Recovering from recycle bin

[cjackson]

Running XP-Pro. Accidentally put a photo in the recycle bin and then emptied it. Is it gone forever, or can it be recovered? Have tried to restore the PC to yesterday's date, but photo still gone. My guess is that photo is kaput.

Any advice?

CFJ

[azzey]

Yes, more than likely it is gone now.

If you have been using the computer since then, the part of the hard disk when the photo was being stored (in the recycler) may have already been overwritten. You can look for commercial data recovery software; I believe there are a number of utilities that in their trial version will recover a couple photos without having to pay, but names are escaping me right now.

You are going to have to weigh the importance of the picture against the inconvenience.

Good luck!

[Fruss Tray Ted]

Do NOT use your computer for anything until you've tried to recover the file. Otherwise as said, it may get overwritten.

I found Restoration here (http://www.aumha.org/freeware/freeware.php#restore) which may be of help.

[Paul Komski]

If you don't use the PC and slave its disk to another PC you have a very good chance of recovering the file with GetDataBack (http://www.runtime.org) (for FAT or NTFS as appropriate) - and indeed a number of other utilities - but the success rates with GDB round here have been excellent.

It is simpler to run GDB from your current hard drive but riskier in terms of losing the data altogether. WinHex (http://www.x-ways.net/winhex/) is another utility that should be well able to get back a deleted file. FreeUndelete (http://www.officerecovery.com/freeundelete/product_information.htm#properusage) is simple and free (for Win2K and upwards) and might just do the job for you.

PS may have already been overwritten
This is of course true but especially with NTFS partitions that have not had chkdsk run on them and have not been defragmented since deletion is unlikely unless a lot of large files have been written to disk or the drive has been in use for a long time. The tendency with the file system is to write over pristine areas of the drive if possible and not to immediately overwrite data that has been marked as deleted.

[Sylvander]

1. FAT[32] Partitions
I have in the past used the FREE copy of the "Emergency Boot CD" [EBCD]->"Un-Erase" program to recover "Shift-Deleted" files.

That program displays a list of deleted files and the chances of successful recovery.
[Whether they have or have not been partially or completely overwritten]

2. [B]NTFS Partitions
Just recently I made a copy of the Ultimate Boot CD for Windows [UBCD4Win] (http://www.ubcd4win.com/) FREE bootable CD.
You can see in this UBCD4Win list of included tools (http://www.ubcd4win.com/contents.htm) at the section on "Recovery" that there are MANY useful programs included.
[Free Undelete being one of them]
Post #5 here (http://www.pcguide.com/vb/showthread.php?t=65982&highlight=UBCD4Win) will give an idea of how to make it, I was surprised how easy it was to "build" yet another updated copy of the ISO file.
I managed to easily and successfully add to UBCD4Win GetDataBack for both NTFS and FAT (http://www.pcguide.com/vb/showthread.php?t=66654&highlight=GetDataBack).
I've run it successfully, but not yet needed to use it to recover any files.
Well worth the effort to make this bootable CD, and add it to your "toolkit".
Paul might correct me, but I think it would save you the need/effort of taking your HDD out of the PC...
Provided that is, that you have some location to which you can save the recovered files [external USB HDD?].

[Paul Komski]

Paul might correct me, but I think it would save you the need/effort of taking your HDD out of the PC.
Not using the hard disk to load and run an OS is always the safest way to go if the data involved is absolutely vital. Accessing the drive from a CD is just fine as long as nothing is run that writes to the hard drive.

It's not so much the running or not of FreeUndelete or any other applications as such from Windows that really matters - its just that the whole time Windows is loaded and running there will be file i/o operations that have the potential to overwrite data. In practice if certain operations (already mentioned) which restructure the file system are avoided and recovery is attempted soon after deletion then loading up the OS is unlikely, but not impossible, to overwrite the data of the "deleted" file.

[cjackson]

Thanks for all your suggestions. I had already purchased a copy of Paretologic's Data Recovery software to recover data from a hard drive in my old PC which went kaput in August. I ran this against my current hard drive and it recovered the photo I had lost.

CFJ