File Recovery: Find Files You Thought Were Lost F 2/1. Clever Tricks to Recover Deleted Files Even if They ve Been Emptied from the Recycle Bin!

Transcription

1 File Recovery: Find Files You Thought Were Lost F 2/1 Clever Tricks to Recover Deleted Files Even if They ve Been Emptied from the Recycle Bin! With the information in this article you can: Save yourself from the distress of losing important documents Recover deleted files you thought you d never see again Learn the secret techniques used by computer forensics experts This article will show you how to recover files that have been deleted and even emptied from the Windows Recycle Bin. When you have been working on your computer for many hours, or even days, there s nothing quite as awful as the sickening realisation that you ve lost a file. Whether you ve forgotten to save, deleted, overwritten or emptied it from the Recycle Bin, this article is packed with information, tips and free software to help you recover your data. Of course, some files really are gone for good but this article will provide you with the knowledge to judge your chances of recovery, and give you the best possible chance to retrieve that all important lost file. Dr Steve North: If you understand the concepts introduced in this article, then you will find that they apply to other areas of computing, such as safeguarding your personal data. A grasp of how data is physically stored on a hard drive can also be very useful when it comes to troubleshooting problems with your PC. Important action to take when you accidentally delete... a file... F 2/2 Discover the different ways that your important files can go missing... F 2/4 Simple steps to recover missing files fast... F 2/7 Analyse the likelihood of recovering a deleted file... F 2/8 Great free tools to quickly recover deleted files... F 2/12 1

2 F 2/2 File Recovery: Find Files You Thought Were Lost!? If you have lost a file, read this section before you do anything! Text files are easier to recover than purely binary files, such as programs. Reformatting a hard drive does NOT wipe the data stored. Important Action to Take when Yo u Accidentally Delete a File There is nothing more frustrating than accidentally deleting or mislaying an important document that you are working on. If you have just lost a file and you need to recover it, read the rest of this section before you do anything else on your PC. At this point, it is useful to provide some facts about file recovery: You are more likely to be able to recover a textorientated file (a Word document, for example) than an entirely binary file, such as an executable program or a JPEG image. This is because even one error in a binary file renders the entire object unusable. Errors in a textorientated file will still allow you recover most of the text and to replace any omissions. You are more likely to be successful recovering most of a large quantity of lost files (for example, 90% of them might be found). A single lost file is more likely to have been overwritten. The greater the capacity of the hard drive (and/or the more free space it has available), the more likely you are to be able to recover your file. On a small (or very full) drive, Windows will need to re-use redundant space much sooner. Re-installing Windows or re-formatting a hard drive does NOT delete the contents. This is important to remember if you are selling an old PC. If your computer contains confidential or personally sensitive information (work correspondence, for example), reformatting can leave it vulnerable to recovery. The old data will not be visible to Windows, however, many old files may still be accessed by recovery software that 2

3 File Recovery: Find Files You Thought Were Lost F 2/3 examines the disk contents, rather than only looking at the Windows file system. To prevent recovery on an old PC, use a file shredder program such as Eraser, which you will find on the CD accompanying this update. This will write random data to all areas of the drive that Windows regards as available for use. One shredder overwriting cycle (or pass ) is usually sufficient to defeat most commercially available recovery tools. Seven passes is considered military grade and will defeat even the FBI and CIA! Before looking at the subject in greater detail, the following subsections offer some very important advice. Don t empty the Recycle Bin! There are two reasons not to empty the Recycle Bin. Firstly, your file may not actually be lost. It you have deleted your file from Windows Explorer (or My Computer), it may still be in the Recycle Bin. If you suspect that your file is in the Recycle Bin, do not shutdown Windows until you have read the simple recovery steps given on page F 2/7. The Windows Recycle Bin may automatically empty on restart. It depends on its settings. If the content size is close to a preset maximum, everything may be flushed. This is not necessarily the end of your file, but it would be better to recover it directly from the Recycle Bin. Stop working straight away! Later in this article, we will look at why files that Windows considers to be deleted may still actually be on your hard drive. Any subsequent activity on your PC may damage your lost file. Temporary files are created all the time. Programs (including Windows) write log files. Therefore, even restarting and running Windows from the affected drive can overwrite the critical areas containing your deleted files. For example, browsing a single website downloads multiple pictures to your hard drive. Once you have ascertained that To really wipe a drive (or to delete a file), use a shredder program. Don t empty the Recycle Bin until you are certain that your file is not in there. Stop working on your PC if you have a lost or deleted file. 3

