Recovering deleted files

Linda Carter · Post by **Linda Carter** » Sun Jul 18, 2010 4:33 pm

I made a mistake today and deleted a file with almost 1 GB (RAR) that I believed to be uploaded to a server. It was not, due to a server error.

After that I downloaded at least 4 or 5 different softwares to at least tell me if the file could be recovered. It was deleted using Shift + Del (today) and nothing was written on that directory ever since. I even restarted the computer (Win XP SP3). This was done on C: on a 750 GB Hard Drive, using Truecrypt and Whole-disk-encryption, and 5-6 GB free (HDD needs to be cleaned and I am currently uploading files for that purpose).

However, I noticed one thing. All of those programs that claim to recover deleted files (some are irrecoverable) never detects recently deleted files. I was able to find small (not so recent) files, and a lot others with different sizes, that were deleted months and even years ago.

But none of those programs were capable of finding recently deleted files. Which means, I will need to write more data on the Hard-Drive and make them irrecoverable as well because for some unknown reason Windows is not informing those programs that data was purged on such areas.

Is there a reason for that? Something I am not aware of?

I thought it was possible to recover (or at least see a status about the deleted file) right after that file was gone. Looks like I was wrong.

Note: A list of some programs tested for this: Magic Uneraser 2.0 / Recuva.

SamG · Post by **SamG** » Sun Jul 18, 2010 5:57 pm

General Discussion is not intended to be a support forum, so I am hoping you have or can find another place to raise your question. My experience with deletion recovery tools is pretty limited or I would try to suggest a place.

3Di · Post by **3Di** » Mon Jul 19, 2010 8:19 am

Big files are deleted, just deleted. That's $indow$.

EXreaction · Post by **EXreaction** » Sun Jul 25, 2010 11:04 pm

There are a number of things I've used in the past.

There was a free one called Recuva, though I am not sure if it will work. I've used a program called Get Data Back in the past and it did work great.

god0fgod · Post by **god0fgod** » Mon Jul 26, 2010 7:54 pm

I think there are business which specialise in file recovery, taking care of it all for you. If the file is particularly important that may be a good option.

Linda Carter · Post by **Linda Carter** » Tue Jul 27, 2010 8:37 pm

This inconsistency is only happening with the only file I need to recover among dozens of others. I have deleted a file today and used Recuva to see if it could be detected and recovered. It was detected, but in this case is located in the non-encrypted drive (marked as in "excellent" condition).

So it must be Truecrypt's fault, that's the only thing I can think of for so much delay reporting this file (and others from this specific C:\ directory as deleted.

Or maybe this not an exact science. I will wait but frankly what's the point of using such tools if the cluster will be overwritten and there is a great chance of not recovering the file?

Another possibility it's the fact that both drives are fragmented.

However I believed it was a lot easier to recover any deleted file on Window$ rather than actually recovering any data from a defective Hard Drive. It seems there's no difference after all.

advertisements