RECOVERING DELETED FILES
After You Have Emptied the Recycle Bin
New February 20, 2006 (Version 2.0)
Hold mouse here for list of most recent changes.
“Can somebody help? I’ve deleted some important files and emptied the Recycle Bin. How can I get them back?” Man, if I had a dollar for every time I’ve seen this question since August 1995, I’d be, well, a few dollars richer by now.
When first learning Windows 95, I relied very heavily on the extra layer of Recycle Bin recovery built into Norton Utilities. And, in those early Win95 days, I used that quite a bit! (It was even more important to keep emptying the Recycle Bin regularly in the days of a 1 GB hard drive on my AMD DX4-100 machine with a whopping 12 MB of RAM.) So I understand how data loss can occur, and the unhappy place it can leave you. Pre-FAT32, the old UNDELETE utility in DOS also was a life-saver a time or two but, once Win95B and FAT32 came into play, that one was history. It took a few years to find a really satisfactory free undelete tool to recommend to folks — but I eventually found Brian Kato’s free Restoration utility, which works splendidly.
Restoration is a freeware program by Brian Kato that restores deleted files no longer in the Recycle Bin. The good news is that it works not only on Windows 9x versions, but also on Windows NT, 2000, and XP — even in NTFS! It fits neatly on a floppy, since it is only 406 KB in size (and the Windows 2000/XP version is less than half that size), but you can also run it from your hard drive. I recommend you be prepared to use either option.
You can read more about Restoration here and download it directly from here.
Over the years, many people have written to thank me for telling them about this tool, and saying that it has saved them from enormous data losses. I appreciate hearing about these success stories. Additionally, the program author’s email address is in the Readme file, and I bet he would like to hear your appreciation too!
Emergency file recovery requires more than the correct tool, though. It requires knowing how file deletion occurs, and what you have to do to maximize the chances of a successful recovery.
When a file is deleted from your computer, its contents aren’t immediately destroyed. Windows simply marks the hard drive space as being available for use by changing one character in the file table so that the file entry won’t be displayed in My Computer or a commandline DIR command, etc. If you manage to start an undeletion process before Windows uses that part of the hard drive to write a new file, all you have to do is set that flag back to “on,” and you get the file. Pretty cool, eh?
Obviously, the sooner you try to restore a file, the more successful you’ll be. But stop a moment and think about the other things that could cause this part of the hard drive to be overwritten. If your hard drive is pretty full, the odds are much greater that Windows will grab your precious unallocated space for its next write. Or, if you defrag the hard drive, you run the risk of unused parts of the drive being overwritten! (This also means that if you are running silent background defrag services like Diskeeper, or if you have defrag utilities scheduled to defrag automatically, you might get blindsided — lose your chance at data recovery — if you don’t halt them until you have your deleted file recovered. Tip from MS-MVP Manny Carvalho.)
NOTE: This risk from defragging is not necessarily as severe as I previously thought. For example, on one test with a half-full C: partition, I had 8,926 recoverable files before a defrag, and 8,915 recoverable files after. Nonetheless, it’s a good thing I didn’t want to recover the 11 files that were lost in the process!
For that matter, simply starting up Windows or, to a lesser extent, shutting down Windows causes many tiny files to be written. You really want to avoid these processes if at all possible.
So the first rule is: STOP USING THAT COMPUTER IMMEDIATELY! THIS MINUTE! RIGHT NOW! Use another computer to get the recovery tool you will need.
This is also one of the places where well-planned partitioning of your hard drive has a huge advantage. Partitions physically mark off different parts of the hard drive. If, for example, you have your data and program files on their own separate partitions, and it’s a data file that you want to recover (which is usually the case), then Windows startup or shutdown won’t touch that part of the hard drive. If you have the swapfile / pagefile on its own partition, and all of your directories for temporary files on another, then these most-changing and most-written files also will be kept from overwriting the part of the drive holding the files you want to recover. However, if you take that 80 GB hard drive and make it all one big single C: partition, then you run the risk of making your file unrecoverable anytime the swapfile resizes, or any time Windows writes a temporary file of any kind... and this could be pretty much at any moment whatsoever! Partitioning gives enormous advantage in file recovery. I recommend you read my article Planning Your Partitions for more ideas along these lines.
Brian Kato’s Restoration is so successful so much of the time that I rarely hear from users that it failed them — unless there is actual physical damage to the drive. However, the program has its limits, and, if it fails to recover your data, there are still other possibilities.
Some of the tools — due to cost or other considerations — are more appropriate to business environments than individual users. For example, at work I use a commercial product built on the popular Bart PE technology, called Bart PE Disk Recovery. Thus far, if the hard drive has been able to spin, we have been able to recover what is on it with this tool.
But for most visitors to this site, I can probably do no better than to pass along a recommendation that my friend and MS-MVP colleague Gary Terhune swears by: R-Studio Data Recovery Software by R-Tools Technology is a commercial software package currently under $200.00 (and some modules much less), with other backup, recovery, and data security tools for varying purposes. On Gary’s enthusiastic vouch, I recommend you try them if you are looking for a “next level” recovery tool.
Beyond that, you are probably limited to “clean room” recovery houses. These aren’t cheap, but sometimes your data is worth the cost. Find one local to you (from the yellow pages, Google, etc.). As a rule, they charge you about $1,000.00 to start looking, with no guarantee anything will be recoverable — but, as I said, sometimes that’s worth it for your data.
The purpose of this page, though, is to help you avoid that step if possible — and to have the peace of mind of knowing that you have saved something important that otherwise would have been lost to you.