Before my power supply blew, I’d deleted a huge folder of pictures and subfolders of pictures to the recycle bin. After I
retrieved my computer from the shop, the folder was emptied from the Bin. So, I performed 2 system restores, which I later found
doesn’t restore files. Then, I downloaded data retrieving software which allowed me to look at my deleted data.
In deleted data, I can see my current folders in “pictures” and the files I deleted from them, and I can see one deleted folder
from “pictures”. The one deleted folder is an earlier version of the huge folder the computer shop deleted, but not the exact
folder they deleted.
It’s been exactly 5 days since I’ve had my computer back. Even if some of the pictures in it were overwritten, some still wouldn’t
be, right? The software doesn’t list ANYTHING which was in that folder (or the folder itself) …and at least 400 pictures were in
Why can’t I see that folder, or other folders I’ve deleted from pictures? Why can I see only the earlier version?
Given the scenario you’ve described, I’d honestly be surprised if you found any pictures at all.
In general, I think we view undelete utilities a little too optimistically. We should be surprised when they work, not the other
Let’s look at why your scenario, and scenarios like it, is so problematic, and what steps I’d take in a last ditch effort to
retrieve your data.
Become a Patron of Ask Leo! and go ad-free!
First things first:
STOP USING THE DRIVE
Every moment you continue to use the drive for anything that isn’t related to recovering your data, you severely decrease the
chances that you’ll be successful. And yes, if it’s your only drive that means even just booting and running your machine
will likely harm your ability to recover data. You should really remove the drive and place it in a different computer as the
secondary drive until you’re done with the recovery process.
Undelete utilities work on the principal that so-called “deleted” data is actually still on the hard disk, until it’s been
overwritten by other activities. So for example, if you write to file B, and then erase file A, the contents of file A might still be
available. On the other hand, if you erase file A and then write file B, A might not be available, because it might have been
overwritten by file B.
That’s a gross over simplification, but it demonstrates the principal. We’ll see in a moment that relying on that
simplification is a common mistake.
With all that out of the way, let’s look at why that recover tool might find nothing.
My first question is simply What else did that repair shop do?
There was no reason for them to empty your Recycle Bin when replacing your power supply. If they did that it makes me wonder
what else they did. If, for example, they emptied your Recycle Bin and then installed other software, or ran diagnostic utilities,
or did anything that wrote to the hard disk it’s likely that they did, in fact, overwrite the files that had been deleted.
It’s not unreasonable to think that they might have.
In my oversimplified example of how undelete might work, we had the implicit assumption that if you delete a file and then write
a file, the write would naturally happen on top of the file just deleted. In reality it’s nothing even close to being that simple,
and in fact depends on many other factors, including, not surprisingly, the type of filesystem. Files are placed on the hard disk
quite differently between NTFS and FAT32 filesystems, for example. They each have their technical reasons for choosing the approach
(older filesystems tend to favor simplicity, and the newer systems are more frequently optimized for access speed) but the
approaches are quite different.
That’s why any disk activity puts your deleted data at risk of being unrecoverable. You simply don’t know what action
might cause the disk write to happen that would overwrite your data.
Another scenario that we don’t often consider when it comes to undelete is defragmenting. Unless your hard disk is not very
fragmented to begin with, defragmenting is likely to write to your hard disk a lot – potentially overwriting all that deleted data,
making it inaccessible to the recovery utilities. And, come to think of it, defragging is something that your computer shop might
have done for you.
So, all in all, my hopes for your data recovery are actually pretty low.
But that’s not to say we should give up just yet.
One thing about undelete utilities is that there’s no “one way” to do it. Particularly when files and folders have been
partially overwritten, different tools use different techniques to to scour the hard disk for possible file and folder fragments
from which more files and fragments might be found.
And of course some tools are just better than others.
Now, aside from having used GetDataBack from Runtime Software for the one time I
had an issue myself (it recovered about 1/3rd of the files I was looking for, the rest were lost), I have no specific
recommendation for an undelete utility. Naturally a search for “Undelete
Files” turns up many, many options. I would try a couple from reputable sources, particularly those with free trials, and see if
they turn up anything more than you’ve already seen.
And finally, I’d be remiss if I didn’t harp on what is ultimately the only foolproof solution: prevention. Had you backed up
your data regularly, you wouldn’t be having this issue at all. Now would be a good time to invest in a good backup solution so as
to avoid this issue in the future.