Recovering deleted files

Published on 28th February 2010 by rosevines in Pre-7 Windows, Windows, Windows 7

We all know cats have nine lives, but did you know files have three?

When you create a file, it has its first bite at existence, an existence which continues until you, in your casual god-like manner, delete it. Deleting the file isn’t the end, though. All you need to do is open up the Recycle Bin on your desktop, select the file and drag it onto the desktop or into an Explorer window to recover it. Or simply double-click to open the Recycle Bin, select the file, and choose Restore from the pop-up menu to restore it to its original folder. Voila! Witness the file’s second coming.

Now, what happens if you empty the Recycle Bin? Surely that’s the end of the file’s existence? To all appearances, yes. The file will appear to have been completely annihilated. But that’s only because Microsoft reckons once you’ve deleted a file and emptied the Recycle Bin, you and the file have both had enough chances. But with an undelete utility there’s a good chance you can resurrect the file yet again for its third go at life – good news for those of us whose fingers work faster than our brains.

What won’t recycle

The Recycle Bin may be a marvel – one which most of us take for granted – but it does have its limits. For starters, the Recycle Bin does not catch every file you delete. All files deleted from the desktop or Windows Explorer end up there, as do files deleted from within compliant programs. Files deleted at the DOS prompt, though, bypass the Recycle Bin, as do any files you delete from removeable media such as floppy or Zip disks, and files deleted from compressed folders.

What’s a ‘compliant’ program? You’ll find most reputable commercial programs are compliant. That is, if you delete a file from within one of these programs it will be sent straight to the Recycle Bin, from which you can restore it if you need to.
The only way to check whether a program is compliant is to try deleting a test file, and then look for it in the Recycle Bin:

  1. Open the application you wish to test.
  2. Create a test file and save it.
  3. Use the application’s File -> Open command to display the Open dialog box.
  4. Locate your test file in the list, right-click the file and choose Delete from the pop-up menu.
  5. Check the Recycle Bin to see whether your file has been placed there.

One thing to watch out for is deleting files via macro languages, such as Microsoft Office’s Visual Basic for Applications (VBA). While recent versions of Office are Recycle Bin compliant, if you create Office macros which delete files automatically using the kill [file] statement, those files will bypass the Recycle Bin entirely.

Why files don’t disappear

So, what’s going on? How is it you can delete a file and yet it remains on your disk?

Let’s start by looking at what happens when you delete a file and it’s placed in the Recycle Bin.

In fact, the file is not moved to the Recycle Bin at all. Instead, the file stays in the same place but its directory entry – the complete path and filename of the file – is removed and placed in a hidden folder called Recycled. (Note: If you have more than one drive in your computer, you’ll have a Recycled folder for each drive.) The file is then renamed. The original name and location of the file are stored in a hidden index file, called INFO2 (or INFO, if you’re using Windows 95), located in the Recycled folder.

When you open the Recycle Bin, click a file and choose Restore, the original path is read from the INFO file, the file is renamed and its directory entry restored.

Deleted files are renamed and stored in the Recycled folder, as can be seen in this folder listing displayed in a DOS window.

The Recycle Bin is a FIFO stack: First In, First Out. That means the files you delete earliest are emptied from the Bin first. When the Recycle Bin is full, Windows starts deleting files from the Bin to make room for newly deleted files. It’s only when you right-click the Recycle Bin and select Empty Recycle Bin from the pop-up menu that all files within the Bin are ‘deleted’.

As you can see, files aren’t really erased when you delete them, just renamed and their location hidden from view. So, what about when you empty the Recycle Bin? What happens then?

Once again, the file data is not deleted. Instead, Windows changes the file’s directory entry to indicate the space occupied by this file is no longer needed and is available for use. The data’s still there, but at any time if the operating system needs space for another file, it may be overwritten. Until it is overwritten, the file still exists on the hard disk and is recoverable. That means you dramatically increase the chances of being able to recover a deleted file if you refrain from any subsequent disk activity, such as creating, editing or copying files.

To delete a file without sending it to the Recycle Bin, select the file (or files) and then press Shift-Del (that is, hold down the Shift key while you press the Del key). You’ll be asked whether you’re sure you want to delete the file. Click Yes.This is a good way to ensure sensitive files don’t remain lurking in the Recycle Bin, but to completely erase all traces of a file you should use a third-party shredder/eraser utility, such as File Shredder (free of charge for personal use).

Undeleting

Unfortunately, at this stage the job of recovering the file is beyond Windows. But it’s not beyond the abilities of numerous third-party unerase/undelete utilities.

Some of the better known undelete utilities are File Recover, WinUndelete and Recuva (the latter is free, but they request a donation if you use the software). Ontrack provides a whole series of undelete tools of increasing power called EasyRecovery. Ontrack also provides data recovery services for those times when your hard disks are failing and you need serious help.

