Digital Spy

Search Digital Spy
 

DS Forums

 
 

Recovering Deleted Files


Reply
Thread Tools Search this Thread
Old 23-02-2013, 08:59
steven123
Forum Member
 
Join Date: Dec 2000
Location: Teesside, England
Posts: 2,715

I deleted some files on my PC a couple of days ago and then decided I wanted them back. As the PC had minimal use since the deletion I was hopeful and after a brief Google found that Recuva was considered one of the better free tools. So I downloaded and ran it on the drive which had the files. I just used the handy wizard and let it do its standard scan (not deep scan). I was very pleased to see it return a list of all my files, all showing as excellent recoverability with no areas overwritten.

I selected all the files I wanted (some 40 odd gigs worth) and I went off in search of an external drive with enough space. Unfortunately, I then got called away to do something else and not knowing how long I would be out I closed down Recuva and shut down the PC assuming the files would show next time I ran Recuva.

Came back later with the external drive and ran Recuva again, same drive, same scan type but none of my original files showed, it found some files but none of the ones I wanted, that it displayed last time. Is it possible the program thinks I have already recovered the files and hence is not displaying them now? If so is there anyway I can reset it to think I am scanning for the first time again?

Alternatively, is there a better program to use for file recovery?

Whilst the files were not that important that I would pay for professional recovery, it would be nice to have them back if this can be done without expense and hosing massive amounts of time on it.
steven123 is offline   Reply With Quote
Please sign in or register to remove this advertisement.
Old 23-02-2013, 13:28
Maxatoria
Forum Member
 
Join Date: Apr 2011
Posts: 6,153
shutting down and restarting the machine will of written new files probably in the space where the files you wanted to recover lived thus overwriting them, the best bet in the future is to just kill the machine so pull the power out and then stick the drive into a usb caddy and use another machine to do the recovery work

Now the problem may be that the disk area with the folder information may have been overwritten only and some deep disk inspection may work but either boot it off a cd/usb drive or use another machine
Maxatoria is offline   Reply With Quote
Old 23-02-2013, 13:34
steven123
Forum Member
 
Join Date: Dec 2000
Location: Teesside, England
Posts: 2,715
I do have another machine I could try the HDD in, worth a shot definitely, though I am surprised that they got overwritten at all as they were not on the same disk as the OS and installed programs, they were on a separate disk that is just used for data storage so I didn't think they were in any danger of being overwritten as nothing else should have been writing to that drive.

Plus the files I deleted were of more than 40GB in total so surely that couldn't all be wiped out in one go? Even if Windows or some other application overwrote some of the deleted files e.g. with an auto update, surely most of the data must still be there waiting to be recovered?
steven123 is offline   Reply With Quote
Old 23-02-2013, 13:46
Maxatoria
Forum Member
 
Join Date: Apr 2011
Posts: 6,153
have you done anything to the drive such as creating new folders and even changing views so that a thumbs.db file is created may of just overwritten the disk cluster with the folder details, but yes the data probably is still there but the easy thing of just undeleting the folder details and everything being returned to normal has probably gone. Probably time for deep scanning as it may still be able to find stuff by reading raw disk space and looking for tell tale headers/footers for files etc but its going to take a lot longer
Maxatoria is offline   Reply With Quote
Old 23-02-2013, 13:47
gemma-the-husky
Forum Member
 
Join Date: Jul 2009
Location: UK
Posts: 13,068
bit late, but I wouldn't have shut down the PC.

I hardly ever shut mine down to be honest.

out of interest delete used to work by renaming the file with the first char as a "~" I think. undelete just asked you what you wanted the first char to be, and reversed the delete. you didn;t need another drive.

40Gb sounds a hell of a lot of files to have deleted.
gemma-the-husky is offline   Reply With Quote
Old 23-02-2013, 14:51
chrisjr
Forum Member
 
Join Date: May 2004
Location: Reading
Posts: 22,300
out of interest delete used to work by renaming the file with the first char as a "~" I think. undelete just asked you what you wanted the first char to be, and reversed the delete. you didn;t need another drive.
In the days of DOS it was ASCII character 255. I actually wrote a simple utility to scan the directory in a folder and retrieve those filenames and rename them. Which is basically how things like Norton Tools and eventually Microsoft Undelete worked.
chrisjr is online now   Reply With Quote
Old 23-02-2013, 15:01
Maxatoria
Forum Member
 
Join Date: Apr 2011
Posts: 6,153
i seem to remember E5 in hex as the char they used but its been years since i bothered to mess with DOS and FAT but for some reason i think 255 was used to create "hidden" folders as a normal dir command just skipped over it so you could hide stuff from casual inspection but any decent program would just bypass it and show the actual folder name
Maxatoria is offline   Reply With Quote
 
Reply



Thread Tools Search this Thread
Search this Thread:

Advanced Search

 
Forum Jump


All times are GMT. The time now is 16:20.