4 F 2/4 File Recovery: Find Files You Thought Were Lost Leave your PC turned off until you have considered how to recover the file. your file is not in the Recycle Bin (see the previous subsection), then shut Windows down and leave the computer off until you have decided on the best course of action. It is important to understand that ending activity on your hard drive effectively freezes it in that state. If you carry on using the drive, you are far more likely to lose the file. Whatever you do, avoid the following potentially disastrous actions: Copying files to the drive Installing new software Running large programs that use your hard drive as temporary storage (a swap file) to free up RAM. Examples of this type of program might include: video editing or 3D gaming.!? Your file might have been moved somewhere else or it might be completely invisible to Windows. If you completely forget to save your file it is probably gone for good. Discover the Different Ways that Yo u r Important Files can go Missing There are two types of lost file. Those that the user has lost. This tends to happen as a result of human error, when a file is either never saved, or it is unintentionally dragged to a new location. The second type of lost file is actually no longer visible to Windows. This can happen either as the result of a delete operation (including having been emptied from the Recycle Bin), a hardware error causing corruption of the file contents or the accidental over-writing of the original file with a new version. Virus attack can also cause the deletion of files, contrary to the user s wishes. The various ways to lose a file are as follows: The file was never saved Failure to save a file is a very common cause of data loss. In most cases, this file will not be recoverable, as it only occupied RAM and was not stored on the hard drive. 4

5 File Recovery: Find Files You Thought Were Lost F 2/5 H o w e v e r, some programs regularly create a temporary backup of the current working file. For example, Microsoft Word uses this approach to recover unsaved documents after it has crashed. Major hardware failure If strange noises, or vibrations from the hard drive accompany your loss of data, then the cause is likely to be a serious mechanical failure. In this case, only a specialist recovery service will be able to recover your file. Minor hardware failure If you suspect that your hard drive may be about to fail (for example, occasional mechanical noises, corrupted files and multiple bad sectors revealed during ScanDisk/CHKDSK operations), then you should use the PC as little as possible and try to get an image of the drive. There are many free tools that will allow you to copy every last binary 1 and 0 found on one hard drive to another to create an exact clone. One such tool is PCI Clone Maxx, which you will find on the CD accompanying this update. File lost due to a Windows installation failure If files are inaccessible because Windows is failing to start, the easiest solution is to remove your hard drive and install it as a second drive (a slave ) in another PC. Accidental file deletion using a process protected by the Windows Recycle Bin If you have accidentally deleted a file using a process protected by the Recycle Bin (for example, right-clicked on its icon in Windows Explorer and selected Delete) you have an excellent chance of recovering it. Please see the subsection, Recovering a file from the Windows Recycle Bin, on page F 2/7. Only a recovery specialist can help you with a major hard drive failure. Use a disk-imaging tool to take a data snapshot of your drive, while it is still usable! Put your hard drive in another PC. 5

6 F 2/6 File Recovery: Find Files You Thought Were Lost Corrupted files may be recoverable. The Recycle Bin does not protect all file deletions. Accidentally overwritten files can often be recovered. A corrupted file can t be opened by the software that created it Sometimes a file is present on your hard drive but it refuses to open. There are many possible causes for this. Some examples might be: a virus, a Windows crash, a power failure/surge or a failure of the software that created the file. If this is a text-orientated file, the free recovery tools introduced in this article may allow you to recover some or all of the content. Accidental file deletion using a process not protected by the Windows Recycle Bin The Recycle Bin does not protect certain types of file deletion. These include: files deleted from removable storage such as floppy disks, ZIP disks or flash drives. In addition, files deleted on a remote PC over a Local Area Network (LAN) are not protected by either computer s Recycle Bin. Finally, if a deleted file is larger than the remaining permitted space in the Recycle Bin, it will not be protected. Again, the free recovery tools introduced later in this article may allow you to recover some or all of the content. The Recycle Bin has been accidentally emptied In the event that you accidentally empty the Windows Recycle Bin, recovery may be possible with the tools introduced in this article. Accidentally saving over a previous version of a file A very common error is to accidentally overwrite a file with an unwanted, revised version. Recovery software might be able to find some or the entire original file. Please see page F 2/7 in this article for the subsection on Recovering older versions of Word documents. 6

