Home› PC & Mac Hardware and Software
Click here to check out Digital Spy's Tech section for the latest news, updates, reviews and cheap deals.

Recovering Deleted Files

steven123steven123 Posts: 3,245
Forum Member
✭✭✭
in PC & Mac Hardware and Software #1
I deleted some files on my PC a couple of days ago and then decided I wanted them back. As the PC had minimal use since the deletion I was hopeful and after a brief Google found that Recuva was considered one of the better free tools. So I downloaded and ran it on the drive which had the files. I just used the handy wizard and let it do its standard scan (not deep scan). I was very pleased to see it return a list of all my files, all showing as excellent recoverability with no areas overwritten.

I selected all the files I wanted (some 40 odd gigs worth) and I went off in search of an external drive with enough space. Unfortunately, I then got called away to do something else and not knowing how long I would be out I closed down Recuva and shut down the PC assuming the files would show next time I ran Recuva.

Came back later with the external drive and ran Recuva again, same drive, same scan type but none of my original files showed, it found some files but none of the ones I wanted, that it displayed last time. Is it possible the program thinks I have already recovered the files and hence is not displaying them now? If so is there anyway I can reset it to think I am scanning for the first time again?

Alternatively, is there a better program to use for file recovery?

Whilst the files were not that important that I would pay for professional recovery, it would be nice to have them back if this can be done without expense and hosing massive amounts of time on it.

Comments

  • MaxatoriaMaxatoria Posts: 17,980
    Forum Member
    ✭✭
    #2
    shutting down and restarting the machine will of written new files probably in the space where the files you wanted to recover lived thus overwriting them, the best bet in the future is to just kill the machine so pull the power out and then stick the drive into a usb caddy and use another machine to do the recovery work

    Now the problem may be that the disk area with the folder information may have been overwritten only and some deep disk inspection may work but either boot it off a cd/usb drive or use another machine
  • steven123steven123 Posts: 3,245
    Forum Member
    ✭✭✭
    #3
    I do have another machine I could try the HDD in, worth a shot definitely, though I am surprised that they got overwritten at all as they were not on the same disk as the OS and installed programs, they were on a separate disk that is just used for data storage so I didn't think they were in any danger of being overwritten as nothing else should have been writing to that drive.

    Plus the files I deleted were of more than 40GB in total so surely that couldn't all be wiped out in one go? Even if Windows or some other application overwrote some of the deleted files e.g. with an auto update, surely most of the data must still be there waiting to be recovered?
  • MaxatoriaMaxatoria Posts: 17,980
    Forum Member
    ✭✭
    #4
    have you done anything to the drive such as creating new folders and even changing views so that a thumbs.db file is created may of just overwritten the disk cluster with the folder details, but yes the data probably is still there but the easy thing of just undeleting the folder details and everything being returned to normal has probably gone. Probably time for deep scanning as it may still be able to find stuff by reading raw disk space and looking for tell tale headers/footers for files etc but its going to take a lot longer
  • gemma-the-huskygemma-the-husky Posts: 18,116
    Forum Member
    ✭✭
    #5
    bit late, but I wouldn't have shut down the PC.

    I hardly ever shut mine down to be honest.

    out of interest delete used to work by renaming the file with the first char as a "~" I think. undelete just asked you what you wanted the first char to be, and reversed the delete. you didn;t need another drive.

    40Gb sounds a hell of a lot of files to have deleted.
  • chrisjrchrisjr Posts: 33,282
    Forum Member
    ✭✭✭
    #6
    gemma-the-husky wrote: »
    out of interest delete used to work by renaming the file with the first char as a "~" I think. undelete just asked you what you wanted the first char to be, and reversed the delete. you didn;t need another drive.
    In the days of DOS it was ASCII character 255. I actually wrote a simple utility to scan the directory in a folder and retrieve those filenames and rename them. Which is basically how things like Norton Tools and eventually Microsoft Undelete worked.
  • MaxatoriaMaxatoria Posts: 17,980
    Forum Member
    ✭✭
    #7
    i seem to remember E5 in hex as the char they used but its been years since i bothered to mess with DOS and FAT but for some reason i think 255 was used to create "hidden" folders as a normal dir command just skipped over it so you could hide stuff from casual inspection but any decent program would just bypass it and show the actual folder name
Sign In or Register to comment.