I have accidentally deleted everything inside my hard drive. How could I
restore them?
I’ve accidentally done this myself.1
It’s never pretty and your recovery options are usually very limited.
Let me start with one admonition: stop using the drive. The more that
you use it, the less likely that you’ll be able to recover.
Now, let’s look at options…
]]>
Restore your most recent backup
The easiest solution is to simply grab the most recent backup that you took of that drive and restore its contents or restore the backed up copies of what you deleted.
In fact, it’s exactly because of these types of scenarios that we take regular backups in the first place.
Once restored, you’ve only lost whatever has changed in the time since that backup was taken. If you’re following a typically recommended pattern of some form of nightly backup, that means that you’ve lost at most a day’s worth of work.
It’s by far the easiest, most reliable, and quickest way to recover from this kind of problem.
You don’t have a backup, you say?
Then the chances of a full recovery just got a lot smaller and the steps to try a recovery just got a lot more complex.
Seriously, stop using the drive
If this is your system drive, or “C:” drive, then I strongly recommend that you actually physically remove it and place it into an external USB enclosure.
You can then take it to another computer for the steps that follow. Alternatively, you can install a new drive in your computer, reinstall Windows onto that drive, and install any applications that you care to so that you can once again have a working machine.
The goal here is to stop using that original drive. Every time Windows writes to the drive, even when trying to boot, it’s overwriting data that you might want to recover. The only way to make sure that it doesn’t happen is to not try to boot from it at all or use it in any way. The safest way to do that is to make it the second or external drive.
Try recovery tools
With the drive attached as a second or external drive, grab the free data recovery tool Recuva and turn it loose on the drive.
Recuva, and other tools like it, scan the drive media looking for deleted, but possibly recoverable files, and allow you to specify which should be restored.
This could be a painstaking and time-consuming process. The problem is that file recovery tools don’t know the difference between files that you just recently deleted by accident and files that you deleted before that on purpose. They’ll identify all of the files which could be recovered and you’ll need to see which of those that you actually want to get back.
I recommend that you not recover in place. By that, I mean rather than simply undeleting the files on the drive, copy the files to be recovered to a different drive. This should avoid writing to the original drive at all. The goal here is to minimize any changes to that drive until all of the files that you want back have been recovered.
Practicality
Most people won’t do what I’m suggesting.
Most won’t have backups. Most will simply reboot from the drive, if they can, and run recovery tools like Recuva to recover what they can. If they can’t even boot, most will actually reinstall Windows on that drive, overwriting most of the data that they’d want to recover, and then try running recovery tools after.
And most folks will quite possibly lose much of the data that they’d accidentally deleted permanently.
(You can guess where I’m going with this…)
Don’t be like most people.
To begin with, start by backing up. You can see how easy it is to restore from a backup compared to all of the steps required to – maybe – recover the deleted files directly.
And if you do find yourself in a situation where important files have been deleted and you have no backup to recover from, slow down and take the time to do it right. That’ll significantly improve your chances of recovering what was lost.
1 For the curious, it was a Linux server that I was setting up and I accidentally typed “rm -fr *” at the root of the drive. For the non-Linux users, that’s the remove command, with the force and recurse options, with “*” meaning everything. Fortunately, it was early in the process and I just started over.
“Blizzard”…there’s a logo I haven’t seen since the days of Starcraft and Diablo2 #I refused to play WOW when it came out as I’m certain it would have been too addicting for me and based on the fanbase I’m probably right#.
What’s your poison Leo? WOW? Starcraft2? D3 beta tester perhaps?
23-Sep-2011
Unlike my other post, I’ll stay a little more on topic here…I’ve not done an accidental delete of “everything” but I do have a friend who, in the early days, discovered the command “deltree” and somehow fat-fingered the “c:” directory. He shortly afterward discovered how to reinstall Windows because he didn’t do backups either.
I accidentally deleted all my family pictures on my computer which numbered about 5000. I tried several expensive data recovery systems and all failed. Then I found Get Data Back & Deleted File Recovery and was able to recovery all of my pictures. That was one of the happiest days of my life. I now back up all of my files on 3 hard disk drives.
Hmmm…
As a C128 user, I regularly use a Unix CSH-shell account at our ISP, so “rm -fr *” isn’t exactly unfamiliar, though I have never had occasion to use that particular combination of switches, myself. <<Shudder.>>
But I am curious: What, in freak’s name, (besides Satan himself), could ever have possessed you to enter that particular command from your root directory?! Yikes!
23-Sep-2011
One alternative to removing the disk or installing Windows to another drive, would be to boot Windows from a live PE CD or DVD or from Live Linux disc such as Ubuntu. Ubuntu is probably the easiest option as it freely downloadable and a PE disk needs to be created. Here’s a tutorial to do itfrom Ubuntu.
http://www.howtogeek.com/howto/13706/recover-deleted-files-on-an-ntfs-hard-drive-from-a-ubuntu-live-cd/
Way, way back in the old DOS days, I managed type del *.* from the c: prompt. I was so used to answering “Y” when using the del command to delete such relatively useless things as backup doc files, that I was on autopilot and answered “Y”. It was a mistake I made only once.
Always happy to hear that somebody else has done the “rm -rf *” command from the root directory. And to answer a previous comment, it happens because you’re logged in as root, and for some reason you lose track of what directory you’re in. Every long-term Linux/UNIX user I know of has done this once. I try to stay away from the people who have done it twice. ;) And just so Leo doesn’t delete this message because it meanders too far off-topic, I have a followup: Are there any Linux live recovery CDs you’d recommend for recovering a Windows drive? My wife insists on using Windows XP, and I have to deal with trashed hard drives occasionally.
I looked into the various means of backing up data on my hard drive – an external hard drive, and decided on an off-site backup servce such as Carbonite or Mozy. My computer guru recommended Mozy and every night at 3 a.m., all the files I designated to be saved are backed up to be retrieved if and when needed.
If the hard drive was trashed, there may be another way.
While using Nero Vision to capture a DVD-RW, the app hung. I had to turn off the computer using the power switch. I put the HD in a USB case and found that both the W7 and logical partitions were unidentified file systems. And there were two additional partitions that should not be there.
I tried repairing with W7 install DVD. NG. Used Easy Recover app in a PE disk that has worked in the past. It did not see all files, but those it recovered were damaged. None of the .mpg files would play.
Used TestDisk 6.12. I attached to the PATA in another computer because TestDisk did not see the disk when in USB enclosure.
I opened testdisk_win.exe and chose the advanced mode. It found the hidden W7 boot, the labeled logical partition, and two unlabeled invalid partitions. I used the cursor keys to select the W7 and set it to as the boot partition. I set the logical to logical, and the two invalid partitions set for deletion.
All files were readable and good when viewed XP.
I put drive back in the original computer, and all worked again.
I run Windows 7 Ultimate and Kubuntu Natty in a duel-boot configuration. I’m forever messing around with my OSes and occasionally have had to pay the price with an unbootable system. I’ve lost count of how many times I had to reinstall my operating system(s). No biggie, though, as I always have my personal files backed up to my portable hard drive so other than the time I used for reinstalling/reconfiguring my OSes, nothing was lost. Sometimes I just get bored and trash my OS for fun so I can reinstall. PS: who in the world would ever include the wild card with the rm command? That’s a rookie mistake. :-)
Seagate has excellent recovery software and they have technicians to help. It is not free but the extra bucks are well worth it. Also buy another portable hard drive to write the scanned files to. Memory sticks are slow.
Dale
Leo wrote:
And that, my dear Leo, is why I set my Unix prompt to display my current working directory. :)
23-Sep-2011