How To Recover Data That You Have Deleted Accidentally?
The term data recovery is not alien to us - from novices to pros, almost all of us at some point in time have accidentally deleted our data or have otherwise find it getting corrupted. The usual cure has been to call a techy friend with bunch of recovery tools at disposal or to take the PC or laptop to the nearest computer shop offering data recovery. Lets briefly see how exactly the data recovery tools work and what are the options available for a typical home user to recover their lost data.
To start with the basics, a file in Windows Operating System is collection of chunks that may be laid out at different locations on the hard disk. But for users and applications, the file appears to be one intact unit taking a particular amount of storage space. And when a file is deleted (from the Recycle Bin as well), the storage space it was occupying becomes available.There must be some system to keep track of all such activities - this is called a File System, such as FAT and NTFS are two popular file systems that are available under Windows, and EXT2/3 are under Linux flavours. File systems keep lists or indexes of files and allows creation of folder structure that is displayed in Windows Explorer etc. When a file is deleted, instead of physically removing the file from hard disk, the file system simply removes the indexed information of that file.Consequently, the file does not show up in the folder structure and its space becomes available for reuse - but the file still exists in the hard disk. Here is where recovery tools come into play.But before data recovery can start, there are few precautions that must be taken to ensure safe data recovery.First, immediately stop any programme that routinely interferes with the drive data, for example, anti-virus tools, firewalls tools creating logs etc. Second, the disk on which the data is lost - either due to deletion, corruption, formatting or loosing a partition - should be taken out of the computer or made non-bootable. This is essential because continuous activity may result in overwriting on the ‘free' spaces that may still hold the lost information.Note that installing recovery tools can be catastrophic at this time, as it means disk usage due to installation which may be an overwriting activity. Even allowing computer to run can allow running processes to access ‘free' space and further erode the recovery chances. Next task is to make a copy of the disk if it is possible and third and final activity is actual data recovery which encompasses listing the recoverable files and reconstructing file system entries or if required, even the individual file headers. Recovery process can be made tough due to presence of long file names and encryption enabled file systems mostly in corporate environments.
Tools
Here a few free tools that can bring back files deleted using Shift+Delete from hard disk or from a USB disk. These tools were tested over a 1GB USB disk from which a Rich Text (RTF) file was deleted a week back and a text (TXT) file that was deleted only a few minutes before the test.
This is a simple tool with Search and Restore buttons at the top and a search location dropdown along with file name filter box to further narrow down the search. File Recovery was able to list both the RTF and TXT files. The first letter of file names was not recovered and was replaced by ‘x' in both the cases. Recover option did recover the text file correctly, but the rich text file could not be opened even after recovery - apparently it was recovered but was corrupted.
The good thing about this programme is its speed. Even when scanning C drive, where hundreds of temporary type files are listed, the programme remains responsive while listing file path, file size, file attributes and creation date.
One of the improvements in this free tool called Restoration is the progress bar when searching for deleted information. Number of files listed is also shown along with an option to include clusters used by other files and vacant clusters. Note that clusters are minimum units of storage in which file chunks are placed. This tool is also fairly quick and offers two more functionalities under the Others menu. These are Search All Clusters and Delete Completely - that is data shredding to make it un-recoverable.
This free utility is more comprehensive than the other two discussed above. Pressing the top left Start button starts the scanning process shown with a progress bar the bottom along with auto updating file count. Using the left side pane, searched results can be grouped by drives, folders or types. This makes if very easy if user is looking for a particular type of file, say a shockwave file or an Excel file. The extra information this tool provides includes date created and modified and most importantly file status.
For the deleted rich text file tested, the tool shows Status as Overwritten - and probably that was the reason why it was not be recovered correctly earlier. Another useful option is that of setting filters. Specific dates of file creation can be defined, inclusion of temporary and overwritten files can be controlled along with modification, size and file name filters.
There are a number of other free data recovery tools available as well over the internet. The list includes :
- DiskInternals Linux Recovery and R-Linux for data restoration in Linux Ext2/Ext3 partitions.
- CD Recovery Toolbox and CD Reader for reading data off the damaged CDs
- FreeUndelete and Pandora Recovery offering NTFS support and ICE ECC for Mac.
- Then there is TestDisk - an open source GPL product that focuses on partition table errors due to which entire partitions become unavailable. It helps in recovering partition and making non-booting partitions boot-able again.
With a support for over 15 file systems of six operating systems, this tool is a must have for support personnel and home users who experiment too much with disks and partitions.
