How do I recover a huge newly-created but permanently file?

S

ScHpAnKy

2[H]4U
Joined
Jan 11, 2003
Messages
3,332
I accidently a word - PERMANENTLY DELETED.

I froze the machine's state by pulling the power to prevent further access -

I've tried EASEUS data recovery and GetDataBack, but they only show the two files created just prior - wouldn't the file still be on the drive if the system just cleared the allocation space?

For what it's worth, the file I need to recover was approximately 3.5hrs old, about 130GB and the two files in the same directory created 2hrs prior are recoverable.

I'm looking for other options, or recommendations beyond outsourcing it.
 
Last edited:
Need a LOT more detail and specificity from you...

SSD or HDD?
Was the file in use in any way when the system froze?
Killed the computer to prevent further access by what, to what?
Is the drive this is on still otherwise functioning?
What makes you think the system cleared the allocation space? It is more likely that something was corrupted than cleared by the system, because systems normally only clear things intentionally and what you are describing doesn't sound intentional.

I will probably have more questions after you answer these.
 
arentol said:
Need a LOT more detail and specificity from you...

SSD or HDD?
Was the file in use in any way when the system froze?
Killed the computer to prevent further access by what, to what?
Is the drive this is on still otherwise functioning?
What makes you think the system cleared the allocation space? It is more likely that something was corrupted than cleared by the system, because systems normally only clear things intentionally and what you are describing doesn't sound intentional.

I will probably have more questions after you answer these.
Click to expand...

AFAIK, you can't recover from a solid state drive due to TRIM.

I don't think you understand the original question - I accidently "permanently deleted" (shift-deleted) a file, the second I did that I immediately killed power to the system to prevent further read/write so that I would be certain I didn't overwrite over the newly-freed allocation space on the disk drive.

The drive has been removed from the system and placed in an external, where it is only powered for data recovery. The file/system was never corrupted.
 
ScHpAnKy said:
AFAIK, you can't recover from a solid state drive due to TRIM.

I don't think you understand the original question - I accidently "permanently deleted" (shift-deleted) a file, the second I did that I immediately killed power to the system to prevent further read/write so that I would be certain I didn't overwrite over the newly-freed allocation space on the disk drive.

The drive has been removed from the system and placed in an external, where it is only powered for data recovery. The file/system was never corrupted.
Click to expand...

I agree I didn't understand the original question, but that is because you didn't say any of that in your original post. You said the PC froze so you turned it off. You never once mentioned having deleted the file, and now you are implying it didn't actually freeze. Go back and read your original post objectively (especially the title) and you should see how it would confuse the heck out of someone trying to help you. That is why I asked so many questions, because you were incredibly unclear and imprecise (and that is why I asked about SSD, just in case you were as frantic and confused as you sounded).

As to recovering this file... If you really killed power "immediately" after hitting delete then you pretty much did the worst thing you could possibly have done. If the HDD hasn't fully completed the delete process when you power down like that then you actually screw the file up even more. You never want to turn off/cut power to a PC when it is doing anything to a file you care about, especially deleting it. I learned this the hard way. Besides, unless an HDD is nearly full and busy with a lot of writes it is extremely unlikely it will overwrite any part the most recently deleted file. So you pretty much always want to make sure you give the HDD plenty of time to complete the delete operation THEN turn the PC off. I usually wait about 15 seconds after the PC says the operation is completed, then hold the power button for 7-10 seconds. So far that has always worked for me.

That being said, I would think you would have a decent chances with EASEUS still. But since that didn't work I would probably try some demo versions of a couple other recovery apps, like Pandora. I did once find a utility that found a file EASEUS didn't find, but I can't recall which recovery utility it was. If that doesn't work then I am afraid I don't have much advice for you other than Ontrack.
 
arentol said:
I agree I didn't understand the original question, but that is because you didn't say any of that in your original post. You said the PC froze so you turned it off. You never once mentioned having deleted the file, and now you are implying it didn't actually freeze. Go back and read your original post objectively (especially the title) and you should see how it would confuse the heck out of someone trying to help you. That is why I asked so many questions, because you were incredibly unclear and imprecise (and that is why I asked about SSD, just in case you were as frantic and confused as you sounded).

