windows - How do I recover or "undelete" files that I accidentally deleted?

05
2014-04
  • KronoS

    I've accidentally deleted some really important files on my machine, and I'm looking to find out how to recover them. Using the Trash bins "restore" isn't an option, as the files aren't there (mostly likely I wasn't paying attention and permanently deleted them from there). Is there any way that I can un-delete these files?

  • Answers
  • KronoS

    Before you go any further you should follow these guidelines when "un-deleting" or recovering lost files:

    • (If possible) DO NOT USE the medium that you are recovering from. This is due to the fact that writing to disk may over-write the files you are trying to recover.
    • Try to recover the files as soon as you can from the time of discovery that the files are missing. This will increase your chances of recovery.

    There are plenty of options out there that you can use, however a very simple one is Recuva from pirifom:

    Accidentally deleted an important file? Lost something important when your computer crashed? No problem! Recuva recovers files deleted from your Windows computer, Recycle Bin, digital camera card, or MP3 player. And it's free!

    enter image description here

    They even have a easy to use wizards for the non-Super User:

    enter image description here

    There's also an exhaustive set of documentation on Recuva including how to use it.

  • 8088

    You should stop writing data onto that drive, then try some of the famed recovery tools. You can even recover files from a formatted hard drive. Don't worry.

    When you recover the files don't put them onto the same drive. That is, if you lost your data on the C: drive then the destination of the recovered files should be D:, E: or anything apart from C: to avoid data loss.

    Remember not to write any new data onto it as soon as you have accidentally deleted your files in order to increase the chances of success.

  • StuffMaster

    R-Studio is something I have used in the past. Not sure if there is a free version.


  • Related Question

    linux - How to recover deleted files?
  • vijay.shad

    My laptop has two os. one is windows vista. and other is Ubuntu. I am currently on ubuntu system, this is my primary OS.

    There are 4 partitions of my hard disk

    1. Windows OS
    2. Linux(Ubuntu OS)
    3. Data

    Now the problem part. The data partition is NTFS. I have mounted this partition on the location /media/windrive-a under ubuntu OS.

    A little while back i decided to delete the mounting of the data partition and i fired command rm -r /media/windrive-a/. To give me a shock; all my data on data drive is gone.

    Now, I know this is not the command to remove mounted partition. But I have committed the wrong. Is there any way i can get my data back. These are very important data for me.

    Please suggest.


  • Related Answers
  • geek

    Your best bet would be to "freeze" the data filesystem and don't alter it. For recovery attempts, make a partition image with dd and try to recover files from there.

    WARNING: dd is a dangerous command if you misuse it by mistake, so make sure you understand what it does, how it does it and double check the command line before hitting Enter.

    You might want to try TestDisk, it claims to be able to recover stuff from NTFS. Can't vouch for it, because I've never had to deal with such situations (yau, I've never experienced loss of personal data, see below why).

    Also, since you said that the data is very important to you, there's something else you must consider. If you would have a backup, that would save you. It seems you don't have one yet, so after dealing with data loss, it'll be a good idea to think about a backup strategy for really important data.

  • Dennis Williamson

    In the old times I used to use undelete, a DOS command that usually required remembering the first letter of the archive list it showed you (?y_file.doc ) and required no alteration, no save or touch the disk (btw, an overwrite with the same name of the file will kill any possibility of recovering it, as far as I know). As all what can save you is a temporary memory, would be overwritten with new activity.

    For NTFS, I have not needed to try, (I am on the same page as Geek, I'm paranoid with backups, so rarely lose something), but from time to time I end up at below site, I am curious if it really is useful. Probably it is, quite, and it is open source :

    http://ntfsundelete.com