Recover Deleted Files: Tips and Tricks for a Safe Recovery
Q. I’ve just lost everything after accidentally deleting the wrong folder or file. Please help me recover deleted files!
A. Immediately do nothing. Hands off the keyboard and mouse and take a deep breath. Let it out slowly. Once that initial spike of panic has subdued, you can act with a more level head. Clear thinking is critical in this situation, as the wrong actions can ruin your chances of deleted file recovery altogether.
To recover deleted files, it’s important to make as little change as possible to the hard drive from which they were deleted. This means that for best results, the computer that contained the deleted data should not be used after the deletion, not even for simple web surfing or emailing.
This is because when data is deleted from a computer’s hard drive, the files themselves are not actually destroyed (unless you used a secure delete/shred utility that promises to do so, in which case recovery is extremely unlikely). Rather, your drive has a file table that tells the system where all files and folders are saved on the disk. When a file is deleted, the file table is modified to show the requested files have been removed, marking the space they occupied as being empty and available to use, even though they’re still physically present there. Now the host operating system (Windows, Mac OS, etc.) and any other application will typically use that space as needed. Your deleted files are thus gradually destroyed as the system uses that space.
If you’ve followed so far, you’ll appreciate that a timely response is important to recover deleted files.
DIY: How to Recover Deleted Files Yourself
This brings us to DIY recovery, which can often be done safely. The golden rule is to never modify the hard drive that contains your deleted data. This very much includes installing data recovery software on the computer from which you’re attempting recovery, as we know from the previous paragraphs that any change to your computer’s hard drive can damage the deleted files. A common mistake I see in DIY situations is not only the installation of data recovery software to the same computer, but then the saving of recovered data back onto that same hard drive. This process is almost certain to ensure a partial recovery at best and a total loss at worst.
The simplest, safest route is to engage professional data recovery services from this point. However, with some careful planning and effort, you may very well be able to get yourself out of trouble without needing to pay for assistance. If this sounds appealing, read on!
Easy part first:
- If on a Mac, check Time Machine (in Control Panel and usually in the Finder bar at the top-right near the clock). If you had Time Machine configured and another hard drive connected (or an Apple Time Capsule), then there’s every chance your files are safely waiting for you there (learn more here).
- If on a PC, you can restore it from a backup version if using Windows Backup or from a previous version if you’ve got shadow copy protection enabled (learn more here).
- For all operating systems and computer types, try to think about other possible locations your needed file/s could be; for example, did you have a USB flash drive with a copy from last month when you were away for that conference, did you email yourself a copy of that presentation back in February, or did you actually format the camera’s memory card after you copied the photos to your computer? You get the idea.
If you’ve tried this and are sure the only copy of your data is what you emptied from the Recycle Bin or Trash before your morning coffee today, roll up your sleeves – things are about to get a bit technical.
Assuming you have no backup of any kind, here are the steps to follow. Please note, this process will require a little computer familiarity and is not a step-by-step guide as the general steps are intended to help you find your way on whatever system you’re using. Read all steps below first so you understand what lies ahead before you start.
Creating a disk image is an optional step because we’re assuming your computer’s internal hard drive is physically healthy and that you will not be modifying its contents in any way. However, it’s better to create the image if you have the time and ability to do so, because having an image is basically having insurance for your lost data. It helps ensure you’ll have the flexibility to try another recovery method if something goes wrong or worse, if your computer’s hard drive suffers physical failure during the recovery, which is always a possibility.
- Turn your computer off to help ensure your hard drive’s contents are not modified any further.
- Grab a 4GB+ USB flash disk or DVD-R disc and gain access to another computer in your home, school, workplace, library, etc.
- Download a free, bootable data recovery tool to suit your situation; try Recuva’s free Portable version for Windows; one of Stellar Phoenix Mac DR (USD$99), Wondershare DR (USD$39.95) and Prosoft Data Rescue (USD$49 or $99); and dd_rescue from a bootable Knoppix system for systems running Linux variants. For the technical user, TestDisk is free and can recover from Windows, Apple and *nix systems.
- Create the bootable media (USB flash drive or CD/DVD) with the software you downloaded, then return to the computer containing your deleted files. Don’t power it up yet!
- Connect an external hard drive that has enough available space to hold your recovered files and connect your bootable USB flash drive that you made in Step 4 (if you have a CD/DVD, insert that in the next step instead).
- Power up your computer and set it to boot from your USB flash drive or optical drive (inserting the CD or DVD at this point if relevant). On a Mac, this means holding down the C key while you boot whilst on Windows computers you may need to be pressing a Function key to bring up the Boot menu, typically F10 or F12 (check your BIOS via F2 or DEL key if unsure).
- Assuming all goes well and you created the bootable system successfully, you should see your computer start up in the ‘live’ environment from your USB flash drive or optical disc.
- Run the data recovery software it includes, point it at your computer’s internal hard drive, then scan, electing to save the scan results (if this is an available option to your external hard drive that you connected in Step 5).
- Review the results of the recovery scan, then select and save the required files to your external hard drive. When done, power the computer down via the software interface (don’t just kill the power!).
- Review the recovered results on another computer. If the results are good and your files open correctly, you’re done! You can resume using your main computer again – be sure to make a copy of your recovered data back on your main computer immediately!
- If the results were not so good, consider trying another tool such as the more complex TestDisk (as linked above), or else consider engaging the services of a data recovery professional.
Take your time, read and learn, then make deliberate and considered actions from start to finish. Remember, you can always seek assistance if the going gets tough. There are friendly, technically-minded folk who are happy to assist polite requests for help via online discussion forums such as OCAU and Whirlpool.net.au.
Lastly, don’t be afraid to just stop the process if things start to feel like they’re getting beyond your control. As a data recovery professional, I’d much rather begin a deleted file recovery for you after you’ve halted your DIY attempt than to receive a drive that had numerous, increasingly-panicked modifications applied in an attempt to undo a growing disaster!
You can do this. Good luck!