Recovering deleted files

Published on 02/28/2010 by rosevines in Pre-7 Windows, Windows, Windows 7

We all know cats have nine lives, but did you know files have three?

When you create a file, it has its first bite at existence, an existence which continues until you, in your casual god-like manner, delete it. Deleting the file isn’t the end, though. All you need to do is open up the Recycle Bin on your desktop, select the file and drag it onto the desktop or into an Explorer window to recover it. Or simply double-click to open the Recycle Bin, select the file, and choose Restore from the pop-up menu to restore it to its original folder. Voila! Witness the file’s second coming.

Now, what happens if you empty the Recycle Bin? Surely that’s the end of the file’s existence? To all appearances, yes. The file will appear to have been completely annihilated. But that’s only because Microsoft reckons once you’ve deleted a file and emptied the Recycle Bin, you and the file have both had enough chances. But with an undelete utility there’s a good chance you can resurrect the file yet again for its third go at life – good news for those of us whose fingers work faster than our brains.

What won’t recycle

The Recycle Bin may be a marvel – one which most of us take for granted – but it does have its limits. For starters, the Recycle Bin does not catch every file you delete. All files deleted from the desktop or Windows Explorer end up there, as do files deleted from within compliant programs. Files deleted at the DOS prompt, though, bypass the Recycle Bin, as do any files you delete from removeable media such as floppy or Zip disks, and files deleted from compressed folders.

What’s a ‘compliant’ program? You’ll find most reputable commercial programs are compliant. That is, if you delete a file from within one of these programs it will be sent straight to the Recycle Bin, from which you can restore it if you need to.
The only way to check whether a program is compliant is to try deleting a test file, and then look for it in the Recycle Bin:

Open the application you wish to test.
Create a test file and save it.
Use the application’s File -> Open command to display the Open dialog box.
Locate your test file in the list, right-click the file and choose Delete from the pop-up menu.
Check the Recycle Bin to see whether your file has been placed there.

One thing to watch out for is deleting files via macro languages, such as Microsoft Office’s Visual Basic for Applications (VBA). While recent versions of Office are Recycle Bin compliant, if you create Office macros which delete files automatically using the kill [file] statement, those files will bypass the Recycle Bin entirely.

Why files don’t disappear

So, what’s going on? How is it you can delete a file and yet it remains on your disk?

Let’s start by looking at what happens when you delete a file and it’s placed in the Recycle Bin.

In fact, the file is not moved to the Recycle Bin at all. Instead, the file stays in the same place but its directory entry – the complete path and filename of the file – is removed and placed in a hidden folder called Recycled. (Note: If you have more than one drive in your computer, you’ll have a Recycled folder for each drive.) The file is then renamed. The original name and location of the file are stored in a hidden index file, called INFO2 (or INFO, if you’re using Windows 95), located in the Recycled folder.

When you open the Recycle Bin, click a file and choose Restore, the original path is read from the INFO file, the file is renamed and its directory entry restored.

Deleted files are renamed and stored in the Recycled folder, as can be seen in this folder listing displayed in a DOS window.

The Recycle Bin is a FIFO stack: First In, First Out. That means the files you delete earliest are emptied from the Bin first. When the Recycle Bin is full, Windows starts deleting files from the Bin to make room for newly deleted files. It’s only when you right-click the Recycle Bin and select Empty Recycle Bin from the pop-up menu that all files within the Bin are ‘deleted’.

As you can see, files aren’t really erased when you delete them, just renamed and their location hidden from view. So, what about when you empty the Recycle Bin? What happens then?

Once again, the file data is not deleted. Instead, Windows changes the file’s directory entry to indicate the space occupied by this file is no longer needed and is available for use. The data’s still there, but at any time if the operating system needs space for another file, it may be overwritten. Until it is overwritten, the file still exists on the hard disk and is recoverable. That means you dramatically increase the chances of being able to recover a deleted file if you refrain from any subsequent disk activity, such as creating, editing or copying files.

