NWA-PCUG Newsletter Article, March 2012
Undelete or Unerase Accidentally Deleted Files with Recuva
By Ira Wilsker, Radio Show Host,
Columnist, College Professor and deputy sheriff
iwilsker@sbcglobal.net
(click to email author)

WEBSITES:
http://www.piriform.com/recuva
http://www.piriform.com/recuva/download/standard

I plead guilty. I admit that I have sometimes deleted files that I should not have deleted. Often, I realize the mistake fairly quickly, but sometimes I am unaware of my error for several days. Since its earliest days, Windows has had a trashcan or "Recycle Bin" where deleted files are stored until the trashcan is emptied. If the deleted file is still in the Recycle Bin, restoring it to its original location is typically an easy task; simply click on the Recycle Bin icon on the desktop or the Recycle Bin in Windows Explorer (or any other file manager), click or highlight the file, and then click on "Restore this item" on the menu bar. Alternatively, from the open Recycle Bin in any file manager program, right click on the file name and select "Restore"; the file will instantly be restored to its original location.

This straightforward method of recovering deleted files from the Recycle Bin is fast and reliable, but all too often users like me frequently empty the recycle bin either manually or with a quick drive cleaner such as CCleaner. Luckily for us, even if a file is gone from the Recycle Bin, there is still a chance that it can be recovered. Unless the deleted file has been intentionally wiped (a process to securely erase a file by repeatedly overwriting it with random data, usually zeros and ones), or overwritten in the normal course of writing to the hard drive, it can likely be recovered. In Windows, when a file is first deleted, it is still intact on the hard drive, but the first character of the filename is changed to a "?", which tells Windows to skip the file when using a file manager such as Windows Explorer to display the files in a directory. This "?" also tells the hard drive and its controller that the space taken up by that file is available to be overwritten, as the file has been deleted, and can be used to store other files. Once a file, or major parts of the file, has been overwritten by other data, the likelihood of recovering that original data is significantly reduced. If for no other reason than this, it is important to have one or more file recovery programs already installed on your computer, because the simple act of installing a file recovery program after a file has been deleted may overwrite the exact file space that contains the targeted deleted file, rendering it unrecoverable!

There are several fine, and often free, file recover utilities that can undelete or unerase recoverable files. My personal favorite is one of the most widely used free undelete utilities, Recuva (http://www.piriform.com/recuva). Recuva will run on almost all builds of 32 and 64 bit Windows, and can possibly recover files from a variety of media including the Windows hard drive, a memory card such as those found in digital cameras and cell phones, and MP3 players including iPods via their USB connection to the computer. While I always install Recuva on all of my computers as one of the first utilities installed, I also have the portable version of Recuva on the flash drive that I have on my car-keychain for use on others' computers that have files to be recovered, but do not have an undelete utility installed; this eliminates the chance of overwriting that target file which could possibly happen if I actually installed Recuva on the target machine. Using Recuva I have successfully recovered countless deleted files including digital photos, emails, music, videos, compressed files, Word files, Excel files, and a variety of other data and program files. Contrary to popular belief, formatting or simply erasing a hard drive or other media does not necessarily delete all of the content, and Recuva can often recover data from formatted or apparently erased and blank storage devices.

Recuva is easy and fast to use. First, download the 2.4 MB free version (paid versions are also available) from http://www.piriform.com/recuva/download/standard

Installation is quick and easy, with few options to select. Upon opening the installed Recuva, a wizard appears that will walk the user through the recovery process; advanced users can skip the wizard and go directly to the recovery console. When using the wizard, the user selects the type of files to be recovered, which speeds up the search and recovery process by only searching for recoverable files of the selected types. If the "Show all files" option is selected, the search process may be slowed substantially as there is more searching to be done. The wizard then asks the user if he knows where to look for the deleted files, such as on a media or memory card, in "My Documents", in the Recycle Bin, in a user selectable specific location or directory on the hard drive, or "I am not sure" which will be slow as it searches everywhere on the computer. The last of the wizard windows informs the user that the wizard is now ready to search for, and display the recoverable files. If the deleted file is not found, the user may select to perform a "Deep Scan" which is much slower, but will do a much more detailed scan.

I attempted a standard scan for missing files in My Documents on my hard drive, a 4.4 GB directory, containing almost 6000 files in over 200 sub-directories; the initial search took 12 seconds. I tried a search on my entire hard drive, which has 545 GB of files, and it completed the initial search in 127 seconds. Once Recuva compiled a listing of potentially recoverable files, it then analyzed the results to determine the degree of recoverability, and this can take several minutes or more up to an hour for a large hard drive. The results are displayed in a sortable format, with the first column being a colored dot icon, green, yellow, and red, with the obvious green icons indicating recoverable files (labeled as "Excellent"), yellow indicating that the chance of recovery may be poor, and the red icon indicating that the file has been overwritten and is unrecoverable. Clicking on a filename in the left column makes information available in the right window. In some case, a preview of the file may be available in the right window, and selecting the "Info" tab displays all of the technical information about the selected deleted file. If a selected file is recoverable, clicking on the "Recover" button on the bottom right of the window will recover the file and restore it to its original location.

The free version of Recuva is one of those free utilities that should be on every personally owned PC, and the paid commercial versions (or similar products) should be installed on all institutional computers. One never knows when it will become necessary to recover deleted files, and Recuva is one of the top programs to perform that task.
Click here to return to top



==================================================================