Jump to content

Undelete?


technoid

Recommended Posts

Hello,

Last weekend, I accidentally permanently-deleted (shift+del) about 80gb of files and folders. Of course, would like them ALL back, or most, if it can't be helped.  I don't know what happened, I only wanted to delete a subfolder's worth of files, but instead deleted a bunch of other folders with files. Perhaps my mouse button got stuck or something and drag-highlighted them, who knows.  But I knew something was wrong as when it was in the process of deleting, it was taking longer than expected and the popup delete window listed "hundreds" of gigabytes rather than only a few gigs. After a few seconds I quickly canceled, but by that time I already lost ~80gb. Better than the hundreds of gigs though that it was about to kill.  It has been probably 10-15 years since I've done anything like this and obviously was not on Win 7 (probably 98SE or XP, can't recall), so I need some refreshing. Or if Win 7 has an undelete of its own?

This is on a Win 7 laptop.  I've googled for freeware undelete apps, but not sure which one is the best. Yes, I would prefer freeware if possible. I only saved one file on purpose that was only a few kilobytes long so don't know if it saved over one of the lost files.  Before the delete, the drive only had about 1.5gb.  After losing the 80gb, the capacity went up to ~81.5gb.  I have not touched the laptop in about a week.  Also, once an undelete software is chosen, how do you install it on the drive without it potentially overwriting these deleted files? Or can it be run on a memory stick or burned cd?

Anyway, need your help on this delicate matter, thanks.

Link to comment
Share on other sites


It's good that you didn't use the laptop, otherwise your chances would have been few, after a week.

I've only tried the free Recuva once, but it managed to find something.
https://www.piriform.com/recuva/features/portable-version

Just put the program on a usb stick and run from it.
(in theory, you shouldn't even boot from the disk containing the deleted files, but that would mean moving it to another pc)

Good luck!


 

Edited by phaolo
Link to comment
Share on other sites

Ideally you should boot from another OS (Windows PE or Live Linux or similar) and image the disk "as is" to another device (external USB hard disk).

Then, if all was done was to SHIFT+DEL, almost *any* undelete software can recover that data (unless entries or data were overwritten), each program may have its own method/algorithms to find and restore deleted files, since you know which files you deleted, Recuva would do (an issue with it is in my experience that usually lists more files than it can actually recover successfully), personally I would use DMDE:
http://dmde.com/

and/or Testdisk:
http://www.cgsecurity.org/wiki/TestDisk

http://www.cgsecurity.org/wiki/Undelete_files_from_NTFS_with_TestDisk

but they are most probably "overkill" for just recovering deleted files, even ntfsundelete from a Live Linux would do.

All in all, if you don't have such a bootable "live" OS, I would recommend you to use sysrescd:

http://www.system-rescue-cd.org/SystemRescueCd_Homepage

which includes Testdisk and is rather easy to setup/make into a bootable CD or USB stick.

You will need anyway (besides the CD/DVD or a USB stick) an external (USB) hard disk as target for storing the recovered files.

jaclaz

Link to comment
Share on other sites

Thanks for the replies so far guys...

Ok so DMDE looks like a good candidate, it's only about 1 mb and can be used on usb. However, the description says the freeware version has some kind of recovery limitation, but not sure exactly what it's saying:

"DMDE has a number of freeware features such as disk editor, simple partition manager (e.g. allows partition undeleting), a tool to create disk images and clones, RAID constructor, file recovery from the current panel. Paid editions support file and directory recovery without the restriction, DMDE Professional Edition has additional features to recover data for clients (compare editions)."

What restriction??  
 

Link to comment
Share on other sites

  • 3 months later...

Update:  Ok, so finally, got this all finished up last weekend. I was in no hurry, but 3 months downtime makes me wish I could've hurried a little more, heh. Purchased a new 500gb drive and drive enclosure (with eSATA III & USB 3), for a total of just under $45, as external backup device a couple weeks before. I used the eSATA mode since that is the fastest method of my 6 year old laptop. I used DMDE shareware, as was recommended above, and put it on a USB stick. Never used file recovery tools before so it was at first confusing but was able to figure out the basics.  I found out what they meant by "directory recovery is only with paid editions".  In freeware mode, which is what I used, only per-file recovery is available. You cannot just click on a folder you want to recover. So what I did was manually add the necessary folders (and any nested folders) on the backup drive and then recovered the files into their designated directory. Then recovered files in next nested directory, etc.

Unfortunately I was only able to recover 70gb instead of the 80gb I lost, because I recalled I did do some file activity that I forgot about, approximately 5gb's worth, right after I lost the 80gb, so that's probably why I couldn't find 10gb of it in dmde's file recovery windows.  The recovered files were in mostly good condition. However, a few of the files are actually backup copies of DVD movies and when I recovered entire movie folders and then run them as usual, it didn't work, but most of the VOB's seem to run fine by themselves. I can always recopy the movies. Or I can always try re-authoring, which is something I've never done before, so this looks like an opportunity to learn that skill.  I also keep a changelog on all my computers, for hardware and software changes, so luckily I was able to read my records and trace what other possible files of the 10gb that are lost forever that were not seen in the file recovery window.

Anyway, thanks all for the help.

Link to comment
Share on other sites

Yep, it is likely that would explain the lost 10 Gb, though usually (but not always) the just deleted files are not overwritten, most probably that happened because you had a rather full volume and/or the single files were rather big and/or the volume was not (or was too recently :w00t:) defragmented.

With Windows 7 (and later are much worse) the "background" or "idle"  defragmenting/optimizing of the file system may also have played a part in that, the only "safe" way to prevent modifications on a mounted volume is to (literally) pull the plug out (or remove the battery in the case of a laptop) immediately cutting power off the device (whatever theoretical damages the file system may suffer by stopping the system this way, like non flushed cache, etc. are very likely to be less destructive).

jaclaz
 

Link to comment
Share on other sites

54 minutes ago, jaclaz said:

the "background" or "idle"  defragmenting/optimizing of the file system may also have played a part in that

On Windows 8 you can easily disable this from C:>Properties>Tools>Disk optimization (Translated from greek, it may say "utilities" instead of "tools"). I suppose it is the same on Windows 7?:unsure:

Link to comment
Share on other sites

8 minutes ago, HarryTri said:

On Windows 8 you can easily disable this from C:>Properties>Tools>Disk optimization (Translated from greek, it may say "utilities" instead of "tools"). I suppose it is the same on Windows 7?:unsure:

Well, you just deleted by mistake some 80 Gb of precious files, you are understandably preoccupied/under stress, it is unlikely that you would remember that, as well most - if not all - people will continue fiddling with the computer for hours, while I was trying ot make the point that the best (in the sense of action that provides the most probabilities of recovering deleted or lost files) thing to do is easy, pull the plug, as soon as you can, even shutting down the device through the OS could make things worse.

Every hour, minute, second the machine is on there is a higher risk of *something* overwriting *something else*.

jaclaz

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...