	To delete a file without sending it to the Recycle Bin, select the file (or files) and then press Shift-Del (that is, hold down the Shift key while you press the Del key). You’ll be asked whether you’re sure you want to delete the file. Click Yes.This is a good way to ensure sensitive files don’t remain lurking in the Recycle Bin, but to completely erase all traces of a file you should use a third-party shredder/eraser utility, such as File Shredder (free of charge for personal use).

Undeleting

Unfortunately, at this stage the job of recovering the file is beyond Windows. But it’s not beyond the abilities of numerous third-party unerase/undelete utilities.

Some of the better known undelete utilities are File Recover, WinUndelete and Recuva (the latter is free, but they request a donation if you use the software). Ontrack provides a whole series of undelete tools of increasing power called EasyRecovery. Ontrack also provides data recovery services for those times when your hard disks are failing and you need serious help.

If you need to recover a file immediately, don’t install any of these undelete utilities onto the hard drive where the lost file is located, or you may overwrite its contents. Instead, run the program directly – if it comes on a CD, run it from the installation CD; if it’s an Internet download (as most of them are), instead of saving the file to disk, open and run it from the Internet. WinUndelete makes this easy by offering two downloads: an Installation Package and a Direct-Use Package. If you use the Installation Package, which saves the utility on your hard disk, you run the risk of overwriting the deleted file and making it irretrievable; instead, use the Direct-Use Package which is run directly from the Internet; then there will be no danger of overwriting your files.

Step-by-step: Fixing a damaged Recycle Bin

A. If the Recycle Bin’s INFO file is damaged, your Recycle Bin will appear empty even when it isn’t. You can often restore a file in this situation by searching for the file by name (click Start -> Find -> Files Or Folders, or Start -> Search in Windows XP) and then renaming it.

If you still can’t recover your file, try deleting the INFO file. This will cause Windows to create a new INFO file the next time you restart your system. When you reboot, you may find the files in the Recycle Bin are now accessible. You’ll need to work from a DOS prompt to fix things up. Remember to press Enter after typing each of the DOS commands mentioned below:

Click Start -> Programs -> MS-DOS Prompt to open a DOS command window. (In Windows XP use Start -> All Programs -> Accessories -> Command Prompt.)
To make the Recycled folder the current folder type:

CD \RECYCLED

To unhide the INFO file type:

ATTRIB -H INF*

To delete the INFO file type:

DEL INFO*.

To close the DOS window type:

EXIT

B. Your Recycle Bin may also appear empty if any of the files within it are damaged. In this case, you probably won’t be able to recover the contents of the Recycle Bin, but you can make it function correctly again by doing the following:

Click Start -> Programs -> MS-DOS Prompt. (In Windows XP use Start -> All Programs -> Accessories -> Command Prompt.)
Type:

CD \RECYCLED

Type:

ATTRIB -H DESKTOP.INI

To copy the desktop.ini file to your root folder type:

COPY DESKTOP.INI \

To delete the entire contents of the Recycled folder type:

DEL *.*

To copy the desktop.ini file back to your Recycled folder type:

COPY \DESKTOP.INI

To delete the copy of desktop.ini in the root folder type:

DEL \DESKTOP.INI

To close the DOS window type:

EXIT

C. If the Desktop.ini file is damaged or missing, you can get the Recycle Bin back up and running correctly by creating a new Desktop.ini file within the Recycled folder:

Open the Recycled folder in Windows Explorer (if you can’t locate it, open any folder in Windows Explorer, select Tools Menu -> Folder Options -> View Tab, enable the Show All Files option and click OK).
Right-click in a blank spot and select New -> Text Document to create a new text file. Name the file desktop.ini.
Double-click the file to open it and type the following two lines:

[.ShellClassInfo]

CLSID={645FF040-5081-101B-9F08-00AA002F954E}

Close and save the file, then reboot.

D. The Recycled folder itself can also become damaged. If this is the case, you will be able to send files to the Recycle Bin and the Recycle Bin icon on the desktop will appear full, but you will be unable to view the contents of the Bin and the Empty Recycle Bin command will be unavailable when you right-click the Recycle Bin.

