if you try hard enough with the right software, or use a professional firm, you could get your data back. Although as i work in a educational capacity; ive never been required to take such steps as a professional solution as the data lost has never been really significant, ive heard good things from other people who have had to recover essential info
This whole situation is very strange. Why this user first deleted the file, perhaps deliberately and perhaps not, and then wanted to retrieve the file is a mystery. Did this individual believe that the recycle bin is an appropriate place to store files? I have run across just that scenerio in the past.
Setting all of that aside there is a program called Easy Recovery Pro that might do the trick. I have used that program to recover data in my computer business for some time. Depends on the size of the hard drive, it could take two or more weeks before the recovery process is completed and there is no guarantee that all of the files will be recovered.
It is to be understood that when a computer goes into the shop there is no guarantee that data will not be lost.
This user might want to consider a good backup scenario. First and foremost for a backup to be considered useful there must be either two hard drives available in the system or the backup should be made to CDs or DVDs. Backing up to a partition on a single drive is worse than useless. Believing that you have a good backup and being wrong about that is actually worse than having no backup at all. A program that I have used for some years is called Acronis. I have looked diligently over the years and I have finally concluded that Acronis, if not the best is certainly near the top in terms of reliability and ease of use.
Even if the files on this drive have been overwritten does not necessarily imply that all or at least some of the files cannot be recovered. A single overwrite of a file frequently leaves that file available for recovery using appropriate software. The only way to truly erase files is to write the disk to zeros using a low level formatting utility.
This user should not give up on retrieving at least some of those files. There are companies that will retrieve the files however the cost can be very high. The files would have to be of considerable importance in order to make such a move a reasonable alternative.
As soon as you accidentally delete something, switch off. Then, if you can’t use hard drive as a slave, download (on another computer) the emergency boot CD (google EBCD) which is a live cd (doesn’t write on startup) and designed for things like that. As well as a lot of other hacks.
Why would you store valuable data in the recycle bin?
I don’t have a big enough font to type “EXACTLY!” the way I want.
Believe it or not, comments on Ask Leo! do allow you to use some html tags so you can make text bold, italics, or larger etc.
hi,
great site and described very well for pc noobs like myself ( even tho am gutted files arn’t really recoverable ) thx for all the info tho and like u say prevention is the key :)
“To maximize the chances for recovery, you should remove the drive and attach it to a different computer as a secondary or external drive until you’re done with the recovery process.”
For the average user who might find it difficult to remove the hard drive from a laptop, it might be practical to boot up from a Linux and use a file recovery tool.
In my experience if the average user is uncomfortable with removing a drive, they’ll likely also be uncomfortable dealing with Linux. Obviously not 100% of the time, but in general. Folks that fall into this camp (or these camps) should probably get a geeky friend to help.
If drive in laptop is SSD then you have no hope of ever recovering them. Unlike on magnetic HDDs, files on SSD cease to exit when you delete them.
Not the case. The deletion process follows the same rules as on an HDD. The difference with an SSD is that a one pass wipe should most likely render the files unrecoverable to forensic recovery methods.
I just ran Recuva on my system SSD to try it out and it found over 140,000 “permanently” deleted files and I successfully recovered one to test it out.
As you mentioned, the shop might have run some maintenance or cleanup software. One thing I saw happen once which might have caused the recycle bin to be emptied. A friend brought her computer to a shop for a repair and when I saw the invoice, it listed running CCleaner with no charge. Some technicians think they are doing you a favor by cleaning up your machine for free. Let that be a lesson to computer technicians. I often have to fight the temptation to be helpful and not do more than I should as it might have unintended consequences.
I would agree with Leo’s sentiment that we should be surprised when they work. My kids share a tablet. While on vacation, my daughter realized that most of the pictures taken on vacation were “missing.” It didn’t take long for me to realize that someone accidentally deleted them. My daughter was greatly upset. Since we had put in an SD card to save data, I popped it out and put it in my laptop. Still no luck and seeing the files, so pretty much confirming the deletion. Not wanting to deal with my crying daughter, I tried Leo’s recommendation and tried Recuva. It’s an Android tablet. It’s an SD card. What’s the chance that running a Windows program is going to find anything.
Gave it a try and to my surprise, it found a lot of photos. No my daughter didn’t get every picture back. In fact some of the most recent it couldn’t recover, but some of the oldest ones it could. But she was much happier that she didn’t lose anything.
The reason that Recuva could recover the files is because Android tablets use a form of the Windows compatible file system, FAT for SD storage. In the future, you might want to install Dropbox on the tablet and have it automatically upload copies of all of you photos taken with the tablet or phone.
I’ve used Recuva upon occasion but when the need arises I tend to use ‘PhotoRec’ depending upon what needs recovering.
Peoples should be aware that installing any recovery application to the drive containing the data to recover have a very high chance of destroying the data that you want to recover, or at least, part of it.
Yes, any time you want to recover any data from any drive or support, that drive/support must remain unused by any mean available.