7 File Recovery: Find Files You Thought Were Lost F 2/7 Simple Steps to Recover Missing Files Fast If you find that you have lost or accidentally deleted an important file, following the simple steps given in this section will usually be enough to get it back for you. Recovering older versions of Word documents Microsoft Word has an option that forces it to save a backup copy, each time a revision is saved. This won t bring back overwritten files, but it will prevent the same thing happening in the future. To enable this feature (Word 2003/2002/2000/97): 1. Start Word. 2. Click Tools > Options > Save. 3. Tick Always create backup copy. 4. Click OK. Recovering a file deleted in Windows Explorer If you have accidentally deleted a file in Windows Explorer, you can undo this process as follows: 1. Do not exit Windows Explorer after the deletion. 2. Right-click in an empty space and then click Undo Delete. Recovering a file from the Windows Recycle Bin To use the Windows built-in file recovery tool: 1. Right-click on the Start Menu and then click Explore. 2. Navigate to the Recycle Bin. 3. Select the file(s) that you want to recover. 4. Click File > Restore. Searching for a lost file to discover where it has been moved If you have lost a file, it is a good idea to do a thorough search of your hard drive to make sure that it hasn t been inadvertently saved in the wrong folder:!? From now on, set Word to save a backup copy. Is your file just in the wrong place? Try a search. 7

8 F 2/8 File Recovery: Find Files You Thought Were Lost Windows XP/2000/Me 1. Right-click Start and then click Explore. 2. Click Search on the toolbar. 3. In Windows XP only: click All files and folders. 4. In the All or part of the file name field (Windows XP) or the Search for files or folders named field (Windows 2000/Me), type the name of the lost file. 5. Select Local Disk (C:) in Windows XP/Me or Local Harddrives (C:) in Windows 2000 from the Look in drop-down menu. 6. Click Search (Windows XP) or Search Now (Windows Me/2000). Windows 98SE 1. Click Start > Find > Files or folders. 2. In the drop-down menu Look in, select (C:). 3. Tick the Include subfolders box. 4. In the Named field type the name of the lost file. 5. Click Find Now. Hard drive platters rotate on a spindle and the head actuator allows read and write operations. Disk tracks contain many clusters and each cluster has one or more sectors. 8!? Analyse the Likelihood of Recovering a Deleted File Before considering how different versions of Windows store files, it is useful to have a basic understanding of how a hard drive works. The disks inside a hard drive are known as platters. Most hard drives have at least two platters, and the larger the storage capacity of the drive, the more platters there are. The platters rotate in unison on a spindle. There are several read/write heads that read and write data to the platters. All the heads are attached to a single head actuator, or actuator arm, that moves the heads around the platters. Data is stored in many thin, concentric bands called tracks. Most hard drives have more than a thousand tracks with each track having many sectors. A sector is the smallest

9 File Recovery: Find Files You Thought Were Lost F 2/9 physical storage unit on a disk, and it is almost always 512 bytes in size. One cluster consists of between 1 and 128 grouped sectors. The cluster sizes vary depending on the capacity of the hard drive and the version of Windows involved. A larger number of sectors in a cluster, means that more of a file can be stored in one location and disk read/write times are consequently improved. As many files are larger than the one or more sectors in a single cluster, the file system has to allocate further clusters. If neighbouring clusters are not available, the additional clusters will be written elsewhere on the same disk. A file stored in this manner is described as being fragmented, because the clusters it uses are spread out across the surface of the disk. In simple terms, Windows keeps track of files using two types of item: A directory entry (a list that contains the filename and a record of the cluster locations). A series of one or more hard drive clusters (where the data is actually located). The exact method used to track a file may vary between versions of Windows. Windows Me/98SE has to use the FAT32 (File Allocation Table) format, whereas Windows XP/2000 can be formatted as either FAT32 or the newer NTFS (New Technology File System). How files are stored in Windows FAT32 drives FAT32 is an enhanced version of the FAT file system that can be used on drives from 512 MB to 32 GB in size. A file in a FAT32 file system is completely described by: its directory entry its entry in the File Allocation Table (FAT) the allocated c lusters on the drive containing the content of the file. A directory entry describes a file and points to the clusters that its data occupies. File data is stored in one or more clusters. FAT32 uses three items to describe a file. 9

