Recovering Deleted Files and Partitions


Ever wanted to recover files that has been deleted from the Recycle Bin?  Do you know that what has been so called deleted from the Recycle Bin has merely been marked as “deleted” and not actually entirely removed from the hard drive.  You might be confused with the word delete, rubbish bin, shift+delete button and what not.  Let us first look into the context of how the entire cycle works below.  Jump straight to “Tools to recover deleted files” to download.

Deleting Files

Files are moved to the Recycle Bin in the following ways:

  • By right clicking on a file and selecting delete from the right-menu.
  • Selecting the file and pressing the delete key.
  • Selecting delete from the side menu in Windows XP.
  • From a context menu command or some other function in a software application (usually configurable).
  • By a computer virus.
  • By dragging and dropping a file into the Recycle Bin icon.

What happens when a file is deleted in Windows

  • When a file is deleted, the operating system marks the file name in the MFT with a special character that indicates that the file has been deleted.
  • The first letter of a file name is replaced by a hex byte code, E5h.
  • Corresponding clusters in FAT are marked as unused.
  • Index field in MFT is marked with special code in NTFS.
  • The computer now looks at the clusters occupied by that file as being empty, and therefore avails space to store a new file.

Recycle Bin in Windows

  • You can retrieve files that have been deleted from the Recycle Bin.
  • When a file is deleted, it is sent to the Recycle Bin where it remains until the Recycle Bin is emptied.
  • The Restore all items option of the Recycle Bin properties allows to restore the data to its original location.
  • After the Recycle Bin is emptied, the data still remains in its original location on the hard drive for a period of time.
  • The data will disappear only when the operating system over writes original location of the file.
  • Data deleted from removable media, such as a floppy disk, is not stored in the Recycle Bin.

How the Recycle Bin works

  • Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext where‘ x’ represents the drive name ‘y’, a sequential number starting at one, and ‘ ext’ extension .ext being original file name extension.
  • When a file or folder is deleted, the complete path, including the original file name, is stored in a special hidden file called “Info” or “Info2” in the Recycled folder.
  • The Recycle Hidden folder contains files deleted from My Computer, Windows Explorer, and some applications.
  • The deleted file is renamed, using the following syntax:
    D<original drive letter of file><#>.<original extension>
    Examples:
    New file name:
    Dc1.txt = (C drive, second file deleted, a.txt file)
    INFO File path:
    C:\Windows\Desktop\Books.txt
    New file name:
    De7.doc = (E drive, eight file deleted, a.doc file)
    INFO file path:
    E:\winword\Letter to Rosemary.doc

Storage locations of Recycle Bin in FAT and NTFS system for Windows

  • Files in the Recycle Bin are stored in C:\RECYCLED folder on FAT file systems and, in the C:\RECYCLER folder on NTFS file systems.
  • All recycled files on FAT system are dumped into a single C:\RECYCLED directory, whereas recycled files on NTFS system are categorized into directories named as C:\RECYCLER\S-…. based on the user’s SID.
  • The maximum possible size of the Recycle Bin is 3.99 gigabytes per drive.
  • Items larger than the storage capacity of the Recycle Bin cannot be stored in the Recycle Bin.

Damaged or deleted INFO file

  • If the INFO file is damaged or deleted, no file appears in the Recycle Bin.
  • The files in the Recycled folder have been renamed.
  • If the INFO file is deleted, it is recreated when you restart Windows.
  • The INFO file is a hidden file. To delete the INFO file, follow these steps:
    Open a command prompt window.
    Type cd recycled.
    Type attrib –h inf*.
    Type del info.

Damaged files in Recycled Bin for Windows

  • Damaged files in the Recycled folder do not appear in the Recycle Bin.
  • To restore the deleted files, follow this process:
    • Create a copy of the Recycled\Desktop file in Desktop.ini another folder, and then delete the entire contents of the Recycled folder.
    • Delete all files in the Recycle Bin.
    • Restore the Desktop.ini file to the Recycled folder.
    • If the Desktop.ini file is not damaged, you can recreate it by adding the following information to A blank Desktop.ini file:

    [.shellClassInfo]
    CLSID-{645FF040-5081-101B-9F08-00AA0O2F954E}

Damaged Recycle folder

  • The Recycled folder itself can become damaged.
  • Files are moved to the folder, and the Recycle Bin appears full, but you cannot view the contents and the ‘Empty the Recycle Bin’ command is unavailable.
  • Deleting this folder and restarting Windows will recreate this folder and restore functionality:
    Restart to a command prompt.
    Type attrib – s –h recycled.
    Type del recycled.
    Restart the computer.

How to undelete a file

  • The procedure principally involves finding the data on the raw partition device, and making it visible again to the operating system.
  • There are, essentially, two ways of doing this:
    • Modify the existing file system such that the deleted in order have their ‘deleted’ flag removed.
    • Find out where the data lies in the partition, and write it out into a new file on another file system

Deletion of partition

  • You cannot delete a partition if it is assigned to an item such as calling, search space or to a route pattern.
  • You cannot delete a partition that is in use.
  • Before deleting a partition that is currently in use, perform either or both  of the following task:
    • Assign a different partition to any calling search spaces, devices, or other items that are using the partition that you want to delete.
    • Delete the calling search spaces, devices, or other items that are using the partition that you want to delete.
  • What happens when partition is deleted?
    • All data on that deleted partition or logical drive is lost.
    • Deleting a partition on a dynamic disk can delete all dynamic volumes on the disk, thus leaving the disk in a corrupt state.

Recovery of deleted partition

  • The partition recovery process is a significant part of data recovery.
  • The recovery of deleted partitions is the process by which the investigator evaluates and extracts deleted partitions.
  • A partition recovery utility helps in recovering all important data lost after accidental lost partition.
  • Tools:

Tools to recover deleted files

Search and Recover * , Zero Assumption Digital Image Recovery ** , e2undel , O&O Unerase ** , Restorer Ultimate ** , BadCopy Pro ** , File ScavengerMycroft v3 * , File-Saver * , VirtualLab ** , Active@ UNERASER *** , Restoration , PC Inspector File Recovery , PC Inspector Smart Recovery , Fundelete , Disk Investigator , RecoverPlus ** , OfficeFIX ** , RecoverMyFiles ** , Zero Assumption Recovery , SUPERFileRecover ** , CDRoller ** , DiskInternals Uneraser ** , DiskInternals Flash Recovery ** , NTFS Undelete , CD Data Rescue , DVD Data Rescue , WinUndelete ** , ImageRecall ** , Recover4All Professional , eData Unerase , Easy-Undelete ** , inDisc Recovery 3 , Recuva

* Paid
** Paid, has trial
*** Free, unique (works without Windows running)

For more article or information alike, be sure to check out the Forensic and Data Recoverycategory more often.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


»
%d bloggers like this: