Data Recovery: Data Loss and Drive Failures

File Deletion & Recovery

When you delete a file, there are three ways it can be removed. The first is by sending the file to the recycle bin and emptying it. The second way, more of an offshoot of the first, is when a file is too big to fit into the recycle bin (the recycle bin is allowed to use 10% of the drive by default), it doesn’t actually get sent to the recycle bin, but is just removed after a confirmation. The third way that a file can be removed is by selecting the file and pressing the key combination SHIFT + DEL. This removes the file immediately after a confirmation prompt.

Although data may have been deleted and removed, the files are still sitting on the hard drive. The first character of the file name is removed, and as far as the operating system is concerned, the file is gone. However, there is a big “but” to this: certain software packages can recover the deleted file only if the physical space on the drive where the file existed is not overwritten by other data. Basically, the operating system marks the area where the deleted file is as “free space”; a space where data can be again written. Files that have been recently deleted have a better chance of being recovered than older files because of normal hard drive use. The more the drive is used, the more files get written to the drive, thus increasing the chance of overwriting deleted files marked as free space. When you realize a file has been deleted, halt all activities that will write to the drive. Do not run any programs, do not install any programs, and do not save any files on the partition that the file was deleted from. Yes, contrary to belief, while you are web surfing, temporary files are written to the drive, so this activity will need to be ceased as well. There is a greater chance of recovery when you stop writing to the drive. This also includes installing file recovery programs on the hard drive. You may inadvertently overwrite the very file you are trying to recover.

There are third party tools available that that will recover data. However, most are not free. Some are trial, but have all the recovery features you would need. Others may only allow you to view the deleted files and not recover them. This is to get you to buy the full version so the data can be recovered. The software packages listed here are listed under the assumption that the need for data recovery is a one-time emergency, so free and limited trials are valid for use in this case.

Directory Snoop – This limited 25 use trial ($39.95US for a full single license) can recover data from FAT 12/16/32 and NTFS file systems, as well as utterly destroy sensitive information that you may not want to be recovered. Media other than hard drives are supported. This tool is probably one of the better trials available.

DIY Data Recovery – There are several utilities from this company, both free and trial downloads. DiskPatch (trial, data cannot be recovered; $39.95US for a single full licence), iRecover (trial, only one directory can be recovered at a time; $49.95US – $99.95US for a full single license), MBRtool (Free), HD Workbench (Trial; $19.95US for a full single license), and CHK-Mate (trial; $11.95US for a full single license) are all available for FAT, FAT32 and NTFS file systems. DiskPatch works with partition table and MBR (Master Boot Record) repairs. iRecover is their primary data recovery program. MBRtool runs repairs on the MBR and track 0 of the hard drive. HD Workbench performs boot sector repairs, disk scans, and bad sector data recovery. Last but not least, CHK-Mate can recover data from scandisk/chkdsk’s *.chk files.

Fast File Undelete – This free trial (a quick registration required; $24.99US – $29.99US for a full single license) can recover data from FAT 12/16/32 and NTFS file systems, and surprisingly, can be run off of a floppy disk, which makes a nice alternative for those of you without access to an alternate computer. The downside is that the trial can only recover files that are no more than 15KB in size.

File Scavenger – This limited 30 day trial ($39.95 for a single full license) only supports NTFS file system recovery with a file size recovery limit of 32KB. It is stated on the website that recovery off of a damaged striped RAID array is possible.

PC Inspector File Recovery – This free tool can recover data from FAT 12/16/32 and NTFS file systems, but the big limitation of the program is that it can only recover specified file formats.

Ontrack EasyRecovery DataRecovery – This free trial package (a quick registration required for trial; $89-$94 for a single full license) also offers recovery support for FAT 12/16/32 and NTFS file systems, in addition to recovery off of more forms of media than just hard drives. The downside is that it needs a relatively large amount of space to install: 150MB. This is problematic if you don’t have an alternative machine to install it onto in an emergency. Otherwise, it’s a impressive package.