IMPORTANT: Never install undelete software on the drive that contains the lost
undelete / unerase golden rules:
||Do not install undelete or
recovery software on the 'victim drive' after you deleted a file.
You may want to consider installing undelete software right
now, so you do not have to worry about this when undelete
software is needed.
||End all tasks and processes
that write to the victim disk, including download managers,
peer-to-peer download software, automatic updaters etc.
||Do not recover deleted files to
the drive that you are recovering files from.
File deletion is an operating system / file system
feature that allows the removal of files from the file system. You may want to delete
files to free up disk space, to remove duplicate files or to make
files unavailable to others. To prevent the accidental removal of files,
some operating systems do not remove files immediately; instead
files are moved to a special directory (for example the Windows Recycle
bin). When files are removed from this special folder they're
actually removed from the file system.
Some warnings are in order regarding the limitations of the Recycle
bin feature in Windows. Normally when you delete a file or folder,
it will be moved to the Recycle bin so you can undo the delete if
needed. But there are situations where the Recycle bin is bypassed
and the file is deleted immediately:
- if files are too large for the Recycle bin
- if you hold the 'shift' key while deleting files
- if files are deleted by applications
- if files are deleted from a windows command prompt
Commercial and free third party
tools replace and extend the standard Windows Recycle bin
functionality by capturing these files as well. Examples of such tools
are Norton Recycle bin and Fundelete from former
For the purpose of this explanation, when we use the term 'deleted
files', we refer to files that are actually deleted. So, not the
files that can be retrieved from the recycle bin, but the files that
are removed from the Recycle bin or otherwise (as explained above)
not retrievable by conventional means.
If deleted files need to be retrieved one can try
to recover these files using undelete software. Undelete software is
almost as old as the IBM compatible PC itself. Even in the early days
of personal computing inventive programmers, such as Peter Norton, created utilities to
retrieve deleted files. Those early undelete tools tried to retrieve the
files by re-registering them in the file system (in-place
recovery). This in contrast to most of today's tools, which recreate the file on a different drive (salvage
by copying). The latter is considered safer; editing the file
system directly always includes the risk that you make matters
worse. So, although today's 'undelete' software technically does not
really undelete a file (the original file remains deleted) it's
still referred to as undelete software.
Whether removed files can be recovered at all depends on several
- the file system type (NTFS is more reliable in this regard)
- in case of FAT type partitions, the degree of fragmentation
- whether the disk has been written to after the file(s) have been
Please note that when a file is deleted, what actually happens is
that the reference to the file is deleted: the contents if the file
itself remain on the disk. The space that the file occupies is
released to the file system for re-use. As such it's always best to
perform a file undelete as quickly as possible; anything that gets
saved to the disk could overwrite the deleted file.
Make sure you don't install the undelete software to the disk that
holds the deleted file(s), as this could overwrite the areas that
hold the deleted file's data!
For FAT type file systems, deleting a file results in a directory entry
being modified so the file
will no longer be shown. Also, clusters allocated to the file are
marked as available for re-use in the File Allocation Table - this explains why recoverability
of fragmented files on the FAT file system is poor.
For the NTFS file system the most important fact is that the MFT entry for the
remains, but the file is flagged as 'not in use'. The MFT entry
holds a runlist (a detailed list that describes the location of the
file on the disk) for all data fragments so file fragmentation is not
Our iUndelete is a quick and easy
way to undelete files. If the volumes that contain the (deleted)
files have additional problems (corruption or other damage), use iRecover.