To fix this you must delete the Recycled folder. Windows will recreate it when you reboot:

Click Start -> Programs -> MS-DOS Prompt. (In Windows XP use Start -> All Programs -> Accessories -> Command Prompt.)
Type:

ATTRIB -S -H RECYCLED

Type:

DEL RECYCLED

Type:

EXIT

Reboot your computer.

Be Sociable, Share!

http://yahoo milah

I think I accidentely deleted or uninstalled my sound. I can’t hear anything. When I looked at my sound on my control panel, I couldn’t move anything or everything was gray. Is there a way to get it back? Or is there something I can download? My computer type is an Aspire, part of Windows.
fk

i cant access some folders on my external drive when using the windows explorer option yet through MS command i can actually view some of them.is there way i can get them back?
fk

i cant access some folders on my external drive when using the windows explorer option yet through MS command i can actually view some of them.is there way i can get them back?
I.N

Very good post – an excellent user friendly explanation of the windows file deleting process.

Some readers may also like to know that you can very easily increase the size of your recycle bin;

to increase the size of your recycle bin, simply right click on the recycle bin icon and chose the properties option. You will now have a pop up box appear on your screen. The top section shows the a folder and details the overall size of your hard drive. This may show more than one folder if you have your disk split into partitions or you have more than one hard disk. If this is the case you can select each section and complete the next process for each individual partition and / or disk.

The middle section (three sections all together) – has a heading “Settings for selected location”

Underneath the heading you have two separate selection boxes:

1) Custom size:
Maxim Size (MB) :

2) Don’t move files to the recycle bin. Remove files immediately when deleted.

Obviously for this exercise, we will not be interested in option 2, so ensure you have the first option selected. In the box that is to the right of option 1, this is where you can modify the size of your recycle bin in MB. For example, I have a 500 GB hard drive (465GB in reality) and have set my recycle bin to 100000MB (100GB)

The final section of the pop up box is simply a tick box option for whether you wish to;

“Display delete confirmation dialog”

I would recommend that you have this box ticked. If you uncheck this box, your files will go straight to the recycle bin when you hit delete without asking you if are certain you wish to delete the file or not.

If you have the box ticked, you will continue with the default option of having to confirm you wish to delete an item after hitting delete (much safer)
I.N

Very good post – an excellent user friendly explanation of the windows file deleting process.

Some readers may also like to know that you can very easily increase the size of your recycle bin;

to increase the size of your recycle bin, simply right click on the recycle bin icon and chose the properties option. You will now have a pop up box appear on your screen. The top section shows the a folder and details the overall size of your hard drive. This may show more than one folder if you have your disk split into partitions or you have more than one hard disk. If this is the case you can select each section and complete the next process for each individual partition and / or disk.

The middle section (three sections all together) – has a heading “Settings for selected location”

Underneath the heading you have two separate selection boxes:

1) Custom size:
Maxim Size (MB) :

2) Don’t move files to the recycle bin. Remove files immediately when deleted.

Obviously for this exercise, we will not be interested in option 2, so ensure you have the first option selected. In the box that is to the right of option 1, this is where you can modify the size of your recycle bin in MB. For example, I have a 500 GB hard drive (465GB in reality) and have set my recycle bin to 100000MB (100GB)

The final section of the pop up box is simply a tick box option for whether you wish to;

“Display delete confirmation dialog”

I would recommend that you have this box ticked. If you uncheck this box, your files will go straight to the recycle bin when you hit delete without asking you if are certain you wish to delete the file or not.

If you have the box ticked, you will continue with the default option of having to confirm you wish to delete an item after hitting delete (much safer)
I.N

Very good post – an excellent user friendly explanation of the windows file deleting process.

