Helping people with computers... one answer at a time.

Deleting a file doesn't necessarily remove the data from disk. It then becomes a race to recover it before it's overwritten by something else.

Before my power supply blew, I'd deleted a huge folder of pictures and subfolders of pictures to the recycle bin. After I retrieved my computer from the shop, the folder was emptied from the Bin. So, I performed 2 system restores, which I later found doesn't restore files. Then, I downloaded data retrieving software which allowed me to look at my deleted data.

In deleted data, I can see my current folders in "pictures" and the files I deleted from them, and I can see one deleted folder from "pictures". The one deleted folder is an earlier version of the huge folder the computer shop deleted, but not the exact folder they deleted.

It's been exactly 5 days since I've had my computer back. Even if some of the pictures in it were overwritten, some still wouldn't be, right? The software doesn't list ANYTHING which was in that folder (or the folder itself) ...and at least 400 pictures were in there.

Why can't I see that folder, or other folders I've deleted from pictures? Why can I see only the earlier version?

Given the scenario you've described, I'd honestly be surprised if you found any pictures at all.

In general, I think we view undelete utilities a little too optimistically. We should be surprised when they work, not the other way around.

Let's look at why your scenario, and scenarios like it, is so problematic, and what steps I'd take in a last ditch effort to retrieve your data.

First things first:

STOP USING THE DRIVE

Every moment you continue to use the drive for anything that isn't related to recovering your data, you severely decrease the chances that you'll be successful. And yes, if it's your only drive that means even just booting and running your machine will likely harm your ability to recover data. You should really remove the drive and place it in a different computer as the secondary drive until you're done with the recovery process.

Undelete utilities work on the principal that so-called "deleted" data is actually still on the hard disk, until it's been overwritten by other activities. So for example, if you write to file B, and then erase file A, the contents of file A might still be available. On the other hand, if you erase file A and then write file B, A might not be available, because it might have been overwritten by file B.

"What else did that repair shop do?"

That's a gross over simplification, but it demonstrates the principal. We'll see in a moment that relying on that simplification is a common mistake.

With all that out of the way, let's look at why that recover tool might find nothing.

My first question is simply What else did that repair shop do?

There was no reason for them to empty your Recycle Bin when replacing your power supply. If they did that it makes me wonder what else they did. If, for example, they emptied your Recycle Bin and then installed other software, or ran diagnostic utilities, or did anything that wrote to the hard disk it's likely that they did, in fact, overwrite the files that had been deleted. It's not unreasonable to think that they might have.

In my oversimplified example of how undelete might work, we had the implicit assumption that if you delete a file and then write a file, the write would naturally happen on top of the file just deleted. In reality it's nothing even close to being that simple, and in fact depends on many other factors, including, not surprisingly, the type of filesystem. Files are placed on the hard disk quite differently between NTFS and FAT32 filesystems, for example. They each have their technical reasons for choosing the approach (older filesystems tend to favor simplicity, and the newer systems are more frequently optimized for access speed) but the approaches are quite different.

That's why any disk activity puts your deleted data at risk of being unrecoverable. You simply don't know what action might cause the disk write to happen that would overwrite your data.

Another scenario that we don't often consider when it comes to undelete is defragmenting. Unless your hard disk is not very fragmented to begin with, defragmenting is likely to write to your hard disk a lot - potentially overwriting all that deleted data, making it inaccessible to the recovery utilities. And, come to think of it, defragging is something that your computer shop might have done for you.

So, all in all, my hopes for your data recovery are actually pretty low.

But that's not to say we should give up just yet.

One thing about undelete utilities is that there's no "one way" to do it. Particularly when files and folders have been partially overwritten, different tools use different techniques to to scour the hard disk for possible file and folder fragments from which more files and fragments might be found.

And of course some tools are just better than others.

Now, aside from having used GetDataBack from Runtime Software for the one time I had an issue myself (it recovered about 1/3rd of the files I was looking for, the rest were lost), I have no specific recommendation for an undelete utility. Naturally a search for "Undelete Files" turns up many, many options. I would try a couple from reputable sources, particularly those with free trials, and see if they turn up anything more than you've already seen.

