Using Salvage to recover accidently deleted or overwritten files

Transcription

1 Background: Ian Belton (June 2010) Using Salvage to recover accidently deleted or overwritten files When a file is deleted or overwritten, it is actually still possible to undelete it. This option is called Salvage. Files only stay in a salvage list for a period of time that depends on how much free space is on the server - typically between 1 and 2 weeks. Contents: 1. Salvaging a deleted/overwritten file 2. Salvaging a file that been edited 3. Salvaging a deleted folder 1. Salvaging a deleted/overwritten file Sometimes files are accidently deleted or overwritten. It is possible to salvage a file using the Salvage Files option on a Windows PC. In the screenshot below, the file deleted was located in the folder called folder1. Right click the folder and you will see a pop up menu - choose Salvage files.

2 You will then see a list of files that can be salvaged. Using the columns as guidance to help you decide, simply highlight the file from the list and click the Salvage File button. The file will then be salvaged and placed back in the folder. 2. Salvaging a file that been accidently edited The steps outlined above can also help salvage files that have been accidently overwritten using some programs. However using the latest version of Office, when a file is edited and saved, there is no file to salvage. This is because Office writes a copy of the file as a temporary file. This can be exploited to recover accidently edited files on a Windows PC. Firstly identify the folder the overwritten file was located in in the example below the file was in a folder called Work important. Right click the folder and you will see a pop up menu - choose Salvage Files below you will see a screenshot of what to look for.

3 Next you will see a list of files that are salvageable. Microsoft Office temporary files have a random name of alpha numeric characters with an extension.tmp. The size of the list will depend on how frequently the files in the folder have been edited. The file that needs salvaging may take some working out you will have to use a combination of deletor name, date, time and size to work out which one. See the screen shot below for an example of what you should see. Hint! If you deleted a section of text or data from within your Office file, then you are likely to be looking for the largest File Size that is listed. To salvage the tmp file you should highlight it in the list and then click the Salvage File button. It is possible to salvage multiple files, but it may be confusing to salvage too many in one go! Next you should rename the tmp file to new file name to allow you to open the file, so if the file was a word document, rename the file to something like temp1.docx

4 Next try opening the file to see if it is the correct version simply open the file in you preferred way or you can simply double click it. You can repeat the above procedure as many times as you wish if the file that was salvaged was not the correct one. 3. Salvaging a Folder It may be that a folder has been deleted. In this case you must salvage the folder first, and then salvage the files that were within the folder. Right click on the parent folder of the deleted directory in the example screenshot below the deleted folder was located in the u: drive.

5 Now look for the name of the folder that was accidently deleted. In this screenshot below the deleted folder was called Work - important Highlight the folder name and click the Salvage file button. Having salvaged the folder it is then possible to salvage the files that were within the folder. Right click the folder and choose the Salvage Files option. Here you will see a list of files. Often it will be easiest to sort these files by the Time Deleted column since the files would have all been deleted at the same here. In the screen shot example below we can simply recover the files that were deleted at 11:32:48. It is possible to highlight multiple files at the same time and they will all be salvaged into the folder.