Some readers may also like to know that you can very easily increase the size of your recycle bin;

to increase the size of your recycle bin, simply right click on the recycle bin icon and chose the properties option. You will now have a pop up box appear on your screen. The top section shows the a folder and details the overall size of your hard drive. This may show more than one folder if you have your disk split into partitions or you have more than one hard disk. If this is the case you can select each section and complete the next process for each individual partition and / or disk.

The middle section (three sections all together) – has a heading “Settings for selected location”

Underneath the heading you have two separate selection boxes:

1) Custom size:
Maxim Size (MB) :

2) Don’t move files to the recycle bin. Remove files immediately when deleted.

Obviously for this exercise, we will not be interested in option 2, so ensure you have the first option selected. In the box that is to the right of option 1, this is where you can modify the size of your recycle bin in MB. For example, I have a 500 GB hard drive (465GB in reality) and have set my recycle bin to 100000MB (100GB)

The final section of the pop up box is simply a tick box option for whether you wish to;

“Display delete confirmation dialog”

I would recommend that you have this box ticked. If you uncheck this box, your files will go straight to the recycle bin when you hit delete without asking you if are certain you wish to delete the file or not.

If you have the box ticked, you will continue with the default option of having to confirm you wish to delete an item after hitting delete (much safer)
I.N

@milah – from your comments, it would seem like you have accidentally damaged you audio settings / codecs / speakers rather than “deleted the sound.”

I will try to help if I can but first need to know:

Which Operating System are you using? i.e: Windows Vista / XP / Windows 7 etc

Has the audio completely stopped working or is it not working when playing media files or anything else?

Are you using a lap top or desk top and if lap top, are you using additional external speakers?

Hope I can help
I.N

@milah – from your comments, it would seem like you have accidentally damaged you audio settings / codecs / speakers rather than “deleted the sound.”

I will try to help if I can but first need to know:

Which Operating System are you using? i.e: Windows Vista / XP / Windows 7 etc

Has the audio completely stopped working or is it not working when playing media files or anything else?

Are you using a lap top or desk top and if lap top, are you using additional external speakers?

Hope I can help
I.N

@milah – from your comments, it would seem like you have accidentally damaged you audio settings / codecs / speakers rather than “deleted the sound.”

I will try to help if I can but first need to know:

Which Operating System are you using? i.e: Windows Vista / XP / Windows 7 etc

Has the audio completely stopped working or is it not working when playing media files or anything else?

Are you using a lap top or desk top and if lap top, are you using additional external speakers?

Hope I can help
I.N

@fk – if you follow the advice of this post and try some of the free programmes that the poster has suggested you may be able to get them back

You could start with the Recuva (link in his post) programme, as it is completely free.

Providing you have not added / copied or moved much data on your hard drive since you deleted the files you want to recover, you will always have a reasonable chance of getting them back.

If there has been a reasonable amount of hard disk activity since deletion, you will probably struggle.

Forensic computer analysts and experts however, have the knowledge and the technology to recover data that has been over written many times. This is why we are now seeing more and more software available for “shredding files” (algorithmic data overwriting). Some world leading military forces use a shredding process named ‘Gutman,’ which uses random characters to overwrite data with 35 passes / overwrites. However, many experts say that overwriting data with random characters with 3 to 7 passes (7 being recommended if you want very high security is sufficient to stop many analysts ever detecting /recovering deleted data. Also, to use the Gutman method you would need a very powerful pc and lots of time. 7 passes can take long enough (dependent on the size of data you wish to securely erase) and most home users will settle for the 3 pass method.

People should note that if they are ever selling or disposing of a pc with the hard drive attached, you should ensure you have overwritten all sensitive data (ideally the whole disk) with at least 3 overwrites (ideally 7) to protect others from ever retrieving the data.
I.N

@fk – if you follow the advice of this post and try some of the free programmes that the poster has suggested you may be able to get them back

You could start with the Recuva (link in his post) programme, as it is completely free.

Providing you have not added / copied or moved much data on your hard drive since you deleted the files you want to recover, you will always have a reasonable chance of getting them back.

If there has been a reasonable amount of hard disk activity since deletion, you will probably struggle.