And finally, I'd be remiss if I didn't harp on what is ultimately the only foolproof solution: prevention. Had you backed up your data regularly, you wouldn't be having this issue at all. Now would be a good time to invest in a good backup solution so as to avoid this issue in the future.

Article C3366 - April 29, 2008 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

7 Comments
Marty
May 1, 2008 12:41 AM

Great article, Leo. Most people have *very* valuable data on their drives, but have absolutely no data protection plan in place. A perfect recipe for disaster, if there was one!

So, backup * regularly*, and also have a file recovery program installed on your PC at all times. The latter is important if you want to recover accidentally deleted files that were modified after the last backup. It is easier to recover such files without having to hunt for a solution after the deletion, and risk overwriting the file.

Regular backups + file recovery software = peace of mind + data protection.

Christopher Homer
May 1, 2008 3:05 AM

Good Article Leo,

I've had to recover data a few times for my clients and usually its been a great success. The tools you can get are varied and i used GetDataBack on one occasion to good effect but its the amount of 'passes' over the data your fighting against. Far as i understand from an article i read on how to 'destroy' data, overwriting sectors (zero pass) as many times as possible is the best way to lose information

The software i usually use is R-studio, which i use more often then not with really good results, my experience with data recovery has usually been really good, even with things like head crashes on HDs, its a long process when theres a hardware fault but it recovers the good parts. Formatted disks have also been a part of the success.

I honestly think if you try hard enough with the right software, or use a professional firm, you could get your data back. Although as i work in a educational capacity; ive never been required to take such steps as a professional solution as the data lost has never been really significant, ive heard good things from other people who have had to recover essential info

Lorne Babcock Sr.
May 2, 2008 6:41 PM

This whole situation is very strange. Why this user first deleted the file, perhaps deliberately and perhaps not, and then wanted to retrieve the file is a mystery. Did this individual believe that the recycle bin is an appropriate place to store files? I have run across just that scenerio in the past.

Setting all of that aside there is a program called Easy Recovery Pro that might do the trick. I have used that program to recover data in my computer business for some time. Depends on the size of the hard drive, it could take two or more weeks before the recovery process is completed and there is no guarantee that all of the files will be recovered.

It is to be understood that when a computer goes into the shop there is no guarantee that data will not be lost.

This user might want to consider a good backup scenario. First and foremost for a backup to be considered useful there must be either two hard drives available in the system or the backup should be made to CDs or DVDs. Backing up to a partition on a single drive is worse than useless. Believing that you have a good backup and being wrong about that is actually worse than having no backup at all. A program that I have used for some years is called Acronis. I have looked diligently over the years and I have finally concluded that Acronis, if not the best is certainly near the top in terms of reliability and ease of use.

Even if the files on this drive have been overwritten does not necessarily imply that all or at least some of the files cannot be recovered. A single overwrite of a file frequently leaves that file available for recovery using appropriate software. The only way to truly erase files is to write the disk to zeros using a low level formatting utility.

This user should not give up on retrieving at least some of those files. There are companies that will retrieve the files however the cost can be very high. The files would have to be of considerable importance in order to make such a move a reasonable alternative.

Fred
May 3, 2008 3:57 PM

As soon as you accidentally delete something, switch off. Then, if you can't use hard drive as a slave, download (on another computer) the emergency boot CD (google EBCD) which is a live cd (doesn't write on startup) and designed for things like that. As well as a lot of other hacks.

Pat Van Dusseldorp
May 6, 2008 2:15 PM

Why would you store valuable data in the recycle bin?

alex
May 13, 2008 6:46 PM

i cant open the MSN website can you pls help me with this problem i have////

layton
May 7, 2009 11:56 AM

hi,


great site and described very well for pc noobs like myself ( even tho am gutted files arn't really recoverable ) thx for all the info tho and like u say prevention is the key :)

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.