Community Newsletter: Q&A forum: Help! What can I do to retrieve deleted data?

Wendy:

I know this sounds like the proverbial "closing the barn door after the cow has gotten out", however, in the future you should back up all your data on an external hard drive or similiar device!

As far as your lost files and pictures, I would recommend that you try doing a "system restore"...that way your computer will be put back to where it was before your friend did the so-called clean-up.

Good Luck

System restore will be of no help at all. Wendy lost DATA files. System restore ONLY backs up SYSTEM files .... Windows (the operating system) itself. It doesn't touch DATA files.

Hmmmm...

Well, I had always understood that System Restore was only for system files, so I took your advice and look up the System Restore help. This is what I found:

"System Restore protects your personal files by not restoring any files in the My Documents folder. It also does not restore any files that use common data file name extensions, such as .doc or .xls."

So based on this information, it can restore data files under very stringent conditions. However, since 99% of the users out there will only save their personal data files in the My Documents folder and will only use file types with "common data file extensions" it is completely fair to say, in general, that System Restore will not get your personal data files back.

In this particular situation, the items mentioned that were lost were: pictures, wedding invitations and plans, and business forms. The pictures and wedding materials I would image are in file formats that would fall under "common data file name extensions." So regardless of where they were saved, System Restore won't do any good. The business forms would be the only thing I would think has a change with System Restore, but I'm not holding my breath since they were probably Word or Excel documents. So again, in all fairness, it would be safe to say that System Restore won't do any good. It couldn't hurt to try, but don't hold to hope.

For a more detailed description of how system Restore works, check out this article:

http://msdn2.microsoft.com/en-us/library/ms997627.aspx

About three-fourths of the way down the page it has a section titled: "What's Restored and What's Not." That gives a much clearere picture of what System Restore covers. Also, you can find the "Monitored File Extensions list" refered to in this article at:

http://msdn2.microsoft.com/en-us/library/aa378870.aspx

Enjoy!

Recently, my 17 year old computer nerd son caused (thru his own admitted non-safe computer practice) all of my disks to fail. Not only would they not boot up but I lost all the directories and files. I did have backups for the most critical files but all else was to be lost. I then started an extensive Internet google search for help. Found suggestions and many software applications. I downloaded many of them in demo mode to check them out. After weeks of research I found one product that blew me away. I purchased it for under $40 and was amazed by it. It recovered all my 320 GB of lost disks
.
There are many products out there. Some assume that you somehow know how to rebuild your boot sectors and directory trees. Some are expensive. Some suggested that I send it to a recovery company for hundreds of dollars. I am not a nerd and I did not trust son to touch anything. It worked wonderfully. All is well now. I do not know if I am supposed to mention the product but if they allow this then the link is http://www.disk-doctor.com/ Beware that the directions are not totally clear for a novice but you should be cautious anyhow. Bottom line is I got it all back. One important word of caution is DO NOT USE YOUR LOST DISK UNTIL YOU ATTEMPT THIS RECOVERY. If you do then your disk files become less and less recoverable as things get overwritten.

You can undelete files on a hard drive, but only if they have not been overwritten by another. And hopefully he didn't use a secure deletion tool like the one in Spybot.

When Windows deletes a file, it simply removes the first letter of the file in the directory listing (so it no longer shows up) and then makes that space available to be overwritten. That's why time is of the essence. Any new files written to that hard drive (like downloaded email or temporary internet files) may overwrite valuable data.

I use File Scavenger as an undelete utility. It works well, and there are others.

Good luck!

As long as you haven't made too many changes, there should be no problem recovering your data. I have been pretty much 100% successful the few times I have had to do this.

The only drawback is the solutions I have been able to find cost to actually recover the data. Go to CNET's Download.com, search for data recovery, then sort by CNET's recommendations, and open another window sorted by User's rating. I could recommend specific programs, but there might be new ones out there I haven't tried, and what is good for me might not be for you.

Download several that look good and run the trial to see what it detects, and if it is comfortable for you to work with.

The important thing to remember is to download and install the program, and recover the data, to a separate drive from the one with the lost data if at all possible. The main reason you will lose data in this scenario is if you overwrite the space it used to occupy with new info.

Of course, depending on what was lost, you can go to a professional, but then you are talking hundreds of dollars, if not thousands. But you might find someone sympathetic, since they already have the pro-grade software, and it is really a matter of hooking it up and walking away for a few hours while the software does it's thing. The actual labor would be very little.

When you find one that gives you what you want, your only legal recourse is to pay the fee for the full program. And there aren't any that are cheap either. At least last time I looked. Good luck!

in the MP3 player forums here,
http://forums.cnet.com/5204-7595_102-0.html?forumID=71

This specific discussion thread is for the newsletter Q&A topic.

Thanks!

It would be nice if you told us which "relatively small and quick piece of software with which I was able to retrieve every file I had deleted." What is the name of it?


"(Possible) Data recovery
by Chemgod - 3/30/07 4:02 PM
In reply to: Help! What can I do to retrieve deleted data? by Lee Koo (ADMIN)
First of all, if the drive where these files were stored has not yet had anything else written to it you may be in excellent shape. If your "friend" did not defragment the drive after he "cleaned" it you are also in excellent shape.

There are several pieces of software that can be downloaded from the internet or purchased at your local computer store. Do a search for "data recovery" on C|net's download site (www.download.com). There will be a couple of dozen possibilities from which you can choose.

I recently had a situation where I copied some files to a DVD and the software said all was well. I deleted the files from the hard drive only to find the DVD was empty (a good lesson here is to check all backups BEFORE deleting originals).

I used download.com and found a relatively small and quick piece of software with which I was able to retrieve every file I had deleted.

Good luck with this."

Because the stock repertoire of most computer "geniuses" includes some form of defragment chances are good that what has been lost is very lost. That is not to say that something it cannot possibly be saved but the cost in time and money to explore recovery can be err...painful.

You can at least use an unerase tool in order to see if there are any recoverable files sitting on the drive. As you probably know, when a file is "erased" from a drive the typical scenario is that the file name is merely truncated so that it does not match up with it's entry in the allocation table (if they even still use such) and that real estate become available again.

So, if the disk area that once was uncle Joe's wedding photo has not been trampled on then it might be recoverable with a little work. In the meantime be very careful about how the machine is used. Any writing to that drive will lessen your chances of finding something to recover.

Good Luck.

You can recover everything that is still recoverable off that hard drive with Runtime Software's Getbackdata for either NTFS of FAT. It takes several hours for the software to find all the deleted files but it is very thorough. Then you need a place for it to copy them once it has found them. It worked great for me on two completely crashed hard drives.
You may also be able to find them in the trash can if you haven't looked in there yet. Gest of luck.
www.runtime.org/

Hi Wendy,

I don't have time to explain at this moment, but tell him to stop whatever you are doing and shut off that computer. The more he uses it and the longer it is turned on, the more likely he will lose everything. I will post a complete answer tomorrow morning.

First thing - try not to run ANYTHING !!
even to the point of useing a friends computer to access Cnet to
get your answers.

I dont have a recovery program idea, and will be looking back
myself to see what answers you do get.

ANY access to your pc could possibly damage the FAT (where file
locations are kept) and that could mean some of the files you
want might be lost.

normal delete steps only flag the file as deleted so the system
ignores them. in the old days I had a program that would list
all the files and you could select to undelet. but others
will be posting good ideas.
ted

Hi - you might try this product or one of the other recovery tools this company offers - I used their Smart Flash Recovery tool and was able to recover most lost files after it had been reformatted. It just depends on if the memory sectors where the photographs were have been overwritten or not.

Good luck.

http://www.smartpctools.com/data_recovery/index1.html


Bob

The question was:

A friend of mine had his computer genius cousin clean up his computer--he cleaned it up all right--cleaned everything out of it including some valuable pictures of past events as well as current wedding arrangements (invites and everything), not to mention all his business forms for his business. Is there anything, I mean, anything I can do to retrieve this lost information? Or are we pretty much out of luck. Any advice or available options you can suggest would be great!

-Wendy

Proposed Answer:

Wendy, unfortunately, you are probably pretty much out of luck. But I would not give up just yet, although Im not optimistic about the outcome.

First, I know its ugly and unpleasant, but for your own future benefit and also for the benefit of the readers, we have to get the chastisement out of the way.