If you need to recover a file immediately, don’t install any of these undelete utilities onto the hard drive where the lost file is located, or you may overwrite its contents. Instead, run the program directly – if it comes on a CD, run it from the installation CD; if it’s an Internet download (as most of them are), instead of saving the file to disk, open and run it from the Internet. WinUndelete makes this easy by offering two downloads: an Installation Package and a Direct-Use Package. If you use the Installation Package, which saves the utility on your hard disk, you run the risk of overwriting the deleted file and making it irretrievable; instead, use the Direct-Use Package which is run directly from the Internet; then there will be no danger of overwriting your files.

Step-by-step: Fixing a damaged Recycle Bin

A. If the Recycle Bin’s INFO file is damaged, your Recycle Bin will appear empty even when it isn’t. You can often restore a file in this situation by searching for the file by name (click Start -> Find -> Files Or Folders, or Start -> Search in Windows XP) and then renaming it.

If you still can’t recover your file, try deleting the INFO file. This will cause Windows to create a new INFO file the next time you restart your system. When you reboot, you may find the files in the Recycle Bin are now accessible. You’ll need to work from a DOS prompt to fix things up. Remember to press Enter after typing each of the DOS commands mentioned below:

  1. Click Start -> Programs -> MS-DOS Prompt to open a DOS command window. (In Windows XP use Start -> All Programs -> Accessories -> Command Prompt.)
  2. To make the Recycled folder the current folder type:
  3. CD \RECYCLED

  4. To unhide the INFO file type:
  5. ATTRIB -H INF*

  6. To delete the INFO file type:
  7. DEL INFO*.

  8. To close the DOS window type:
  9. EXIT

B. Your Recycle Bin may also appear empty if any of the files within it are damaged. In this case, you probably won’t be able to recover the contents of the Recycle Bin, but you can make it function correctly again by doing the following:

  1. Click Start -> Programs -> MS-DOS Prompt. (In Windows XP use Start -> All Programs -> Accessories -> Command Prompt.)
  2. Type:
  3. CD \RECYCLED

  4. Type:
  5. ATTRIB -H DESKTOP.INI

  6. To copy the desktop.ini file to your root folder type:
  7. COPY DESKTOP.INI \

  8. To delete the entire contents of the Recycled folder type:
  9. DEL *.*

  10. To copy the desktop.ini file back to your Recycled folder type:
  11. COPY \DESKTOP.INI

  12. To delete the copy of desktop.ini in the root folder type:
  13. DEL \DESKTOP.INI

  14. To close the DOS window type:
  15. EXIT

C. If the Desktop.ini file is damaged or missing, you can get the Recycle Bin back up and running correctly by creating a new Desktop.ini file within the Recycled folder:

  1. Open the Recycled folder in Windows Explorer (if you can’t locate it, open any folder in Windows Explorer, select Tools Menu -> Folder Options -> View Tab, enable the Show All Files option and click OK).
  2. Right-click in a blank spot and select New -> Text Document to create a new text file. Name the file desktop.ini.
  3. Double-click the file to open it and type the following two lines:
  4. [.ShellClassInfo]

    CLSID={645FF040-5081-101B-9F08-00AA002F954E}

  5. Close and save the file, then reboot.

D. The Recycled folder itself can also become damaged. If this is the case, you will be able to send files to the Recycle Bin and the Recycle Bin icon on the desktop will appear full, but you will be unable to view the contents of the Bin and the Empty Recycle Bin command will be unavailable when you right-click the Recycle Bin.

To fix this you must delete the Recycled folder. Windows will recreate it when you reboot:

  1. Click Start -> Programs -> MS-DOS Prompt. (In Windows XP use Start -> All Programs -> Accessories -> Command Prompt.)
  2. Type:
  3. ATTRIB -S -H RECYCLED

  4. Type:
  5. DEL RECYCLED

  6. Type:
  7. EXIT

  8. Reboot your computer.
Share or print this article:
  • Facebook
  • Twitter
  • Digg
  • del.icio.us
  • StumbleUpon
  • FriendFeed
  • Netvibes
  • Reddit
  • Mixx
  • email
  • Add to favorites
  • Print

Related posts:

  1. Viewing and organising files
  2. Quickly copy a folder’s contents
  3. Using the handy SendTo command
  4. Customising Windows
  5. Understanding Libraries
  • Jegfzysm
    i emptied the recycling bin that contained a folder of precious photos that mean very much to our family. i need it back how can i get it?
  • Gosu Goku
    Do you understand the article?
  • Melissa_mitchell_695
    hi i recently deleted something on my flash drive and it is not in recycle bin how do i recover it
  • La_bella_india
    D drive not being detected even though it opens and I her it
  • kkoutsogiannis
    hi, I once rebooted my netbook while connected to my Passport external drive but I did not pay attention in the process. Later, I found out that one of my major folder with my photos was missing and at the same place was created a single file without extension nut with the same name. Any ideas what to do to recover my files?
  • 21taylor
    I tried to uninstall an application, which ended up being unsuccessful, but in doing so it deleted other files that were saved in the same folder. These were Excel, Word, PowerPoint and PDF documents. They did not go to the recycle bin. Is there any way I can recover these files?

