Recover deleted files with this undelete howto article.

Purpose of this document

In this article I describe two methods to restore unwanted deleted files and directories.

These methods especially describe how to restore deleted files and/or directories on MS Windows systems. But for other systems the first steps are also usefull for other systems (Linux, Unix, Mac).

Although I think you can get most of your files back by following my instructions, I can NOT garantee that you will get those files or directories back.

Time for a Disclaimer The written instructions in this text are at your own risk. The author is not responsible for any data lost or data corruption or damage to systems while following these instructions.

When are files deleted?

When you put your files in your (computers) trash bin the files are still there. You can get them out of there, just as you would do with a real trash bin. When you empty your real trash bin, your garbage will almost be certainly lost. On your computer there is a chance to get them back.

Files themselves are not deeleted, but the reference to the file is removed. Look at as it where a street and to remove a house, you remove the number of the house. In this case the adress of the house ceased to exist, and therefore the house is gone.

Note that the house is not really gone, it's adress is gone. With files and directories it's almost the same. Only when you "delete" a house it will certainly be restored by putting a number on it. To restore a file or directory, you have to know the location of the file.

To the computer the files reference (it's adress) is gone, so it can use it's location for another file. Just like placing another house on our "deleted" house. Ok by doing this with a house, it needs a little more work to accomplish this.

So, as long there are no other files to be placed on the location "deleted" files, it can be recoverd. Right, let's maximize the chance of recovery by following one of the two methods to recover your unwanted deleted files.

Method One is the way to make sure your computersystem will work after my instructions, but the chance for file recovery is a little lower than Method Two.

Method Two is more risky, because your computersystem might crash, but the chance for file recovery is higher.

So you must choose. A rule of thumb is, how more valuable the file, the computersystem will be less important. Think of terms of reinstalling windows versus rewrite your thesis. The choice is yours, but make up your mind rather quick. Because time is a luxury you don't have right now.

Method One

Method One has a smaller chance to recover, but then chance to break your computer is almost zero. So I prefer this method.

Step one:

Minimize harddrive activity.

To do this: Do not start any new programs. Do not close running programs, unless they are writing to the harddrive (e-mail, websurfing, kazaa, bittorrent etc.). Remove cables from network interface cards (NIC) and modems. Deactivate any WIFI cards. Make sure the computer won't go into suspense/hibernate mode. This you can accomplish by turning the system standby and system hibernate options off from the control panel's power options. Make sure no screensaver will popup. Leave the computer running.

Ok, we have a computer in a relative stasis. You may breath now. But don't take to long, because there might still some write activity possible so let's move to step two, find the file's adress.

Gee, what's my file's adress?

Ok, I won't know your unwanted deleted file's adress, and neither will you. Fortunately we have programs to detect the deleted files on disk. Here I'll mention three of such programs.

Use another computer to download one of the following programs:

The first two I use myself. The last one has some good reviews.

All of above programs are freeware (at this moment of writing). The first program fits on a diskette, and thats quite what we want. A small program that is capable to run from diskette to check your harddrive for deleted files.

The other two can be execute on a cd-rom. But first you have to install them on an other computer and then you can burn them on a cd-rom. This takes more time. Here I show you how to use Restoration.

Download the program Restoration and decompress the file on another computer. Put the file restoration.exe on a diskette or cd-rom but not on an USB disk! Using an USB disk while cause harddrive write activity and that is something we don't want to.

Put the diskette into the computer where we want to recover the data and start de program restoration.exe. In a few moments the following program window will appear.

Choose the drive (i.e. c:) where the to recover data should exist from the "Drive" dropdownbox. If you know the name of the deleted file you may enter it right under the "Drive" dropdownbox. So now your all set to search for deleted files. Hit that button. This may take sometime, so you can do something else in the meantime.

When the program is finished, there will be in the leftpane of the window a list of deleted files that where found. If you cannot find the file you would like to recover, try the another search and with the vacant cluster option enabled. BUt I have to dissapoint you, the file will be lost.

On the other hand you might find the file, so lets restore it.

Select the file;
Push the 'Restore by copying' button;
A Save dialog appears, choose a location other than the drive where you restore from! You might erase the file by copying it!
Push the Save button;
Make another copy of the file as backup.

Now you're ready to view the result. It depends mostly on how much time has elapsed from the moment of deletion and recovery. If it's to long ago you will have garbage, or the file is partly corrupted. In the most positive scenario you'll recover the file in perfect condition.

To summarize, don't waste to much time.

<hr>

Method Two

Again I'll point out that this method is quite risky for your computersystem and might have a negative side effect. You've not only lost your data, but also a working computersystem. Use this method only if you want to recover files very badly. Otherwise use Method One.

Ok it's that bad, your put everything on this horse so to speak. Will let's get on with it.

Be absolute sure that what you have now on your computerscreen might be lost after following this method!

Look a view seconds at your computerscreen. Try to memorize as much detail as you can. Than unplug the computer's powercable. Be very careful by doing this. You might get a flash in the worst sense of the word, so watch out for fire.

Your computersystem will be silent now. Write down the programs you where running before you unplugged the power cable. And ofcourse the names of the files you want to recover and their locations.

Now you have some time to think things over. If it's very important data you want to recover contact a specialised company for doing this. Otherwise you can continue with Step two using programs to detect deleted files.

Step two

There are three methods to try to recover the files.

swap harddrives;
use a boot floppydisk;
use a boot cd-rom or dvd-rom.

If you have a second computer, you might go for this option. Remove the drive where the to recover files exists on, from computer A and put it in computer B. Make sure you have downloaded and installed one of the programs mentioned here. And make sure you won't boot from the harddrive from computer A. Or take the drive to a friend and put it there in a computer.

You can also use a bootfloppy and a floppy with Restoration.

Or you use a cd/dvd-rom Ultimate Windows boot cdrom. Read the manual very carefully.

You need another computer to use this and a Windows XP cd-rom. It's based on the work Of Bart Lagerwij called BartPe

You might use the original linux version the Ultimate Boot cd .

if you're planning to use the floppydrive or the cd/dvd-rom methodm make sure you've changed to boot sequence in the Bios.

When you use one of te programs to detect deleted files and you've found the one you want to recover Do not restore it on the same drive! This might just erase it!.

Some final words

Think things thouroughly through, and be calm. Install after you recover the file one of above recover programs. Make structured backups and even consider using a version control system like Tortoise cvs.

Use a harddrive divided in at least two partitions.

Success and goodluck!

By the way there is also a dutch version of this article!

Er is ook een nederlandstalige versie van dit artikel!