Recovering deleted files from XP
Page 1 of 2 12 LastLast
Results 1 to 10 of 12

Thread: Recovering deleted files from XP

  1. #1
    Junior Member
    Join Date
    Jan 2004
    Posts
    27

    Question Recovering deleted files from XP

    I have a situation here where we let go an employee that deleted some files off his laptop and then emptied his recycle bin. I know it doesn't get permantely deleted but does anyone know where deleted files get stored once the recycle bin has been emptied or know of a way to recover those files.

    Thanks in advance..
    If at first you don\'t succeed, f**k it try something else.

  2. #2
    Junior Member
    Join Date
    Aug 2003
    Location
    Kansas City, MO
    Posts
    18
    There are file recovery software available, but I guess it would depend on long it has been since the files have been deleted and has Windows overwritten the data you are wanting to recover. You might give this a shot I have used only once and it worked pretty well.

    http://www.pcinspector.de/file_recovery/UK/welcome.htm

    Also try Google -

    http://www.google.com/search?hl=en&i...les%22&spell=1

  3. #3
    Senior Member
    Join Date
    Feb 2004
    Posts
    197
    Go to http://www.iolo.com/sr/ and downlaod it





    READ INSTRUCTIONS

  4. #4
    Junior Member
    Join Date
    Jan 2004
    Posts
    27
    It just happened about 3 hours ago and nothing has been touch on the machine since.

    Thanks for the link WildOne..
    If at first you don\'t succeed, f**k it try something else.

  5. #5
    Senior Member
    Join Date
    Feb 2004
    Posts
    197
    ask for help when ever you need it. I help every one who asks ,and im still bored

  6. #6
    Senior Member
    Join Date
    Jun 2003
    Posts
    220
    but i want to know that even after emptying the recycle bin, where is the trace of deleted files left? I know they are still there in the system, but i want to know where exactly they are? in which folder and in which format etc? thank you
    Now is the moment, or NEVER!!!

  7. #7
    Junior Member
    Join Date
    Mar 2004
    Posts
    4
    Well the way it works is this : they don't actually exist in a folder, insofar as giving you an ability to find them in that manner - they simply still exist as data in a sector on your hard drive which can no longer be seen through the user interface. This is why it's important to recover them as soon as possible - because the second you install anything / download anything ( add content to the hard drive in any fashion) you run the risk of overwriting the sector where that hidden information ( the files you wish to recover) exists.
    Knowing this, it would VERY likely be a complete waste of time to download / install any data recovery program to the same hard drive you want to recover the data from - better run that program from disc if you want that data back.
    Total Physical Memory 1,024.00 MB
    Available Physical Memory 438.18 MB
    Total Virtual Memory 3.40 GB
    Available Virtual Memory 2.55 GB

  8. #8
    AntiOnline n00b
    Join Date
    Feb 2004
    Posts
    665
    hi riya_here

    where is the trace of deleted files left?
    i would like to add a few things to what wackoz said. the files you store are not stored in one place they are broken and scattred all over your hard disk( in DOS and Windows), when you delete it it goes into recycle bin(simple delete not "Shift+Del"). when you delete it from Recycle Bin you actually tell the OS that it can now write on the areas the previous file existed. So after a long time there might be a few portions that are still there. the earlier you recover the better are your chances of recovering it.


    --Good Luck--

  9. #9
    Senior Member Zonewalker's Avatar
    Join Date
    Jul 2002
    Posts
    949
    riya - just to expand on wackoz' explanation - on FAT/FAT32 there exists the File Allocation Table (hence the acronym FAT) and on NTFS there exists the Master File Table - basically they are both the same thing (ok I know there are differences but thats more than we need here).... anyway either of these are system files which you can't view through the GUI as wackoz rightly says. It's these files that hold the information about what clusters your 'normal' files are held on. These files aren't in a 'folder' as such. This site might be of interest to you.

    Essentially when you delete something from the recovery bin all you do is delete the first character of the 'normal' filename and replace it with a tag that means 'this cluster can be overwritten' - which is why as wackoz points out its a VERY good idea not to install anything else to the drive if you want to recover a file

    Z

    [edited for spelling]
    Quis Custodiet Ipsos Custodes

  10. #10
    Junior Member
    Join Date
    Mar 2004
    Posts
    4
    Originally posted here by SwordFish_13
    hi riya_here



    i would like to add a few things to what wackoz said. the files you store are not stored in one place they are broken and scattred all over your hard disk( in DOS and Windows), when you delete it it goes into recycle bin(simple delete not "Shift+Del"). when you delete it from Recycle Bin you actually tell the OS that it can now write on the areas the previous file existed. So after a long time there might be a few portions that are still there. the earlier you recover the better are your chances of recovering it.


    --Good Luck--
    The degree to which this applies, however, is directly proportional to the level of fragmentaion that exists on the hard drive - a well maintained drive will not have file fragments scattered all over the place. This becomes even more true on an NTFS partition, which is FAR more efficient than FAT.

    Resultantly, your chances of success in data recovery may be greatly enhanced by defragging the hard drive first, before running the data recovery program, as this will re-attach the file fragments together, as much as is possible, at any rate.
    Total Physical Memory 1,024.00 MB
    Available Physical Memory 438.18 MB
    Total Virtual Memory 3.40 GB
    Available Virtual Memory 2.55 GB

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides