Deleted Data Recovery

What To Do When You Accidentally Delete Data

1. Don’t Panic – Often people make the situation much worse by overreacting and making a snap decision to attempt recovery.  Try to keep your calm and research what to do first, before running out to install the first program that advertises it can get your data back.  Remember that until you do something, you have a near 100% chance of recovery.  Once you start messing around that can quickly change.
2. Immediately Stop Using and Shut Off The Computer (Without Shutting Down) – I know you’ve been taught to never do this as it poses some minor hardware risks, however the risk is much higher that the computer might overwrite the data during it’s logging process while shutting down.  So in all seriousness, just unplug it, or pull out the battery of the laptop (some laptop models you can just hold down the power button for 5-10 seconds).  Even just leaving the computer on or browsing the web poses risks to the data.  Shutting it off is the only guaranteed way to stop all future writes to the hard drive.
3. Remove the Hard Drive – Although you might be tempted to install some software on the computer that the data was deleted on, DON’T!  The files downloaded and generated when the software is installed will often overwrite where the data is stored.  Data recovery operations should always be performed on another computer running it’s operating system on a separate hard drive.
4. Clone the Hard Drive – Even if you’re experienced in data recovery, this step is very important.  Working from the original drive poses significant risks to the data.  Not only because of the ease of making a mistake during the recovery, but also there are hardware risks.  Very often seemingly healthy hard drives may have areas of bad sectors that have gone undetected.  During a data recovery scan, these areas will become apparent and the drive may actually fail partway through.  By cloning first, you’ll at least have a copy of all the data on the first pass.
5. Choose a Data Recovery Program Appropriate to Your Filesystem – No one data recovery program does it all.  Although their advertising departments may tell you otherwise.  And even if it does support your filesystem it might not be the best at handling it.  If it’s a typical NTFS file system, you’ll probably want to go with R-Studio, if it’s FAT on the other hand you might be better off going with GetDataBack or another program.  It’s important to research this first, otherwise you’ll waste money on software that doesn’t really work for your situation.  Here in our lab we use about a dozen or more programs for different situations.
6. Extract the Recovered Data to A Different Hard Drive – While this seems like it should be obvious, and most programs won’t even let you this does happen.  I’ve had quite a number of difficult cases where a computer guy started to recover the data back onto the same drive it was deleted from, thus overwriting other files needing to be recovered.  This is again why step number 4 is so important.  Only after you are confident you’ve recovered everything you need might you consider copying the files back to the original drive.

In most cases, yes.  Even if you empty the recycle bin the data still exists on the hard drive, at least for a while.  It’s important to understand how operating systems like Windows store data.  All operating systems use a type of filesystem which is essentially a directory of where files are stored, their names, folder location, size, and other information.  Also to protect against accidents, a backup copy of the filesystem is also stored in most operating systems. When a file is “deleted” what’s actually deleted is the reference in the primary filesystem table.  However the file itself is stored in a different location on the drive.  After the entry in the filesystem is deleted, the OS now thinks that space is available and may opt to store another file in that location making recovery impossible.  That’s why it’s so important to immediately stop using the computer where the data was deleted.  Also in most cases the secondary filesystem still contains the necessary information to properly identify the file.  Just don’t wait too long, or the backup copy may be updated and the entry lost completely. Most data recovery software works by analyzing the filesystem data to see what entries are in the secondary copy but not in the primary.  Thus identifying them as deleted files.  The higher end software can also perform a data area scan to identify lost files and folder structures that are no longer available in the filesystem.  The files may not have their names and folder locations, but if you have time to sort through them, you’ll likely find what you’re looking for.

The pros here at Data Medics in Cranston, RI will gladly take a look at your drive to see if we can get back your lost data.  We offer free evaluation, even if someone else has told you that the data can’t be recovered.  If we fail to get back your data, there’s no charge for our service.  Visit our homepage by clicking any of the links at the top of the page for more details.   Or visit our contact page to get in touch with someone right now.