Before my power supply blew, I’d deleted a huge folder of pictures and subfolders of pictures to the Recycle Bin. After I retrieved my computer from the shop, the folder was emptied from the Bin. So, I performed 2 system restores, which I later found doesn’t restore files. Then, I downloaded data retrieving software which allowed me to look at my deleted data.
In deleted data, I can see my current folders in “pictures” and the files I deleted from them, and I can see one deleted folder from “pictures”. The one deleted folder is an earlier version of the huge folder the computer shop deleted, but not the exact folder they deleted.
It’s been exactly 5 days since I’ve had my computer back. Even if some of the pictures in it were overwritten, some still wouldn’t be, right? The software doesn’t list ANYTHING which was in that folder (or the folder itself) …and at least 400 pictures were in there.
Why can’t I see that folder, or other folders I’ve deleted from pictures? Why can I see only the earlier version?
Given the scenario you’ve described, I’d honestly be surprised if you found any pictures at all.
It’s easy to view undelete utilities a little too optimistically. We should be surprised when they work, not the other way around.
Let’s look at why your scenario is so problematic, and what steps I’d take in a last-ditch effort to retrieve your data.
Become a Patron of Ask Leo! and go ad-free!
- Stop using the drive.
- Undelete success relies on how Windows deletes files.
- A repair shop may have inadvertently overwritten the deleted files by performing routine maintenance.
- Try a couple of different undelete utilities.
- Start backing up.
First things first:
STOP USING THE DRIVE!
Every moment you continue to use the drive for anything unrelated to data recovery, you severely decrease your chances of success.
If it’s your only drive, that means even booting and running your machine will likely impact your ability to recover data. To maximize the chances for recovery, you should remove the drive and attach it to a different computer as a secondary or external drive until you’re done with the recovery process.
How undelete works
Undelete utilities work on the principle that so-called “deleted” data is not physically erased, but rather marked as “not used”. The data is still on the hard disk until it’s been overwritten by other activities.
For example, if you write to file B, and then erase file A, the contents of file A might still be available. On the other hand, if you erase file A and then write file B, A might not be available, because it might have been overwritten by file B.
That’s a gross oversimplification, but demonstrates the principle.
Repair shop operations
My first question is simply What else did that repair shop do?
Technically, there’s no reason for them to empty your Recycle Bin when replacing your power supply. Since they did, it makes me wonder what else they did. My guess is that they probably had good intentions, and performed some additional routine maintenance on the machine while they had it. They may have installed other software, or run diagnostics, or just generally “cleaned up” your machine for you.
Unfortunately, if they did anything that wrote to the hard disk, it’s likely that they did, in fact, overwrite the files that had been deleted.
In my oversimplified example of how undelete works, we had the implicit assumption that if you delete a file and then write a file, the write would naturally happen on top of the file just deleted. In reality, it’s not even close to that simple. Where data is written on a disk depends on many other factors, including, not surprisingly, the type of file system: NTFS, FAT32, or something else.
That’s why any disk activity puts your deleted data at risk of being unrecoverable. You simply don’t know what action might cause the disk to overwrite your data.
It’s also possible that defragmenting your hard disk would overwrite your deleted files. Defragmenting has the potential to write to your hard disk a lot, potentially overwriting all the deleted data and making it inaccessible to the recovery utilities. And defragging is something your computer shop might have done for you as part of that routine maintenance.
Because of the various ways files can be stored and the various ways things can be overwritten, there’s no single or “right” way to undelete. Particularly when files and folders have been partially overwritten, different tools use different techniques to scour the hard disk for possible file and folder fragments from which more files and fragments might be found.
And, of course, some tools are just better than others.
Years ago, I used GetDataBack from Runtime Software when I had an issue. It recovered about a third of the files I was looking for; the rest were lost.
My recommendation would be to try a couple of undelete utilities from different, reputable sources — particularly those with free trials — and see if they turn up anything more than you’ve already seen.
Learn a lesson
I’d be remiss if I didn’t harp on what is ultimately the only foolproof solution: prevention.
Had you backed up your data regularly, you wouldn’t be having this issue at all. You would simply restore the data you lost from your most recent backup and move on with your life.
Now would be a good time to invest in a good backup solution so as to avoid this issue in the future.
If you found this article helpful, I'm sure you'll also love Confident Computing! My weekly email newsletter is full of articles that help you solve problems, stay safe, and give you more confidence with technology. Subscribe now and I'll see you there soon,