Accidentally Deleted File FAQ

This response assumes you have unsuccessfully searched the recycle bin and your backups for the file. If it is not in either of these places there is still hope. We can probably recover it for you if you do not panic! Read the rest of this tutorial before you do anything else!

1. Stop using the Internet, as temporary files are created while you surf, and these may be stored in the area of the disk that holds the file you wish to recover.
2. Do not save any more files for the same reason, the best chance for recovery is when you shut down the computer until the file recovery is done.
3. If you don't have an undelete utility on your computer, don't install one now! Finding and installing one violates rules both 1 and 2 and diminishes the chances for recovery. Also you need to practice using one when your data is not at risk.
4. The best plan is to shut the computer down and don't boot it again until help arrives.
5. Ask yourself, would a good backup plan have saved me this grief? Consider NTbackup (free, comes with Windows), or Norton Ghost $80. Windows 7 and up have a good built in tool called "backup".

The way that individual files are stored and erased depends of the file system type. There are two main systems in use on PCs using Windows operating systems. The older system is called FAT and the newer scheme is called NTFS.

FAT file system:

The FAT file system is the most common on older computers, and is the file system used by Windows 95 & Windows 98. Deleting a file only removes it from an index of files on the disk. The contents of the individual file is not erased! Nearly all of the details are left in the index (directory), all except for the 1st character in the 8.3 file name which is changed to H.E5. In addition for FAT file systems, the index table entries that points to the data area of the file are erased and made available for reuse. This 2nd point is not a problem if the file is not fragmented, as the directory also has a pointer to the first part of the file. Therefore all new file creation must stop, or there is a chance that the area holding the file contents will be re-used, or the directory entry will be reused. Once the data area is reused the contents are gone forever, unless extremely difficult and expensive recovery techniques are used. Only governments and spying organizations can afford the cost of recovering data that way. If the file is not fragmented, the directory entry has both a pointer to the start of the data, and the length of the file, which is all that is needed. If the data area has not yet been reused, the file can be 100% recovered. If a file is fragmented, but not reused, the first fragment can be recovered, but subsequent fragments are very hard to find, similar to a needle in a haystack.

NTFS file system:

For an NTFS file system, deleting a file only marks its entry an index of files on the disk, called the MFT as unused. The data is not modified. Compared to FAT file systems, there is much less of a problem with fragmented files. As long as the data area has not been reused, and the MFT entry has not been reused, the file typically can be 100% recovered. For this reason, the NTFS file system is the best choice if you ever expect to recover an accidentally deleted file. It is in every way the better of the two file systems.

A program running on another external disk or external USB flash drive analyzes the table of contents and looks for entries marked as deleted. In some cases we use a different operating system to run an undelete program so that running this program does not read or write any files on your C: drive. It first tries to change the entry to "not deleted" and restore the file’s name. If this does not work, then it can scan through the disk, looking in the “unused areas” for possible blocks of the disk that hold your data.

In the older FAT file systems, only the first letter of the file name is zeroed in the disk table of contents entry, and the FAT's (File Allocation Table) which points to the data area is marked as unused. The data storage area is untouched when it is deleted. The recovery program finds the deleted directory entry, and assumes the data is contiguous, (not fragmented) and uses the directory pointer to the first data area, and the length to restore the file. If the file is fragmented, then it can try to guess which blocks of data area holds additional parts of the file, but this is "a long shot" and frequently does not work. If the directory is reused, but the file is not fragmented, and the data area has not been reused, these can be recovered as "lost files". The exact size, file name and modification date and other attributes are all lost, and has to be supplied by hand.

If you have an NTFS file system, your data can be recovered even if it is fragmented, as long as the master entry (MFT) has not been reused, and the data area occupied by the file has not been reused. When you have an NTFS file system you have a better chance of undeleting a file, with less effort.

The bottom line is, the sooner you stop using the computer and let an expert attempt the recovery, the more likely the file can be recovered. If you attempt to find the file yourself, and as a result any files have been saved on the original disk, then the chances of a professional being able to recover the file later on are slim.

• When you have recovered all of your missing files, install a utility to recover deleted files and practice using it so you know how to use it when a real problem occurs. Some of these utilities are free. If you have more than one drive, install this anywhere except on your C: drive. We can supply you with a copy of a good free program and can show you how to use it. Practice on a floppy drive or a small USB drive, rather than on your main hard drive. Always use a 2nd drive, or USB flash drive to hold your "recovered" files.
• Keep your hard drives no more than 85% full, and defragment your disk when the defragmenting tools recommend doing a defragmentation operation. (This helps in file recovery since an accidentally deleted file is more likely to be contiguous (in sequential blocks) on the disk, and much easier to recover. As a bonus, some programs may start up a little faster, or application data may open slightly quicker. If you have a drive that is over 85% full, consider upgrading to a bigger hard drive as a precaution, or deleting some unimportant big files (movies, audio, etc) and then defragmenting the disk.
• Never store important files in the root directory, this is the first area overwritten if you accidentally do a quick format.
• Put your most valuable data on your biggest disk, (when you have more than one drive, or partition) so that it is least likely to be fragmented. (The more free space the least likely a file will be fragmented.) If it is not fragmented, and you react quickly before the free data space is reused, a basic file recovery utility is likely to be 100% successful.
• Backup, Backup, Backup!
• If you are using a FAT file system, change to the more robust NTFS file system. This capability to convert is built into Windows XP and later, and no data is lost during the conversion.
• When using Microsoft Word, turn off the option to "allow fast saves". This "fast save" saves the areas of the file that have changed by appending them to the end of the file. This encourages file fragmentation. You want the full file saved every time, for better chances of a good recovery after an accidental deletion, or from data loss due to a crash. Also, the full save completely removes deleted contents, where as a fast save leaves the deleted data in the file, where another person could view it.

Nearly all camera flash cards use a FAT16 file system, very similar to that used on some Windows PCs. Most of the things we have stated above are applicable, with the exception of NTFS, and thankfully cameras do not normally fragment files which improves your chances with recovery. The recovery process is much the same. The only thing that you don't have is the safety net of the Windows Recycle bin. Once you mark it as deleted it is gone unless you use software tools to recover it. Stop using the card, that is stop taking pictures, and we may be able to undelete the picture for you. If you take any more pictures and the one you want.

If you have quick formatted the camera's flash card on a PC but have not taken any more pictures, then the chances are good that the picture can still be recovered. If you have done a thorough format, then your pictures are gone!

It is possible to delete a file so that it is gone forever and an expert can't get it back. There are utilities called file shredders that are specifically for this purpose. They are not supplied as part of Windows.

These file shredding utilities (some of them are free) use the methods the government agencies are supposed to use. The area occupied by the file is written with a pattern of data, overwriting the original contents. Then this is repeated with a different pattern, and this is done for a number of times. Next the directory index is similarly overwritten to remove all hints of the file's details, and then marked as deleted. If the file has already been deleted, then it is not to late to get it shredded. The shredding utility can go through all of the unused space on the hard drive and do the same multiple pass overwrite mechanism. Before these utilities were available, governments would take a hard drive apart and use a blow torch on the disk surfaces to mechanically destroy them, now they can reuse hard drives.