Okay Geek Farm
How to Recover Deleted Files (or Undelete) on Windows
Ricardo Trejo
We’ve all deleted files that we later wish we hadn’t, and people have always asked me if there were ways to undo the dreaded, permanent effects of the “Empty Recycle Bin” option. Well, I’m here to comfortingly say, yes — there are indeed a couple of ways to restore deleted files back to normal.
What’s it Mean to Delete?
Most people believe once a file has been deleted it’s gone forever, never to be seen again. However, computer forensics specialists can find even the smallest of bits and bytes off a hard drive, provided they have the right tools. How’s that — especially when these files of information didn’t really exist in a physical nature in the first place? Microsoft provides the following answer on their support page:
When you delete files or folders, the data is not initially removed from the hard disk. Instead, the space on the disk that was occupied by the deleted data is “deallocated.” After it is deallocated, the space is available for use when new data is written to the disk. Until the space is overwritten, it is possible to recover the deleted data by using a low-level disk editor or data-recovery software.
In other words, when you delete a file, your computer simply marks it as free space, ready to be overwritten by another piece of information. And with thousands upon thousands of places to allocate new files and folders, there are creaks and crevices all over your hard drive that expose old pieces of deleted data, some of which can be restored.
Before “Undeleting”
After deletion, the more operations you run, the more applications you install, the more you click away at your keyboard, new blocks of information are being stacked onto your old, potentially precious data that may have accidentally been deleted. So before we get into which applications and programs are best to saving your trashed data, keep in mind that you’re going to want to install any of the following programs on a disk drive where your deleted files are NOT on.
For example; if your deleted files were on drive “C:” then it’s recommended you install any of the following programs on a seperate drive, NOT marked with under “C:”. The same rules apply if your files were on a “D:” drive, etc.
To do this, download and install the applications to a flash drive, or on an external hard drive, and run them off the external source. However, if you have no options and are forced to install on the drive in which your deleted files are on, then make sure you don’t do any other file saving of any kind, as this may overwrite what you’re trying to restore.
Applications
When it comes to data recovery there are two methods to scanning forsaken data; a simple scan and a deep scan. A simple scan will take anywhere between a few seconds to a minute, whereas a deep scan can take up to a few hours. For the purpose of this review, we’re going to note what type of scan each program is able to conduct next to its title.
Restoration (Simple) — Download for Free
Restoration is quite minimal, lacking any sort of advanced featured, yet for some reason uses this to excuse itself from using coherent options for non-tech savvy users. That being said, to scan and “undelete” can be done by doing the following:
- Choose the disk drive you want to scan
- Enter all or a portion of the file name you’re looking for
- Select “Search Deleted Files”
- Select “Restore by Copying” to restore selected files
Again, we’re a little confounded as to why they included a checkbox option thats asks “Include user clusters by other files”. I mean, we don’t even know what that means! But if Restoration gets the job done for you then hey, that’s all we ask for.
NTFS Undelete (Simple) — Download for Free
NTFS Undelete immediately sets itself apart from Restoration with colored buttons presented on the left-hand, top corner. Aside from asthetics, when scanning for files you aren’t given vague commands and options to choose from. To start looking for deleted files, simply:
- Check the disk drive(s) you wants to scan on the left hand panel
- Choose where you’d like restored files to be saved (under the main panel)
- Filter which files will be displayed by selecting “filter” (next to restore button)
- Begin searching by clicking on the “Start Scan” (blue) at the top
- Click “Restore File” to recover deleted files to your system
When your scan is complete, notice the “Status” column that informs the user on the condition of each specific, deleted file. In the filter option, you can algo toggle on and off the function to search for completely overwritten files, so as to not waste time on deleted information that is no longer attainable.
Priform’s Recuva (Advanced) — Download for Free
Sometimes deleted files are so deeply engrained into a hard drive’s disc that a simple scan is completely pointless. Therefore, we’re listing Priform’s Recuva as an advanced data recovery application despite it having the option to do both simple and deep scans. To start up a deep scan:
- Open up Recuva and a Wizard tutorial will follow you through each step necessary
- In the Wizard, you can select which file type you’re looking for as well as in which drive
- In the Wizard, Enable “Deep Scan” on the final window and wait a few hours
- Or you can skip the Wizard and switch to “Advanced mode” in the top, right hand corner, go into options and enable “Deep Scan”
- Under Options you can also filter overwritten files, zero byte files, and secured files
Primform is responsibile for our favorite startup utility, CCleaner, and so Recuva also sports a level of user-friendly capableness and simplicity that makes the process of finding deleted files an easy experieince. Like NTFS Undelete, you can view the “State” of each deleted file in the main panel, allowing you to know whether something is gone for good or can partially be retained. When conducting a deep scan, it took us a full 2 hours for it to complete, but during which it was able to find a tremendous more amount of data that the simple scan just didn’t come anywhere near pulling up.
Also, something to note is Recuva’s ability to Overwrite specific files so that they can never be recovered. Not only that, but you can go into options and increase the number of Overwrite passes so that even the most dedicated of Department of Defense agents wouldn’t be able to access whatever illegal work you’ve been doing in your basement.
Results and Tips
To prevent ever having to worry about deleting the wrong file again, always make sure you know what’s going when you right-click, “Empty Recycle Bin”. And in the likely chance you do forget to do this, keep one of these applications handy on your system or on a separate flash drive so you can get right to work on getting back those precious bits and bytes of information you didn’t meant to throw out.
