Subscribe to AfterDawn's weekly newsletter.
In this article we will look at using free software to recover files that you have accidentally deleted. Please note that recovery is not always possible, and only being able to partially recover data is a real possibility. However, this guide will walk you through a program called Recuva that is free, and should be installed on a PC even just as a precautionary measure.
Introduction & Requirements
|Software you must download and install|
|Required: Recuva is a free software download that can scan a drive for deleted files and recover them if possible. Download!|
When you delete a file, it's usually not destroyed unless you are using some specialty software like Eraser. Instead, the areas of the disk it occupied can now be over-written and the operating system can read this. Therefore, the simple process of downloading and installing Recuva could over-write a file you deleted. It's a harsh reality to face, so if you have deleted something vitally important, do not touch your computer, and call a professional. Otherwise, give Recuva a shot and you may get what you want.
Just run the Recuva installation and follow the steps. A quick note is that the installer includes an optional Yahoo! Toolbar that would be integrated into your browser. If you are like me, and don't like toolbar clutter, you can unselect this option on the screen you see pictured above. The bar can of course be uninstalled or just taken off the browser window in the View settings.
The Recuva interface has been made to be simple for the end user. If you do not see this simplicity, I challenge you to check out some of the commercial recovery options. Anyway, as you can see, any drive is easily selectable to be scanned for deleted files. There is also a search box that can filter out the results to a particular file name, or file type (or group of file types). Before we attempt to recover anything, let's check the settings for a couple of things.
Secure Deletion Settings
Click Options and the window above should pop-up. Why are we making settings for secure file deletion? Well one of Recuva's built-in options is to "properly delete" any of the results that you don't want to be recoverable. Even if you never use this option, it's best to choose a Secure Deletion method. Gutmann is the most intensive methods, employing 35 specific patterns, meaning it will overwrite 35 times. These days, that much is not really required so you can choose a less intensive, and less time consuming method. One single pass of random data should suffice.
Now let's take a look at the Actions tab.
Recuva - Deep Scan?
Click the Actions tab as seen above. There is one option here I wanted to point out in case you might need it later. Deep Scan will drive up the time it takes to scan for deleted files but it should also push up the amount of recoverable files (even partially) that Recuva does find. However I have found in most cases that Deep Scan is not required for basic recovery, so I'd recommend you keep it unselected unless you want to try it later on when a normal scan fails to materialize. When done click OK
Run a Scan
When you get back to the main Recuva interface, select the drive that you want to recover files from and click the Scan button. You will see this scan in progress (like pictured above). The amount of time it will take depends on many factors, including the speed and health of your HDD etc.
You might be surprised with the amount of results that Recuva will throw up, as there are loads of temporary files and other junk that are deleted automatically by Web Browsers and other software. If you want to, you can use the search box to filter out results by typing in a filename, or the a file extension (like .doc for a word document). Please note that often times filenames are not the same as they were on the hard drive before you deleted the files, but they are oft ne easily found by filtering the results to a file extension. So how do you read these results?
Above is a detailed look at the Recuva results. Obviously, we have the filename, path (not always the same as before deletion), the last modification etc. The important stats are "State" and "Comment". For example, a file with "Unrecoverable" state is very bad. The great thing about Recuva is it will show you then under "Comment" what other file has been written over it. Sometimes a file might not be in Excellent condition but it is still partially recoverable, and something is better than nothing right?
How to Recover
Right-click on any file that you want to attempt recovery of and click Recover Highlighted (this will work with multiple file selections too). Once you do that you will be prompted for a location to save the file.
Save on another drive
Bare with me for a second because this is interesting. You are always advised to recover to another drive, or to a flash drive or some type of storage you can write to in explorer. Why is this? The reason is simple. The file that you deleted was stored on the hard drive, and another file (or files) can now overwrite that space. Therefore, recovering to the same drive could cause a problem for the program if it began overwriting what it was supposed to recover. For a much better chance of a successful recovery, choose another drive to save on besides the drive you are recovering from.
If you get the message as shown above, then you will have recovered the file successfully - go check it out. If you can't find the file to recover, try filtering by the file extension and hunt through the files. If that fails you, you can go back and try to Deep Scan the drive and see if it make a difference. Either way, good luck and I hope you have a successful file recovery.
How to destroy a deleted file
Now that you have file recovery software on your computer, it might be a good idea to utilize Recuva's "Secure Delete" options for any private or sensitive data you previously deleted that show up as recoverable following a scan. In order to available of this option, simply right click on any file you want to make impossible to recover and choose the Secure Delete option.
The Secure Deletion process will take time depending on the size of the file that is being destroyed and the method for deletion that you choose earlier in the article. Either way, I hope this program helps you out very much
Written by: James "Dela" Delahunty
Last updated: 30 January 2009
Last updated: 30 January 2009