    Help desparately needed . . .
  • Lew
    Hey I just did something stupid and I don't think GeekGirl or anyone else can recover my file. I created a file with the same name as another . . . however, they are both totally different written reports which I would like to retain but I think the original is now lost for good.
    Is the file gone for good or not?
  • Luda
    how do i made a directory using command prompt
  • Shane P. Cauley
    Hey this is great! Thanks for the info.

    Shane P. Cauley

    Cheyenne, Wyoming
  • Tracie
    anyone know how I can recover a deleted address folder step by step?
  • Tracie: What do you mean by "deleted address folder"? Do you mean a contacts folder in your email program? If so, which email program (and which operating system are you using)?
  • Luke: Use the same technique you use to get very unimportant things back (see above). :-)
  • Luke
    I recently deleted something which had some VERY important things on it. Is there a way i could get it back?
  • Sue H: It's hard to tell what's happened to your documents without more info. Could you have accidentally moved them? Do you share your computer with someone else who might have moved them?

    Have you tried using Windows search to track down the files in case they've been moved yet again? That'd be my starting point. You can search for files using their filenames or, if they're documents, by searching for words or phrases within the files. If you do locate them, by the way, how about backing them up onto an external drive so you can't lose them completely.

    I'd certainly run antivirus and anti-spyware software to check if something nasty is lurking on your system, but this doesn't really sound like malware at work. Before you run a scan, you might want to see whether you can use the Direct Use version of < href="http://www.winundelete.com">WinUndelete to recover the missing files.

    Arie: You, too, should try Windows search to track down the files. They may have been moved somewhere else on your computer. Also, if you run a file recovery tool on the folder, it should let you see whether they've been deleted. I'd also stop letting that friend use my computer.
  • Mike M: Once again, I recommend you try one of the unerase/recovery tools I mentioned in the article or in my reply to Aimee above.
  • Carolyn: Here's what you do: make it a rule to never directly edit files sitting on removable drives. Copy the file to your local hard drive first, then edit the file, then copy it back.

    There are two reasons to do this. First, the chances of something going wrong while editing a file on a removable drive (especially a USB drive, but also USB cable drives) is far greater than when editing a file on your internal hard drive. The cable can come loose (as you've discovered), your USB port could fail, there could be a momentary glitch (one of my USB ports has a tendency to "disappear" every now and then). All sorts of things can go wrong.

    Second, if you copy the file to your hard drive and work on it there, you now have two copies of the file. If something goes wrong while you're editing the copy on your hard drive, you can always retrieve the one sitting untouched on your USB drive.

    I treat all my external drives purely as storage. I don't edit the files on them, ever. This applied in the days of floppy disk drives and zip discs (anyone remember those technologies?) and it applies to external drives now.

    In the meantime, you can try one of the utilities I recommended to Aimee to try to recover your deleted files.
  • Aimee: There are plenty of file recovery programs that work on flash drives as well as on your computer's hard drives. Often, the chances of recovery from such a drive are greater because you're less likely to have overwritten the file by copying new ones to the drive, whereas with hard drives we're copying and moving all the time and thus obliterating deleted files. Just remember: don't copy anything else to the USB drive until you've attempted to undelete your deleted file, or your chances of recovering the file will plummet.

    Do a Google search for "recover deleted files usb flash" and you'll come up with a bunch of utilities that might get your game file back. Or check out Pandora Recovery, a free program specifically for USB and secondary drives, or DiskInternals Uneraser (this company also makes an undeleter specifically for camera flash drives).
  • Aimee
    AWESOME POST!!!! I have a question for you. I deleted a file from my R4 game by mistake. It was on a USB so it is not in the recycling bin. Is there any way to get it back??
  • arie
    i want to know how i can figure out if files in a folder were moved on my comp or if they were deleted. can i see the name of them even after they were deleted out of the recycle bin. im running 7 starter on a Asus Eee netbook. please help me. i really need to find out if they were moved or deleted because the files were very private. i let my friend go on my comp and i think he deleted the files and even out of the recycle bin and now im pissed off because i can never get those files back. unless anyone knows, (if they were deleted), how i can recover them from beyond the grave. and can i see by going to properties on the folder the files were deleted out of can i see if they were moved or deleted. it only says that the folder was updated, at the time i gave my comp to my friend.
  • successme1
    I suddenly lost all of my files in my documents on my laptop MS OS XP. I found in another folder. Somehow they were moved from My Documents to a new folder that I did not create.

    The next time I booted up all of my files were gone from My Documents and from the new folder. In their place was a file called desktop.ini. When I tried opening this file it said all documents were deleted. I checked the trashbin which was also empty. Is this spyware? A virus? Is there a way to recover these files?
blog comments powered by Disqus