Wed, 07/07/2010 - 09:33 — KETTANEH

Recovering deleted files

When you create a file, it has its first bite at existence, an existence which continues until you, in your casual god-like manner, delete it. Deleting the file isn’t the end, though. All you need to do is open up the Recycle Bin on your desktop, select the file and drag it onto the desktop or into an Explorer window to recover it. Or simply double-click to open the Recycle Bin, select the file, and choose Restore from the pop-up menu to restore it to its original folder. Voila! Witness the file’s second coming.

Now, what happens if you empty the Recycle Bin? Surely that’s the end of the file’s existence? To all appearances, yes. The file will appear to have been completely annihilated. But that’s only because Microsoft reckons once you’ve deleted a file and emptied the Recycle Bin, you and the file have both had enough chances. But with an undelete utility there’s a good chance you can resurrect the file yet again for its third go at life – good news for those of us whose fingers work faster than our brains.

What won’t recycle
The Recycle Bin may be a marvel – one which most of us take for granted – but it does have its limits. For starters, the Recycle Bin does not catch every file you delete. All files deleted from the desktop or Windows Explorer end up there, as do files deleted from within compliant programs. Files deleted at the DOS prompt, though, bypass the Recycle Bin, as do any files you delete from removeable media such as floppy or Zip disks, and files deleted from compressed folders.

What’s a ‘compliant’ program? You’ll find most reputable commercial programs are compliant. That is, if you delete a file from within one of these programs it will be sent straight to the Recycle Bin, from which you can restore it if you need to.
The only way to check whether a program is compliant is to try deleting a test file, and then look for it in the Recycle Bin:

   1. Open the application you wish to test.
   2. Create a test file and save it.
   3. Use the application’s File -> Open command to display the Open dialog box.
   4. Locate your test file in the list, right-click the file and choose Delete from the pop-up menu.
   5. Check the Recycle Bin to see whether your file has been placed there.

One thing to watch out for is deleting files via macro languages, such as Microsoft Office’s Visual Basic for Applications (VBA). While recent versions of Office are Recycle Bin compliant, if you create Office macros which delete files automatically using the kill [file] statement, those files will bypass the Recycle Bin entirely.

Why files don’t disappear
So, what’s going on? How is it you can delete a file and yet it remains on your disk?

Let’s start by looking at what happens when you delete a file and it’s placed in the Recycle Bin.

In fact, the file is not moved to the Recycle Bin at all. Instead, the file stays in the same place but its directory entry – the complete path and filename of the file – is removed and placed in a hidden folder called Recycled. (Note: If you have more than one drive in your computer, you’ll have a Recycled folder for each drive.) The file is then renamed. The original name and location of the file are stored in a hidden index file, called INFO2 (or INFO, if you’re using Windows 95), located in the Recycled folder.

When you open the Recycle Bin, click a file and choose Restore, the original path is read from the INFO file, the file is renamed and its directory entry restored.

Deleted files are renamed and stored in the Recycled folder, as can be seen in this folder listing displayed in a DOS window.

The Recycle Bin is a FIFO stack: First In, First Out. That means the files you delete earliest are emptied from the Bin first. When the Recycle Bin is full, Windows starts deleting files from the Bin to make room for newly deleted files. It’s only when you right-click the Recycle Bin and select Empty Recycle Bin from the pop-up menu that all files within the Bin are ‘deleted’.

As you can see, files aren’t really erased when you delete them, just renamed and their location hidden from view. So, what about when you empty the Recycle Bin? What happens then?

Once again, the file data is not deleted. Instead, Windows changes the file’s directory entry to indicate the space occupied by this file is no longer needed and is available for use. The data’s still there, but at any time if the operating system needs space for another file, it may be overwritten. Until it is overwritten, the file still exists on the hard disk and is recoverable. That means you dramatically increase the chances of being able to recover a deleted file if you refrain from any subsequent disk activity, such as creating, editing or copying files.

