[Mad Vlad]

With deadlines looming towards the end of term, everyone's racing to make sure their coursework gets done. But what happens when you go to open up that epic essay and it's not there!? Or if you accidentally delete something you shouldn't have? Most people will panic but what can you do to find it again?

Hopefully, you'll have a backup (tips for backing up later on in this guide), but if you don't then what can you do about it?

Step 1

Stop what you're doing!

When you create a file, the computer looks for free space on your computer. It then writes the information about where that file is located to something called the Master File Table (MFT) and then writes the data to the main part of the hard disk. When the file is deleted, all your computer does is overwrite the information in the MFT to say that the space where the file sits is actually free. The actual data remains on the disk, but the computer allows the data to be overwritten as if it was just empty space.

Because of this, you must stop what you're doing. Anything you do on your computer could be potentially overwriting this deleted data! If you want any hope of getting it back, you need to reduce the usage of your computer to a minimum. Browsing the internet, shutting down and powering on your computer, it all writes things to the hard disk.

A worthwhile note...

The techniques discussed here will apply to not only hard drives, but also USB sticks and memory cards.

First things to try:

NOT SYSTEM RESTORE!

System restore is a largely useless feature that only rolls back a windows installation to a previous time. It will NOT recover files and will probably do untold damage to any deleted files, due to it being a very read/write intensive process.

If you're using Microsoft Office, the first thing you'll want to do is have a quick look to see if the autosave feature has saved a copy of your work. You can do this by going to C:\Documents and Settings\[your username]\Application Data\Microsoft, and then having a browse through any sub folders.
Or: C:\Documents and Settings\[your username]\Local Settings\Temp"
Or: C:\Users\<Username>\AppData\Roaming\Microsoft\Word and C:\Users\[your username]\AppData\Local\Temp in Vista (Thanks to SpikeyMike and AWSLC)
Note: You may have to show hidden files to see the contents of these folders.

You'll be looking for .tmp or .wbk files that look like ~wra####.tmp (where those hashes will be numbers)

This style of filename relates to Word documents which will be the most common. Powerpoint documents will look like ~ppt####.tmp. Excel doesn't autosave by default.

If you draw a blank there, the file has probably been deleted and you'll need to download some file recovery software to see if the original file can be recovered.

File Recovery

You need to do the downloading on another computer, really, as otherwise you could again be overwriting data. I've personally got very little experience with the following tools, however, they do tend to crop up quite frequently in discussions on here.
Just to be clear: I make no warranty of the suitability or effectiveness of the following software packages.

Recuva
http://www.recuva.com/

Recuva is a freeware file recovery tool and seems pretty decent. It's got no limitations on its use, unlike some packages that you can download and it's been tried and tested by a number of people on TSR with a fairly decent level of success. It's compatible with a wide range of Windows file systems making it ideal for recovery from hard disks or flash drives.

NTFSUndelete
http://ntfsundelete.com/

Another good, this time open source tool. Not sure of its compatibility with other file systems like FAT16/FAT32, however. This package has the benefit of being downloadable in .zip format, allowing you to copy the program onto a USB stick and run it from there.

If anyone has any experience with alternative packages, then please let me know and I'll include them here.

Another worthwhile note...

When using this kind of software, you should try and install it to a partition other than the one you're trying to recover from. You should also recover the files to a different partition or drive.

If recovery software cannot find the files, then the file may be wholly or in part destroyed and that will require forensic techniques that I won't cover here, to effect a partial recovery if indeed there is anything left of the file at all.

DIY solutions can only get you so far. If your storage device completely dies or is physically damaged (especially with hard disks) then your only realistic hope of recovery will be with professional data recovery specialists and this is expensive. There are a few examples where you can try and improvise a bodge e.g. with USB sticks, but I would advise asking our advice before you start breaking out the toolbox!

What if I've saved over the file?
It's probably gone. Once you overwrite the data on the disk, the overwritten data is PERMANENTLY gone. The theory into you being able to recover the previously held data using a magnetic force microscope put forward by Peter Gutmann in the mid 90's is unfounded. It's not possible to recover it. Partial recovery may be possible if the file that overwrote the original data was not completely overwritten, but you need forensic tools to recover that and it won't be very pretty to look at. In the main, the file will be gone.

If you have any questions, start a thread and we'll see what we can do to help. Also, if have anything you think would be worthwhile adding to this guide, just post and I'll add it.

[Mad Vlad]

Data Security

The second part of this guide is about good practice in storing and transporting your data.

[Work in progress!]

[AWSLC]

Good guide Vlad!