Any hard drive on any computer of any type can fail instantly, at any moment and for no reason whatsoever, with the complete, total and permanent loss of every single thing on the drive. That is, really, what happened to you ... except that in your case it was caused by someones incompetence. However, it can happen due to mechanical and electrical failures as well ... again, at any time, to anyone on any computer. Consequently, its just irresponsible for anyone who stores anything of value on their computer (and presumably that means pretty much anyone) not to have backups of the stuff that they have on their computer. The right answer to your query is ... retrieve the lost files from your backups, and shame on you if you dont have backups. But Ill bet you will have backups the NEXT time that this happens, right? And before I leave the subject of backups, consider that the risk isnt limited to just the hard drive, as many people in New Orleans found out. Fires and disasters can destroy your entire residence. There not only need to be backups, but if the material is really important, you need at least one set of off-site backups, stored somewhere else. Until you have seen the angst of someone who has lost a Doctoral Thesis that they have worked on for years, or all of their photos of their children, or a business that has lost all of its accounts receivable records, the importance of this may not really make an impression on you, but almost all of us use our computer to store things that we consider important. Therefore, almost all of us need backups of the data on our computer.

Ok, now to make an attempt at recovery: Rule #1: IMMEDIATELY stop using the disk drive in question. That may mean that you need to buy a new disk drive (or a new computer) and get your system transferred to or reinstalled on the new drive. But the one thing you should know is that every time that there is a write operation to the disk drive, the chances of recovering anything, and the amount of stuff that can be recovered, goes down. Simply turning on the computer probably involves tens or hundreds of thousands of writes to the hard drive in the first 2 minutes, and every one of those reduces your chances of recovering anything. Since its undoubtedly been weeks since this happened, that is a large part of my pessimism about recovering anything. Its likely that had recovery been initiated at the moment of the loss, much of the material could have been recovered. But, weeks later, your chances of recovery are probably near zero. The stuff that was, at the time of its removal, recoverable, is probably gone for good now, overwritten by all of the activity that has gone on since the original loss.

But, how to proceed, notwithstanding the slim chances of success:

The drive in question needs to be installed as a 2nd drive in another computer (or in the same computer with a new system (1st) drive) so that it will not be further written to.

Then, of course, try the recycle bin. Stuff that is erased goes there and stays there until the recycle bin is emptied, or until a period of time passes, or until the space that these erased files take up is needed. Your chances of finding stuff in the recycle bin are slim (your friends computer genius cousin almost undoubtedly emptied the recycle bin, for one thing, and too much time has undoubtedly passed), but its still the place to start. Also, if you have any routine recovery software installed (things like Norton Utilities or SystemWorks, or similar programs by other publishers), try those also. Again, the chances are slim, but not quite zero.

To proceed beyond this point, you will need some specialized recovery software, and its not going to be free. You are looking for software that can search the disk looking for files that are no longer in the directory but which may still exist on the drive. There are probably a few thousand such programs out there, and there may not be a best program (some programs may find things that others miss, but may themselves miss some thing that others get). A google search for data recovery software will turn up no end of choices, some of them free and perhaps worth trying. But be warned, DO NOT USE ANY SOFTWARE THAT WRITES TO THE DRIVE CONTAINING THE LOST DATA. Now Im going to make a specific recommendation, which is Runtime Softwares GetDataBack. This software is highly regarded and while I cant say that its categorically the best choice for everyone in all situations, its a good choice, and maybe the best choice in a typical situation.

I might also suggest that you consider exploring the possibility of getting professional assistance. This is problematic, because true data recovery services are often almost price prohibitive (thousands of dollars), and if you go seeking local help you may end up finding an amateur who (like your friends computer genius cousin) does as much harm as good. But you might ask around, you may be able to find someone who both really does know what they are doing, and who would be willing to help you at a reasonable cost.

That said, the time that has passed since your data was lost, and the manner of loss make your particular recovery situation extremely difficult. In fact, you are far worse off than the typical situation, because your friends computer genius cousin probably did things like emptying the recycle bin and, God forbid, doing a defragmentation AFTER he erased the files, that would make recovery just about impossible. Im sorry to be the bearer of this news, but that is probably your situation. Next time, hopefully, you will have some backups to fall back on.

Sincerely,
Barry Watzman
Watzman@neo.rr.com

...there is inexpensive software out there that once loaded and set up WILL restore ALL files as they were before the last boot. It's normally used in schools or dumb terminals but is quite useful. If you want to change anything you need to sign on as an Administrator, then back to User. Disk Sheriff comes to mind. BTW - I would recommend professional help if the data is worth it. I have tried getting data off other peoples disks as well as my own and it's nigh on impossible with current software.