Deleted file recovery

[Roady]

FYI

How is it possible to retreive files that were deleted from the Recycling bin in XP? Is it the same process, more or less for other O/S?

Does doing a Format of a drive not delete the data for good? i.e Still recoverable! If not how can you perform a high level format? or do you just Killdisk it?

does doing a low level format scub the data off, Can you still install a fresh O/S after a low level format? if so has this then made the old data uncoverable?

Thanks to all that respond.

Roady

[Paul Komski]

Deleted files (in both FAT and NTFS partitions) just have a deleted attribute or bit set on them and are not seen by Windows but are usually easily recoverable with a wide range of software. The names of folders in the root of a FAT partition can get lost completely - but not the files inside them unless the data is overwritten.

Formatting a partition can overwrite some of the metadata at the start of the drive but generally speaking it overwrites very little, if any, of the data area.

Technically the only place that low level formats are done are at the factory level when a drive is being assembled. So called low level formats nowadays are the use of programs that will write zeros or other random data over the whole drive. That is what programs like killdisk and copywipe do.

I don't know what you mean by a high level format. With FAT and NTFS nowadays there are only two formatting options; quick or full. The only difference between these is that the full format checks the surface area for defects. A quick format is equivalent to comprehensively deleting all files and folders on the partition. Formatting FAT over NTFS or vice versa can lose a small amount of original data as either the FATs or the MFT metadata are created.

[Roady]

Ok well thanks for that? The reason i said High Level was im sure I have heard of it before and presumed there was such a level bsimply because its opposite to Low!

Anyway I found a great site that explains a lot in english http://www.geekgirls.com/windows_recycle_bin.htm

Looks like you have to use 3rd party software to recover deleted items from the recycle bin. Apparently when data is deleted from the bin Windows changes the file's directory entry to indicate the space occupied by this file is no longer needed and is available for use. The data's still there, but at any time if the operating system needs space for another file, it may be overwritten. Until it is overwritten, the file still exists on the hard disk and is recoverable. That means you dramatically increase the chances of being able to recover a deleted file if you refrain from any subsequent disk activity, such as creating, editing or copying files.

Happy Days!!

[Paul Komski]

As I said - "but not the files inside them unless the data is overwritten". Of note is the fact that a folder under NTFS is actually a special type of file and so more recoverable than folder names under FAT.

There are different degrees of recoverability and ease of the same. If files have simply been deleted or a partition formatted then undeletion is possible. If the metadata (FAT or NTFS metafiles etc) is damaged then the whole data area must be searched and individual files recovered or put back into some sort of virtual directory structure. In this case a recently defragmented drive will allow greater recovery but disk checking and defragmentation themselves can both make recoverabiltiy worse. Why? Because chkdsk, scandisk and defrag can all overwrite areas of the drive when "fixing" things. If partitions themselves are simply "deleted" then rebuilding of the MBR or EPBRs is all that is generally required.

Regarding High Level format (http://en.wikipedia.org/wiki/Disk_formatting#Low-level_formatting_.28LLF.29_of_hard_disks). Seems to be a synonym for Quick or Full format of the type done by a windows formatter.

There are two basic rules when data has been "lost". (1) Don't panic and do something you later regret. (2) Don't use the PC until you have worked out by yourself or with help from experts a proper plan of action.