Helping people with computers... one answer at a time.
Deleting a file doesn't necessarily remove the data from disk. It then becomes a race to recover it before it's overwritten by something else.
Before my power supply blew, I'd deleted a huge folder of pictures and subfolders of pictures to the recycle bin. After I retrieved my computer from the shop, the folder was emptied from the Bin. So, I performed 2 system restores, which I later found doesn't restore files. Then, I downloaded data retrieving software which allowed me to look at my deleted data.
In deleted data, I can see my current folders in "pictures" and the files I deleted from them, and I can see one deleted folder from "pictures". The one deleted folder is an earlier version of the huge folder the computer shop deleted, but not the exact folder they deleted.
It's been exactly 5 days since I've had my computer back. Even if some of the pictures in it were overwritten, some still wouldn't be, right? The software doesn't list ANYTHING which was in that folder (or the folder itself) ...and at least 400 pictures were in there.
Why can't I see that folder, or other folders I've deleted from pictures? Why can I see only the earlier version?
Given the scenario you've described, I'd honestly be surprised if you found any pictures at all.
In general, I think we view undelete utilities a little too optimistically. We should be surprised when they work, not the other way around.
Let's look at why your scenario, and scenarios like it, is so problematic, and what steps I'd take in a last ditch effort to retrieve your data.
First things first:
STOP USING THE DRIVE
Every moment you continue to use the drive for anything that isn't related to recovering your data, you severely decrease the chances that you'll be successful. And yes, if it's your only drive that means even just booting and running your machine will likely harm your ability to recover data. You should really remove the drive and place it in a different computer as the secondary drive until you're done with the recovery process.
Undelete utilities work on the principal that so-called "deleted" data is actually still on the hard disk, until it's been overwritten by other activities. So for example, if you write to file B, and then erase file A, the contents of file A might still be available. On the other hand, if you erase file A and then write file B, A might not be available, because it might have been overwritten by file B.
That's a gross over simplification, but it demonstrates the principal. We'll see in a moment that relying on that simplification is a common mistake.
With all that out of the way, let's look at why that recover tool might find nothing.
My first question is simply What else did that repair shop do?
There was no reason for them to empty your Recycle Bin when replacing your power supply. If they did that it makes me wonder what else they did. If, for example, they emptied your Recycle Bin and then installed other software, or ran diagnostic utilities, or did anything that wrote to the hard disk it's likely that they did, in fact, overwrite the files that had been deleted. It's not unreasonable to think that they might have.
In my oversimplified example of how undelete might work, we had the implicit assumption that if you delete a file and then write a file, the write would naturally happen on top of the file just deleted. In reality it's nothing even close to being that simple, and in fact depends on many other factors, including, not surprisingly, the type of filesystem. Files are placed on the hard disk quite differently between NTFS and FAT32 filesystems, for example. They each have their technical reasons for choosing the approach (older filesystems tend to favor simplicity, and the newer systems are more frequently optimized for access speed) but the approaches are quite different.
That's why any disk activity puts your deleted data at risk of being unrecoverable. You simply don't know what action might cause the disk write to happen that would overwrite your data.
Another scenario that we don't often consider when it comes to undelete is defragmenting. Unless your hard disk is not very fragmented to begin with, defragmenting is likely to write to your hard disk a lot - potentially overwriting all that deleted data, making it inaccessible to the recovery utilities. And, come to think of it, defragging is something that your computer shop might have done for you.
So, all in all, my hopes for your data recovery are actually pretty low.
But that's not to say we should give up just yet.
One thing about undelete utilities is that there's no "one way" to do it. Particularly when files and folders have been partially overwritten, different tools use different techniques to to scour the hard disk for possible file and folder fragments from which more files and fragments might be found.
And of course some tools are just better than others.
Now, aside from having used GetDataBack from Runtime Software for the one time I had an issue myself (it recovered about 1/3rd of the files I was looking for, the rest were lost), I have no specific recommendation for an undelete utility. Naturally a search for "Undelete Files" turns up many, many options. I would try a couple from reputable sources, particularly those with free trials, and see if they turn up anything more than you've already seen.
And finally, I'd be remiss if I didn't harp on what is ultimately the only foolproof solution: prevention. Had you backed up your data regularly, you wouldn't be having this issue at all. Now would be a good time to invest in a good backup solution so as to avoid this issue in the future.
Comments on this entry are closed.
If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.
If you don't find your answer, head out to http://askleo.com/ask to ask your question.