Forensic computer analysts and experts however, have the knowledge and the technology to recover data that has been over written many times. This is why we are now seeing more and more software available for “shredding files” (algorithmic data overwriting). Some world leading military forces use a shredding process named ‘Gutman,’ which uses random characters to overwrite data with 35 passes / overwrites. However, many experts say that overwriting data with random characters with 3 to 7 passes (7 being recommended if you want very high security is sufficient to stop many analysts ever detecting /recovering deleted data. Also, to use the Gutman method you would need a very powerful pc and lots of time. 7 passes can take long enough (dependent on the size of data you wish to securely erase) and most home users will settle for the 3 pass method.

People should note that if they are ever selling or disposing of a pc with the hard drive attached, you should ensure you have overwritten all sensitive data (ideally the whole disk) with at least 3 overwrites (ideally 7) to protect others from ever retrieving the data.
I.N

@fk – if you follow the advice of this post and try some of the free programmes that the poster has suggested you may be able to get them back

You could start with the Recuva (link in his post) programme, as it is completely free.

Providing you have not added / copied or moved much data on your hard drive since you deleted the files you want to recover, you will always have a reasonable chance of getting them back.

If there has been a reasonable amount of hard disk activity since deletion, you will probably struggle.

Forensic computer analysts and experts however, have the knowledge and the technology to recover data that has been over written many times. This is why we are now seeing more and more software available for “shredding files” (algorithmic data overwriting). Some world leading military forces use a shredding process named ‘Gutman,’ which uses random characters to overwrite data with 35 passes / overwrites. However, many experts say that overwriting data with random characters with 3 to 7 passes (7 being recommended if you want very high security is sufficient to stop many analysts ever detecting /recovering deleted data. Also, to use the Gutman method you would need a very powerful pc and lots of time. 7 passes can take long enough (dependent on the size of data you wish to securely erase) and most home users will settle for the 3 pass method.

People should note that if they are ever selling or disposing of a pc with the hard drive attached, you should ensure you have overwritten all sensitive data (ideally the whole disk) with at least 3 overwrites (ideally 7) to protect others from ever retrieving the data.
http://www.geekgirls.com/articles Rose Vines

I.N: Thanks for helping out with some answers to people’s questions – I appreciate your responses.

Milah: Adding to IN’s comments: You can’t really “delete” your sound, although there are files used for processing and delivering sounds on your system. More likely you’ve messed up your sound settings in some way.

If you reply with the additional info IN requested, we may be able to help you out. In the meantime, try the usual first step when hardware goes wrong: turn your machine off. More specifically:

Turn your computer off.
If you have external speakers connected, check that all the cables are securely plugged in.
If you have external speakers connected, ensure that the power supply is switched on if the speakers have their own power supply.
Turn your computer back on and, before loading any programs, check whether the sound is working via the speaker icon in the right-hand side of the taskbar: click the icon and drag the slider up or down – you should hear a “ding” if the sound is working.
If you’re using a laptop computer, make sure you haven’t disabled the sound via a function key. If you see a function key across the top of your keyboard (it’ll be labelled F1 – F12) with a speaker icon on it, try holding down the Fn key (usually in the lower left of the keyboard) and pressing that speaker key to see whether it has any effect.

- Rose
http://www.geekgirls.com/articles Rose Vines

I.N: Thanks for helping out with some answers to people’s questions – I appreciate your responses.

Milah: Adding to IN’s comments: You can’t really “delete” your sound, although there are files used for processing and delivering sounds on your system. More likely you’ve messed up your sound settings in some way.