As to recovering this file... If you really killed power "immediately" after hitting delete then you pretty much did the worst thing you could possibly have done. If the HDD hasn't fully completed the delete process when you power down like that then you actually screw the file up even more. You never want to turn off/cut power to a PC when it is doing anything to a file you care about, especially deleting it. I learned this the hard way. Besides, unless an HDD is nearly full and busy with a lot of writes it is extremely unlikely it will overwrite any part the most recently deleted file. So you pretty much always want to make sure you give the HDD plenty of time to complete the delete operation THEN turn the PC off. I usually wait about 15 seconds after the PC says the operation is completed, then hold the power button for 7-10 seconds. So far that has always worked for me.

That being said, I would think you would have a decent chances with EASEUS still. But since that didn't work I would probably try some demo versions of a couple other recovery apps, like Pandora. I did once find a utility that found a file EASEUS didn't find, but I can't recall which recovery utility it was. If that doesn't work then I am afraid I don't have much advice for you other than Ontrack.
Click to expand...

It's common terminology in data recovery to "freeze" a system by stopping the machine at it's current state. I updated the original post to those that aren't in the field or don't have much experience with it.

Unfortunately, I cannot add "deleted" to the title, but it's clearly written in the OP.

The system was in an idle state when the file was deleted (which only takes a fraction of time) - keep in mind, single permanently deleted files (shift-click) are "gone" instantly.

Nothing read/written at the time, deleted (instantly), few nano seconds, power button off.

Is EASEUS likely to pick up more or less files the more times it's run? It was a 24hr full scan from start to finish (750GB drive) and only had the same results that I listed in the OP.
 
Uh.. I am pretty sure using the shift-delete combination does not "instant" delete anything any faster than just hitting the delete key. The only thing the shift key does is bypass sending it to the recycle bin. If the computer was in the process of "deleting' the data and you turned it off you most likely did more harm than good.
 
Skillz said:
Uh.. I am pretty sure using the shift-delete combination does not "instant" delete anything any faster than just hitting the delete key. The only thing the shift key does is bypass sending it to the recycle bin. If the computer was in the process of "deleting' the data and you turned it off you most likely did more harm than good.
Click to expand...

no.

Nothing was "in-process" - I don't know why this is so hard to understand.
So, to avoid any confusion:

THE PC WAS IN AN IDLE STATE PRIOR, DURING, AND AFTER DELETION OPERATION AND FINISHED DELETION PRIOR TO SHUT DOWN
THE PC WAS IN AN IDLE STATE PRIOR, DURING, AND AFTER DELETION OPERATION AND FINISHED DELETION PRIOR TO SHUT DOWN
THE PC WAS IN AN IDLE STATE PRIOR, DURING, AND AFTER DELETION OPERATION AND FINISHED DELETION PRIOR TO SHUT DOWN
THE PC WAS IN AN IDLE STATE PRIOR, DURING, AND AFTER DELETION OPERATION AND FINISHED DELETION PRIOR TO SHUT DOWN



No read/write occured prior to killing the power.
 
hmm well if the file has gone then obviously the os has written to the disc to mark it as deleted.

not sure how you would recover a file from a ssd if that's what it was on, trim could have already erased the blocks making file recovery impossible. maybe somebody else can point out the subtleties of recovering files on an ssd vs hd.

might have been better to post in the ssd & data storage forum.
 
dangerouseddy said:
hmm well if the file has gone then obviously the os has written to the disc to mark it as deleted.

not sure how you would recover a file from a ssd if that's what it was on, trim could have already erased the blocks making file recovery impossible. maybe somebody else can point out the subtleties of recovering files on an ssd vs hd.

might have been better to post in the ssd & data storage forum.
Click to expand...

That's not how it works - when you delete a file, the OS sees the area as space that you can now write over. The previous information is there until it's erased by new data.

I'd be interested in having this moved to the correct forum, it doesn't appear there's much data recovery experience in general, adding the word "deleted" between permanently and file might help
 
He was talking about on an SSD which is not the same as an HDD. You can not overwrite data on an SSD like you can on an HDD. That's what TRIM is for.
 
You must log in or register to reply here.
Back
Top