Community Newsletter: Q&A: Help! What can I do to retrieve deleted data?

Help! What can I do to retrieve deleted data?

by Lee Koo (ADMIN)  - 4/12/07 4:45 PM

Question:

A friend of mine had his computer genius cousin clean up his computer--he cleaned it up all right--cleaned everything out of it including some valuable pictures of past events as well as current wedding arrangements (invites and everything), not to mention all his business forms for his business. Is there anything, I mean, anything I can do to retrieve this lost information? Or are we pretty much out of luck. Any advice or available options you can suggest would be great!

Submitted by Wendy J. of Calgary, Alberta, Canada


Answer voted most helpful by our members:

Dear Wendy,

For extensive data recovery, your best bet is to contact a professional outfit specializing in this type of service, such as Ontrack Data Recovery (http://www.ontrack.com/).

Data recovery is not the sort of thing Geek Squad (http://www.geeksquad.com/) or a local computer shop will probably do, yet you might get a valuable referral from them. Moreover, you should be able to find data recovery services listed in your phone book, as well as in the classified section of computer and technology magazines such as PC Magazine.

Understand, this type of service will not be inexpensive, but for anyone needing to retrieve business documents and other valuable and irreplaceable files, the expense might be well worth it.

Professional data recovery services are usually overkill for the average user, or when one needs to recover relatively small numbers of deleted files. Under these circumstances, a "recovery" or "undelete" utility can prove quite helpful. (Your friend can always roll the dice and try one of the undelete utilities mentioned below, though as you will see, finding specific files might be a chore and the success rate might be significantly less than that of a professional service.)

When a file is moved to the Recycle Bin and the latter is emptied, Windows neither moves nor erases the file. Instead, it simply marks the space in which the deleted file (or files) is located as available for immediate use. The file is no longer listed in your Windows database, but it is still in your hard drive, exactly where it resided before being deleted. Because of this, a deleted file can often be retrieved. The trick is to do so before Windows or another program starts writing new data in that "newly-available" space. (The assumption being some genius cousin did not reformat the hard drive or "shredded" files, in which case only the most advanced professional recovery services and techniques might be able to recover the files. Might.)

Time is of the essence, so the first thing to do once you realize the need to recover a file is to stop using your computer. Doing so minimizes the chances of Windows overwriting the part of your hard drive where the file you want to recover resides.

About the worst thing you can do is turn off and/or reboot your PC, as both processes require your operating system to write data on your hard drive. Also, if there are any disk maintenance utilities (such as a disk defragmenter) running in the background, it is imperative that you abort them at once.

To recover a deleted file, you will need to locate it and copy it elsewhere using the undelete utility. Fortunately, one of the better ones, RESTORATION, is free. You can download this utility from Download.com

http://www.download.com/Restoration/3003-2094_4-10322949.html?tag=tab_rev

Here's where the proactive approach pays off. What do you think will happen if you don't already have this or a similar application in your computer, and accidentally delete an important or precious file? You will inevitably have to rely on your browser to search for an application and/or its download site, then download installation or executable files, and finally install and/or run the program. All those steps involve an awful lot of writing, and Murphy's Law all but guarantees that some of the temporary installation files will be written right over that file you are trying to save!

RESTORATION is very simple to use. Once you download the executable files and start the application, you simply specify the drive for recovery from the drop-down menu on the upper right corner of the application window, then click the Search Deleted Files button. There is a box above this button in which you can enter the name of the file you want to recover. You can either do so before starting the scan, or after the latter is complete to filter the results. Once you find the file in question, select it with your mouse, then click the Restore by Copying button. The application will suggest you restore to a different drive, if possible, to avoid overwriting other deleted data which you might also want to retrieve. If you need to undelete more than one file, this might be a good idea.

Another excellent - and free - undelete utility is RECUVA (http://www.recuva.com/). It is just as intuitive as RESTORATION, but it also features a "Comment" column that will tell you the state of a file (whether or not it has been overwritten, and if so, to what extent). This feature makes RECUVA my favorite undelete utility even though it is currently a Beta application (i.e., a work in progress which might have significant bugs). I have not encountered any performance or stability issues with RECUVA, and recommend this utility to anyone comfortable with beta software. This is quality stuff from the same folks who publish the excellent CCleaner (http://www.download.com/CCleaner/3000-2144_4-10634975.html?tag=lst-0-1).

Regardless of the undelete utility used, I have noticed that searching deleted files by name does not always yield the expected results. For example, a JPEG image saved as "Roubaix" and subsequently deleted might not show up as "Roubaix" in the search results. But the file is there and probably recoverable; it might be listed as "Doc1.JPEG" and its location path listed as something like "C:\RECYCLERS..." rather than your Desktop or My Pictures folders. Thus, before you go into panic mode, use the characteristics of the file in question (size, file extension of items listed under the Name column, date listed under the Modified column) to narrow the search results and make an educated guess.

Remember, you have little to lose by restoring a deleted file - especially if you are restoring it to a different drive. If it turns out it was the wrong file, you can always try another.

If your friend decides against enlisting a professional data recovery service, he or she can try recovering ALL files identified by RESTORATION to a second drive (internal or external). I wouldn't worry about restoring the operating system and other programs that can be manually reinstalled. The latter might be time-consuming and a hassle, but highly advisable - recovered program might be corrupted, or might not work at all due to changes in the Windows registry.

Understand, there are no guarantees that you will be able to recover a file either with RESTORATION, with similar software, or even with a professional data recovery service. And it is always possible for a restored file to be corrupt. But at least you tried!

RESTORATION and RECUVA are just two of a number of undelete utilities available, which tend to differ in features and complexity. Some of the more powerful ones will set you back hundreds of dollars, but there are some affordable choices. Among the latter you will find Norton Utilities (now part of the Norton SystemWorks Suite, though you might be able to find a stand-alone version):

http://www.symantec.com/home_homeoffice/products/overview.jsp?pcid=sp&pvid=nsw2006

Hope this information helps!

Submitted by Miguel (CNET member Kid A)


If you have any additional advice or recommendations for Wendy, let's hear them. Click on the "Reply" link to post. Thanks!