10 F 2/10 File Recovery: Find Files You Thought Were Lost These arrows indicate that the first item (the pointer) knows where to find the second item (the pointee) on the hard drive. The FAT entry lists the locations of all clusters used by the file. With three items to go wrong, it is difficult to recover a file. Clusters still exist How FAT32 knows where to find a file Information about a file in a FAT32 file system is spread among three different locations. As shown in the above figure, the Directory Entry parameter first allocated cluster points at the initial cluster that is allocated for the file. It also points to a FAT entry that describes where the remaining parts of the file can be found. Recovering files on FAT32 drives Because information about a file is stored at three different locations it will obviously cause problems if any of these are missing or incomplete. Directory entry exists FAT entry exists Chances of file recovery Yes Yes Yes Excellent Yes Yes No Good- but could be fragmented Yes No Yes Poor file has no name Yes No No Poor file has no name No Yes Yes Impossible filename still visible 10

11 File Recovery: Find Files You Thought Were Lost F 2/11 Clusters still exist Directory entry exists FAT entry exists The above table indicates the likelihood of restoring a lost FAT32 file (using appropriate software), dependent on how many of the three file elements have been recovered. Chances of file recovery No Yes No Impossible filename still visible No No Yes Impossible no trace left No No No Impossible no trace left How files are stored in Windows NTFS drives Please note that Windows XP/2000 can use the FAT 3 2 standard, but it is conventional to make the most of the benefits offered by NTFS. Certainly, it is recommended that you use NTFS rather than FAT32 for hard drives larger than 32 GB. A file in a NTFS file system is completely described by: An MFT (Master File Table) entry The allocated clusters on the drive containing the actual contents of the file. Windows XP/2000 will work with FAT32, but it is conventional to make use of the benefits offered by NTFS. The Master File Table contains all of the data needed to locate a file on disk. How NTFS knows where to find a file 11

12 F 2/12 File Recovery: Find Files You Thought Were Lost Describing a file with two items, improves the chances of recovery. As shown in the previous figure, information about an NTFS file is spread over two different locations. The MFT entry contains both the file s name and where on the drive it is allocated. It should be noted that, for very small files, Windows NTFS does not store data in a cluster, but in the MFT entry itself. The MFT entry contains the file s name, size, date, time and the clusters occupied by its data. Unlike the directory entry in a FAT32 file system, NTFS keeps a complete record of this file s clusters in a run list. Recovering files on NTFS drives As information about a file is stored in two different locations, it will cause problems if either of these is missing or incomplete. Clusters still exist MFT entry exists Chances of file recovery Yes Yes Excellent Yes No Poor file has no name No Yes Impossible filename still visible No No Impossible no trace left This table indicates the likelihood of restoring a lost NTFS file (using appropriate software), dependent on which of the two elements have been recovered.!? Great Free Tools to Quickly Recover Deleted Files On the CD accompanying this article, you will find three great file recovery tools. The best thing is that they are all free! The tools are all compatible with Windows XP/2000/Me/98SE. Software of this type fundamentally works in the same way. The range of features may vary s l i g h t l y, but the principles remain the same. The 12

