Before my power supply blew, I’d deleted a huge folder of pictures and subfolders of pictures to the recycle bin. After I
retrieved my computer from the shop, the folder was emptied from the Bin. So, I performed 2 system restores, which I later found
doesn’t restore files. Then, I downloaded data retrieving software which allowed me to look at my deleted data.
In deleted data, I can see my current folders in “pictures” and the files I deleted from them, and I can see one deleted folder
from “pictures”. The one deleted folder is an earlier version of the huge folder the computer shop deleted, but not the exact
folder they deleted.
It’s been exactly 5 days since I’ve had my computer back. Even if some of the pictures in it were overwritten, some still wouldn’t
be, right? The software doesn’t list ANYTHING which was in that folder (or the folder itself) …and at least 400 pictures were in
there.
Why can’t I see that folder, or other folders I’ve deleted from pictures? Why can I see only the earlier version?
Given the scenario you’ve described, I’d honestly be surprised if you found any pictures at all.
In general, I think we view undelete utilities a little too optimistically. We should be surprised when they work, not the other
way around.
Let’s look at why your scenario, and scenarios like it, is so problematic, and what steps I’d take in a last ditch effort to
retrieve your data.
Become a Patron of Ask Leo! and go ad-free!
First things first:
STOP USING THE DRIVE
Every moment you continue to use the drive for anything that isn’t related to recovering your data, you severely decrease the
chances that you’ll be successful. And yes, if it’s your only drive that means even just booting and running your machine
will likely harm your ability to recover data. You should really remove the drive and place it in a different computer as the
secondary drive until you’re done with the recovery process.
•
Undelete utilities work on the principal that so-called “deleted” data is actually still on the hard disk, until it’s been
overwritten by other activities. So for example, if you write to file B, and then erase file A, the contents of file A might still be
available. On the other hand, if you erase file A and then write file B, A might not be available, because it might have been
overwritten by file B.
That’s a gross over simplification, but it demonstrates the principal. We’ll see in a moment that relying on that
simplification is a common mistake.
With all that out of the way, let’s look at why that recover tool might find nothing.
My first question is simply What else did that repair shop do?
There was no reason for them to empty your Recycle Bin when replacing your power supply. If they did that it makes me wonder
what else they did. If, for example, they emptied your Recycle Bin and then installed other software, or ran diagnostic utilities,
or did anything that wrote to the hard disk it’s likely that they did, in fact, overwrite the files that had been deleted.
It’s not unreasonable to think that they might have.
In my oversimplified example of how undelete might work, we had the implicit assumption that if you delete a file and then write
a file, the write would naturally happen on top of the file just deleted. In reality it’s nothing even close to being that simple,
and in fact depends on many other factors, including, not surprisingly, the type of filesystem. Files are placed on the hard disk
quite differently between NTFS and FAT32 filesystems, for example. They each have their technical reasons for choosing the approach
(older filesystems tend to favor simplicity, and the newer systems are more frequently optimized for access speed) but the
approaches are quite different.
That’s why any disk activity puts your deleted data at risk of being unrecoverable. You simply don’t know what action
might cause the disk write to happen that would overwrite your data.
Another scenario that we don’t often consider when it comes to undelete is defragmenting. Unless your hard disk is not very
fragmented to begin with, defragmenting is likely to write to your hard disk a lot – potentially overwriting all that deleted data,
making it inaccessible to the recovery utilities. And, come to think of it, defragging is something that your computer shop might
have done for you.
So, all in all, my hopes for your data recovery are actually pretty low.
But that’s not to say we should give up just yet.
One thing about undelete utilities is that there’s no “one way” to do it. Particularly when files and folders have been
partially overwritten, different tools use different techniques to to scour the hard disk for possible file and folder fragments
from which more files and fragments might be found.
And of course some tools are just better than others.
Now, aside from having used GetDataBack from Runtime Software for the one time I
had an issue myself (it recovered about 1/3rd of the files I was looking for, the rest were lost), I have no specific
recommendation for an undelete utility. Naturally a search for “Undelete
Files” turns up many, many options. I would try a couple from reputable sources, particularly those with free trials, and see if
they turn up anything more than you’ve already seen.
And finally, I’d be remiss if I didn’t harp on what is ultimately the only foolproof solution: prevention. Had you backed up
your data regularly, you wouldn’t be having this issue at all. Now would be a good time to invest in a good backup solution so as
to avoid this issue in the future.
Great article, Leo. Most people have *very* valuable data on their drives, but have absolutely no data protection plan in place. A perfect recipe for disaster, if there was one!
So, backup * regularly*, and also have a file recovery program installed on your PC at all times. The latter is important if you want to recover accidentally deleted files that were modified after the last backup. It is easier to recover such files without having to hunt for a solution after the deletion, and risk overwriting the file.
Regular backups + file recovery software = peace of mind + data protection.
Good Article Leo,
I’ve had to recover data a few times for my clients and usually its been a great success. The tools you can get are varied and i used GetDataBack on one occasion to good effect but its the amount of ‘passes’ over the data your fighting against. Far as i understand from an article i read on how to ‘destroy’ data, overwriting sectors (zero pass) as many times as possible is the best way to lose information
The software i usually use is R-studio, which i use more often then not with really good results, my experience with data recovery has usually been really good, even with things like head crashes on HDs, its a long process when theres a hardware fault but it recovers the good parts. Formatted disks have also been a part of the success.
I honestly think if you try hard enough with the right software, or use a professional firm, you could get your data back. Although as i work in a educational capacity; ive never been required to take such steps as a professional solution as the data lost has never been really significant, ive heard good things from other people who have had to recover essential info
This whole situation is very strange. Why this user first deleted the file, perhaps deliberately and perhaps not, and then wanted to retrieve the file is a mystery. Did this individual believe that the recycle bin is an appropriate place to store files? I have run across just that scenerio in the past.
Setting all of that aside there is a program called Easy Recovery Pro that might do the trick. I have used that program to recover data in my computer business for some time. Depends on the size of the hard drive, it could take two or more weeks before the recovery process is completed and there is no guarantee that all of the files will be recovered.
It is to be understood that when a computer goes into the shop there is no guarantee that data will not be lost.
This user might want to consider a good backup scenario. First and foremost for a backup to be considered useful there must be either two hard drives available in the system or the backup should be made to CDs or DVDs. Backing up to a partition on a single drive is worse than useless. Believing that you have a good backup and being wrong about that is actually worse than having no backup at all. A program that I have used for some years is called Acronis. I have looked diligently over the years and I have finally concluded that Acronis, if not the best is certainly near the top in terms of reliability and ease of use.
Even if the files on this drive have been overwritten does not necessarily imply that all or at least some of the files cannot be recovered. A single overwrite of a file frequently leaves that file available for recovery using appropriate software. The only way to truly erase files is to write the disk to zeros using a low level formatting utility.
This user should not give up on retrieving at least some of those files. There are companies that will retrieve the files however the cost can be very high. The files would have to be of considerable importance in order to make such a move a reasonable alternative.
As soon as you accidentally delete something, switch off. Then, if you can’t use hard drive as a slave, download (on another computer) the emergency boot CD (google EBCD) which is a live cd (doesn’t write on startup) and designed for things like that. As well as a lot of other hacks.
Why would you store valuable data in the recycle bin?
i cant open the MSN website can you pls help me with this problem i have////
hi,
great site and described very well for pc noobs like myself ( even tho am gutted files arn’t really recoverable ) thx for all the info tho and like u say prevention is the key :)