Wednesday, October 1, 2008

Recover deleted files

How many times have you deleted a file, emptied the Recycle Bin, and then had that sinking feeling in your gut. You need one of those files. Or maybe you just had a hard-disk crash, and suddenly all the files have disappeared.

I'll tell you how to recover your files, and show you how to do it, in this video.

For this example, I'm going to use a USB drive. But the same thing applies to most data drives. If your disk is still readable by the computer, you can recover all kinds of cool stuff.

See when you delete data it's not actually wiped off the disk. When a file is written to the disk, its location is noted. So the system knows where to go to read that file--kind of like a book index.

When you delete a file, the system removes the entry in the table. The file appears to be gone. This is akin to me blacking out or even tearing out the entry in the book's index.

The file itself stays on the machine, though. Just like Page 9 is still in the book even if I rip out the index page that refers to Page 9. But don't forget the computer thinks that location was empty. So if another file was written to that area, you may only recover part of a file.

Regardless of how your lost file was deleted, if you haven't performed many--if any--operations on the disk, you have a good chance of recovering it.

I'm going to use PhotoRec from cgsecurity.org, a free and open-source program, in my example. There are a lot of other programs to choose from, such as PC Inspector File Recovery.

Let's say I have a few MP3s on a USB drive, then I accidentally delete them.

No worries.

Just launch PhotoRec. Your USB thumbdrive should show up. Select it and make sure "proceed" is highlighted then press "enter."

Then you need to tell PhotoRec what kind of file system the machine uses. If it's Windows NTFS or FAT32, choose Intel. If you formatted the disk from a Mac choose "EFI" for Intel Macs and "Mac" for G4s or older.

If the disk has more than one partition, you'll need to choose which one to scan. Otherwise, choose the only partition available and make sure search is selected.

Then tell it what file system was used. FAT/NTFs/HFS for Windows and OS X, and EXT for Linux systems.

Next, you can tell it to look only at the unused space, which is faster, or if you're obsessive, choose to extract files from the whole partition.

Finally, tell the program where to store the files. It will suggest a folder based on where PhotoRec is running from. Just don't choose the drive you're scanning as the location. Then press "Y" and let it do its work.

Once it's done, look in the folder you specified earlier. You may have a lot of little pieces of files but you should also have some of the files you thought lost. If you're lucky, you may have all of them.

No comments:

Your Ad Here
Custom Search

Enter your email address:

Delivered by FeedBurner