13 File Recovery: Find Files You Thought Were Lost F 2/13 fundamental thing to understand about Windows file deletion is that it doesn t actually delete anything! When a file is emptied from the Recycle Bin, or otherwise discarded, Windows simply marks that file s directory entry as deleted. It does this by replacing the first character of the file s name with a special character (0xE5). This indicates that the file s clusters are now available for re-use and that Windows can no longer display the file. However, until the clusters are re-used for another file, the data is still present on the disk. Recovery tools work by viewing the disk instead of the file system. It is usually possible to directly view the contents of any cluster, irrespective of whether Windows regards it as available space. If the directory entry is still intact, replacing the special character with any random character will render it visible to Windows again. In some tools, this process is automated. All deleted files that the software finds (by looking for the special character) can be undeleted and output to a new location for identification. However, if the directory entry is damaged or missing, then recovery software can only work by reconstructing a file from its clusters. This can be a time-consuming process and usually only works for textorientated files, where the user can recognise the content. Some recovery programs work on the assumption that (even with a lost directory entry) Windows is likely to have stored a file on clusters that are in close physical proximity on the disk platter. This process can also be automated. In other words, the software attempts to complete the jigsaw puzzle for you. It should be noted that all three software tools recommend that you recover files to a different drive. This can be a hard drive, a CD-RW, a ZIP disk or a Flash drive. If you recover to the disk with the lost file, you seriously risk overwriting your data. Windows may put the recovered files in the free clusters that contain parts of your file. Yes No Test When Windows marks a file as deleted, its clusters are free to be reused for other files. If your file contains text, you may be able to piece it back together, cluster-by-cluster. Always try to recover files to a different drive. 13

14 F 2/14 File Recovery: Find Files You Thought Were Lost The full version of Disk Investigator will show deleted files (those that are largely intact but that Windows has marked as deleted) in red. FreeUndelete This tool recovers accidentally deleted files on the file systems FAT 32 and NTFS. To recover deleted files using FreeUndelete: 1. Start FreeUndelete. 2. In the left-hand pane, select the drive icon where the deleted files are located. 3. Press Scan (selected drive letter). 4. After the scan results are displayed, click Browse and specify a location for the recovered file(s). This will be displayed in Undelete selected file(s) to: This location must be on another drive. This can be a second hard drive, a CD-RW, a Flash Drive or a floppy disk. Recovering files to the same drive could overwrite the files that you are trying to save. 5. From the results of the scan, select the deleted file(s) to be recovered. 6. Click Undelete. 7. Use Windows Explorer to navigate to the location that you selected for the recovered files. Disk Investigator This is a sophisticated data recovery tool that bypasses Windows and directly reads raw hard drive sectors. Please note that the freeware version of Disk Investigator has the following limitations: 1. The Directories view does not show deleted files in red. 2. The Tools > Recover/Undelete all deleted files option is disabled. The disk view can still be used to reconstruct text-orientated files from their clusters by searching for known words or phrases. To use this method: 14

15 File Recovery: Find Files You Thought Were Lost F 2/15 1. Under View select Disk. 2. Click Tools > Search Disk. 3. In the Search for field, type a word or phrase associated with a lost or deleted file. 4. Click Search. 5. When the search has completed (progress can be seen under the right-hand pane), choose an item from the Search Results window and click Locate Item. 6. Click Add this cluster. 7. Repeat for any other clusters from the Search Results window. 8. Click Save to disk. 9. Choose a filename (retaining the file extension.sav) and choose to locate the file on your desktop. 10. Click Save. 11. Now click OK > Close > Quit. 12. Start Notepad. 13. Click on the.sav file on your desktop and then drag it to the open Notepad window. 14. You will need to edit the resulting file as desired. PC Inspector File Recovery This is a file recovery program that supports the following file systems: FAT 12/16/32 and NTFS. To use PC Inspector File Recovery: 1. Click Object > Drive > Logical drives > Rescan drives. 2. Select a drive to search for recoverable files (this will normally be C:). 3. Click on the green tick. 4. When the search process is completed, select the file(s) and/or folder(s) to recover and click Object > Save to. Disk Investigator allows you to grab multiple clusters and sequentially add them to a new file. 15

16 F 2/16 File Recovery: Find Files You Thought Were Lost 5. Using the Windows Explorer-style interface, navigate to the location where you would like your files recovered. Remember that this should ideally be on a second hard drive, a flash drive, a CD-RW or a floppy. Avoid saving to the drive that you are recovering from. One final tip before you go and find that lost masterpiece that the cat deleted! Avoid locating important files in the root directory (usually C:\). If your hard drive has a serious formatting problem, you may have to perform a quick re-format. Surprisingly, most files are recoverable after a format. The only exceptions are files stored in the root directory, as re-formatting disables directory entries (FAT32) and MFT entries (NTFS) at this location. If you need to locate files in the root, try to keep them inside a subfolder If you have lost or accidentally deleted a file you may think that it is gone forever. However, this article has shown you how it can very often be recovered, either using simple strategies, or with advanced file recovery software. 16