Vista temporary folder is located at: C:\Users\(User Name)\AppData\Local\Temp and I think the default location for Word autosave in Vista is C:\Users\<Username>\AppData\Roaming\Microsoft\Word

Another good piece of software which is related to this, is called 'The Autosavers' and can be downloaded from here. The basic idea of it is that it is a separate program which runs in the background, using next to no resources, once running will prompt you with a dialog pop-up box once every X minutes (user is able to set time intervals) to save your work (making you manually save as opposed to the autosave feature in Office).

[Mad Vlad]

Originally Posted by AWSLC

Good guide Vlad!

Vista temporary folder is located at: C:\Users\(User Name)\AppData\Local\Temp and I think the default location for Word autosave in Vista is C:\Users\<Username>\AppData\Roaming\Microsoft\Word

Another good piece of software which is related to this, is called 'The Autosavers' and can be downloaded from here. The basic idea of it is that it is a separate program which runs in the background, using next to no resources, once running will prompt you with a dialog pop-up box once every X minutes (user is able to set time intervals) to save your work (making you manually save as opposed to the autosave feature in Office).

That's a neat little program. I'll add that to the forthcoming second section.
[EDIT] Link added.

[giran]

Needs a sticky, good work Vlad.

[AWSLC]

Yep, second vote for sticky! :-)

[Swwils]

Vote for sticky . - VLAD perhaps apps for the recovery of files from USB sticks?

[Mad Vlad]

Originally Posted by Swwils

Vote for sticky . - VLAD perhaps apps for the recovery of files from USB sticks?

Any ideas on those apps? Recuva should do fine as it supports FAT12/16/32. I don't use commercial DIY apps, personally. I use Foremost, Scalpel and Technology Pathways ProDiscover (and next year, EnCase) for my forensic recovery work.

[alexsheppard11]

how about adding a bit for hard drives that are slowly dieing and cannot boot?

such as mentioning testdisk?
because if you cannot boot, recuva and the other techniques are useless.

testdisk can be put on a floppy or cd and booted to.
its a dos program, that kind of mimics and explorer style window.
you can then select folders, and where to copy them to

[Swwils]

I think this is just a general call for a much bigger and in depth guide .

PhotoRec is a good choice for finding known file headers and I've had very impressive results using it for EXT2/EXT3 filesystems, and general devices I cant get to boot properly.

[giran]

I know I'll get flamed to high hell, but what about Norton Ghost?

Assuming you lost alot of important files, with this work if you stored the image on an external safe HDD?

[Mad Vlad]

Originally Posted by giran

I know I'll get flamed to high hell, but what about Norton Ghost?

Assuming you lost alot of important files, with this work if you stored the image on an external safe HDD?

Norton Ghost isn't that bad a program tbh.

I agree, there's a lot that can go into this guide. If possible, could we brainstorm some ideas and then I can write the appropriate article sections for them.

[giran]

Originally Posted by Mad Vlad

Norton Ghost isn't that bad a program tbh.

I agree, there's a lot that can go into this guide. If possible, could we brainstorm some ideas and then I can write the appropriate article sections for them.

Yeah definitely +1 on that.

I think I was being judgemental on Norton. Just because their anti virus doesn't do its job, doesn't mean its other products cannot either.

[INTit]

Originally Posted by giran

I know I'll get flamed to high hell, but what about Norton Ghost?

Assuming you lost alot of important files, with this work if you stored the image on an external safe HDD?

Yup Norton ghost is great.

[spikeymike]

Originally Posted by alexsheppard11

how about adding a bit for hard drives that are slowly dieing and cannot boot?

such as mentioning testdisk?
because if you cannot boot, recuva and the other techniques are useless.

testdisk can be put on a floppy or cd and booted to.
its a dos program, that kind of mimics and explorer style window.
you can then select folders, and where to copy them to

I like Test Disk.

[notsam]

Now, if only everyone had backups of all their data this'd never be needed :P

Nice guide.

[atheistwithfaith]

Very good guide, ill have to look up the proper forensic techniques - always been interested in computer security but never really researched this.

[Puma]

Seems small, but maybe add that as well as auto save users should also manually save files themselves and if it is an important document then 'Save As' and create another file for back up. That is the simplest way to backup whilst mid flow of a file.

[Puma]

Vlad, when your finishing the second park, wireless security, encryption, the need for AV software, anti-spyware, ad-ware and malwarebytes could do with a strong mention. Encryption, firewalls and strong passwords would be useful too. Also, maybe a few comments about where not to post personal information & bank details, what do to in event of fraud and such information, as some people clearly aren't bright...
Also, private information given on a public forum/site, does it become Public Information?

The above is just from recent threads I have read where they have not got security or such.

[mikeyd85]

For the backup part of this guide, a company called 2brightsparks do a freeware app called SyncBack.
Also, Microsoft have their own SyncToy.

Both free, both useful (though synctoy can't support filenames > 128 characters including path) and both make keeping a backup dead easy.