If you reply with the additional info IN requested, we may be able to help you out. In the meantime, try the usual first step when hardware goes wrong: turn your machine off. More specifically:

Turn your computer off.
If you have external speakers connected, check that all the cables are securely plugged in.
If you have external speakers connected, ensure that the power supply is switched on if the speakers have their own power supply.
Turn your computer back on and, before loading any programs, check whether the sound is working via the speaker icon in the right-hand side of the taskbar: click the icon and drag the slider up or down – you should hear a “ding” if the sound is working.
If you’re using a laptop computer, make sure you haven’t disabled the sound via a function key. If you see a function key across the top of your keyboard (it’ll be labelled F1 – F12) with a speaker icon on it, try holding down the Fn key (usually in the lower left of the keyboard) and pressing that speaker key to see whether it has any effect.

- Rose
rosevines

I.N: Thanks for helping out with some answers to people’s questions – I appreciate your responses.

Milah: Adding to IN’s comments: You can’t really “delete” your sound, although there are files used for processing and delivering sounds on your system. More likely you’ve messed up your sound settings in some way.

If you reply with the additional info IN requested, we may be able to help you out. In the meantime, try the usual first step when hardware goes wrong: turn your machine off. More specifically:

Turn your computer off.
If you have external speakers connected, check that all the cables are securely plugged in.
If you have external speakers connected, ensure that the power supply is switched on if the speakers have their own power supply.
Turn your computer back on and, before loading any programs, check whether the sound is working via the speaker icon in the right-hand side of the taskbar: click the icon and drag the slider up or down – you should hear a “ding” if the sound is working.
If you’re using a laptop computer, make sure you haven’t disabled the sound via a function key. If you see a function key across the top of your keyboard (it’ll be labelled F1 – F12) with a speaker icon on it, try holding down the Fn key (usually in the lower left of the keyboard) and pressing that speaker key to see whether it has any effect.

- Rose
http://www.geekgirls.com/articles Rose Vines

I.N.: I’m not a big fan of turning the delete confirmation dialog on. I always turn it on when I’m setting up a computer for someone who is not experienced (it’s usually on by default, anyway) so they don’t accidentally delete a file, but for experience users it’s a huge waste of time. I delete dozens of files each day, and that delete confirmation dialog box drives me nuts. I also don’t need it, because I know I can open up the Recycle Bin and recover a file. That’s the joy of the Recycle Bin.

As for adjusting the size of the Recycle Bin, I agree it’s good to set the size to match your needs. Unlike you, though, I tend to make my Recycle Bin much, much smaller, usually reducing the size set by default. I rarely set the Recycle Bin to anything larger than 10G and I often keep it much smaller than that. That’s because I have a tendency to fill even my large hard drives with data, so I don’t want to waste a lot of space on a mammoth Recycle Bin.

However, if you’re someone who works with very large files all the time, video files for example, you may want to increase the size of the Recycle Bin. Deleting large videos can quickly fill the bin and once the bin is full, Windows will automatically start deleting the oldest files in the bin. Once that happens, your chances of recovering such a file start to grow slim.

- Rose
rosevines

I.N.: I’m not a big fan of turning the delete confirmation dialog on. I always turn it on when I’m setting up a computer for someone who is not experienced (it’s usually on by default, anyway) so they don’t accidentally delete a file, but for experience users it’s a huge waste of time. I delete dozens of files each day, and that delete confirmation dialog box drives me nuts. I also don’t need it, because I know I can open up the Recycle Bin and recover a file. That’s the joy of the Recycle Bin.

As for adjusting the size of the Recycle Bin, I agree it’s good to set the size to match your needs. Unlike you, though, I tend to make my Recycle Bin much, much smaller, usually reducing the size set by default. I rarely set the Recycle Bin to anything larger than 10G and I often keep it much smaller than that. That’s because I have a tendency to fill even my large hard drives with data, so I don’t want to waste a lot of space on a mammoth Recycle Bin.

However, if you’re someone who works with very large files all the time, video files for example, you may want to increase the size of the Recycle Bin. Deleting large videos can quickly fill the bin and once the bin is full, Windows will automatically start deleting the oldest files in the bin. Once that happens, your chances of recovering such a file start to grow slim.

- Rose
azlan

try get data back or ontrack easy recovery
azlan

try get data back or ontrack easy recovery
azlan

try get data back or ontrack easy recovery