To delete a file without sending it to the Recycle Bin, select the file (or files) and then press Shift-Del (that is, hold down the Shift key while you press the Del key). You’ll be asked whether you’re sure you want to delete the file. Click Yes.This is a good way to ensure sensitive files don’t remain lurking in the Recycle Bin, but to completely erase all traces of a file you should use a third-party shredder/eraser utility, such as File Shredder (free of charge for personal use).

Undeleting

Unfortunately, at this stage the job of recovering the file is beyond Windows. But it’s not beyond the abilities of numerous third-party unerase/undelete utilities.

Some of the better known undelete utilities are File Recover, WinUndelete and Recuva (the latter is free, but they request a donation if you use the software). Ontrack provides a whole series of undelete tools of increasing power called EasyRecovery. Ontrack also provides data recovery services for those times when your hard disks are failing and you need serious help.

If you need to recover a file immediately, don’t install any of these undelete utilities onto the hard drive where the lost file is located, or you may overwrite its contents. Instead, run the program directly – if it comes on a CD, run it from the installation CD; if it’s an Internet download (as most of them are), instead of saving the file to disk, open and run it from the Internet. WinUndelete makes this easy by offering two downloads: an Installation Package and a Direct-Use Package. If you use the Installation Package, which saves the utility on your hard disk, you run the risk of overwriting the deleted file and making it irretrievable; instead, use the Direct-Use Package which is run directly from the Internet; then there will be no danger of overwriting your files.

Step-by-step: Fixing a damaged Recycle Bin

A. If the Recycle Bin’s INFO file is damaged, your Recycle Bin will appear empty even when it isn’t. You can often restore a file in this situation by searching for the file by name (click Start -> Find -> Files Or Folders, or Start -> Search in Windows XP) and then renaming it.

If you still can’t recover your file, try deleting the INFO file. This will cause Windows to create a new INFO file the next time you restart your system. When you reboot, you may find the files in the Recycle Bin are now accessible. You’ll need to work from a DOS prompt to fix things up. Remember to press Enter after typing each of the DOS commands mentioned below:

1. Click Start -> Programs -> MS-DOS Prompt to open a DOS command window. (In Windows XP use Start -> All Programs -> Accessories -> Command Prompt.)
2. To make the Recycled folder the current folder type:

CD \RECYCLED
3. To unhide the INFO file type:

ATTRIB -H INF*
4. To delete the INFO file type:

DEL INFO*.
5. To close the DOS window type:

EXIT

B. Your Recycle Bin may also appear empty if any of the files within it are damaged. In this case, you probably won’t be able to recover the contents of the Recycle Bin, but you can make it function correctly again by doing the following:

1. Click Start -> Programs -> MS-DOS Prompt. (In Windows XP use Start -> All Programs -> Accessories -> Command Prompt.)
2. Type:

CD \RECYCLED

3. Type:

ATTRIB -H DESKTOP.INI

4. To copy the desktop.ini file to your root folder type:

COPY DESKTOP.INI \

5. To delete the entire contents of the Recycled folder type:

DEL *.*

6. To copy the desktop.ini file back to your Recycled folder type:

COPY \DESKTOP.INI

7. To delete the copy of desktop.ini in the root folder type:

DEL \DESKTOP.INI

8. To close the DOS window type:

EXIT

C. If the Desktop.ini file is damaged or missing, you can get the Recycle Bin back up and running correctly by creating a new Desktop.ini file within the Recycled folder:

   1. Open the Recycled folder in Windows Explorer (if you can’t locate it, open any folder in Windows Explorer, select Tools Menu -> Folder Options -> View Tab, enable the Show All Files option and click OK).
   2. Right-click in a blank spot and select New -> Text Document to create a new text file. Name the file desktop.ini.
   3. Double-click the file to open it and type the following two lines:

[.ShellClassInfo]

CLSID={645FF040-5081-101B-9F08-00AA002F954E}

4. Close and save the file, then reboot.

D. The Recycled folder itself can also become damaged. If this is the case, you will be able to send files to the Recycle Bin and the Recycle Bin icon on the desktop will appear full, but you will be unable to view the contents of the Bin and the Empty Recycle Bin command will be unavailable when you right-click the Recycle Bin.

To fix this you must delete the Recycled folder. Windows will recreate it when you reboot: