Oh crap. I accidentily deleted pics of my deceased father, and want them back

K

Kuyt

Gawd
Joined
Jan 21, 2007
Messages
563
There was this huge ass folder of his pics from my digital camera on my old SP1 rig that I'm forced to use now, and I put in the Recycling Bin since the comp is old as fuck and has hardly any storage (Norton Protected Recycle Bin), hoping that I'd transfer it later or something. Little did I know, it's no longer there and I guess Norton deletes shit off your recycling bin when you add more stuff in there (limits the size of it) and just has the recent things I put in there.


Anyway to recover them? :( I feel like crap. Oh well, I guess.
 
You can try using an undeleting program, although it's not guaranteed to work, especially as the data may have been overwritten if the drive is small. You should avoid use of the hard drive and install the undelete program on a different drive (or a USB pen drive). I'm not sure what programs are good, but this comes up as a freeware example:

http://www.snapfiles.com/get/restoration.html
 
Got a budget?

Remove the drive from the rig and take it to a professional data recovery service.

No budget?

Pop that drive in a different rig and run a file recovery program over it.



Either way, DO NOT use that drive again until AFTER you've recovered any of the pics of your deceased Dad you can get back.
 
Recuva is free and might help, but to be honest, if the files were in the Recycle Bin and then pushed out (GIGO, technically, Garbage In, Garbage Out... with FILO - First In Last Out - in action) the files are effectively gone forever.

If you stopped using the drive precisely when you realized the files were gone there's a tiny chance of some recovery of the content using data recovery software. Recuva works with the data in the Recycler folder (where Recycle Bin content is stored) but once the data is pushed out, it's gone, there's nothing you can do to help with that.

The chance that the data - or at least some part(s) of it - are still on the drive in the original positions is there, of course, but Recuva can't help with that. You'll need something a lot stronger, you could say.

TestDisk might be able to help, but it sounds to me like this should be done by a pro data recovery shop (and I don't mean Geek Squad or anyplace local to you unless you happen to live next to DriveSavers or Ontrack Systems, that is). Commercial/consumer data recovery software like EasyRecovery or R-Studio might be able to help, but based on what's been said by the OP, I have serious doubts he'll get any of the images back at this point.

Sometimes that's just how things work out... :(
 
I have had success with using Recuva as well. But like already been stated, DONT USE THE DRIVE. Another program I've had success with is GetDataBack. Unfortunatly its not free, but it beats paying a service for data recovery which in most cases can easily run in the hundreds.
Correct me if I'm wrong, but when the OS empties the Recycle Bin, the space reserved for the deleted file is labeled as "free" and the next deleted file overwrites that space. So as long as you havent used that drive since, you should have a decent chance at recovering those photos.
 
Yea, I'd recommend using Hiren's boot cd.

Step #1, attach another IDE drive and set it to master.
Step #2, set the drive (that you need to recover contents from) as slave
Step #3, boot to hirens's boot cd.
Step #4, use the SEVERAL recovery tools to recover those files to the 2ndary (new Master drive)

recovery however is less likely with Norton Protected recycle bin. Like others have said, if you put more stuff in the recycle bin, it's probably overwrote those files.

Good luck, and next time don't use the recycle bin as a storage area... they make usb thumb drives for $10 now, go buy one.
 
Joe Average said:
TestDisk might be able to help, but it sounds to me like this should be done by a pro data recovery shop (
Click to expand...

What does a pro shop do differently that I can't do already with free software like Recuva? They just use a software method to recover data too right? They certainly don't use microscopy unless you have loads of money to pay for it. I've deleted a load of mp3 files by accident a couple of times and was able to retrieve all of them using Recuva both times. But that was because I realized my mistake immediately so none of them had been overwritten. If the data is overwritten though how is a pro shop going to have any better chance to retrieve the data than I would?
 
Klob said:
What does a pro shop do differently that I can't do already with free software like Recuva? They just use a software method to recover data too right? They certainly don't use microscopy unless you have loads of money to pay for it. I've deleted a load of mp3 files by accident a couple of times and was able to retrieve all of them using Recuva both times. But that was because I realized my mistake immediately so none of them had been overwritten. If the data is overwritten though how is a pro shop going to have any better chance to retrieve the data than I would?
Click to expand...

If it's a decent local shop(not ShitSqaud, Circuit Shitty..etc) they'll use something like EasyRecovery Pro or something along those lines which IMO is one of the best data recovery programs on the market. They'll hook your drive up to a rig that has ERPro or other recovery program and scan your drive, it can take days depending how much data there is and how messed up things are. But nothing comparable to what DriveSavers can do. If there's a mechanical failure with the drive you're generally screwed, that's when you use somebody like DriveSavers because many local shops don't have the ability to do anything in those situations.
 
You missed the point of my post.

Recuva recovers files that are still available to the OS, nothing more. If the file is deleted without going to the Recycle Bin - commonly done by holding Shift and then deleting the file which bypasses the Recycle Bin totally. If you delete files without using the Recycle Bin (like using the Command Prompt, etc) then you're out of luck.

Make no mistake: Recuva is nice for simple data "recovery" of files you deleted that hit the Recycle Bin. If they're still there, or deleted from there, you might have some luck but I doubt it.

I just tested this theory because I just cleared off one of my main data storage partitions. WIth absolutely nothing on that drive and formatted as NTFS, I copied a single mp3 file to that drive, then deleted it (highlight, press Delete, done). That placed it in the Recycle Bin but even at that point Recuva can't/couldn't "find" it and showed nothing in it's scan. I then deleted the file totally by emptying the Recycle Bin and THEN Recuva showed a recoverable file, in RECYCLER (which is where Recycle Bin stores the parameters of the file that was just tossed out) but the filename was lost in the process and it turned into Dd2.mp3 which isn't a big deal I suppose.

I tried the same test with 8 different random files, text, picture, mp3, even a ripped VOB file from a DVD I had on the drive, and deleted them into the Recycle Bin - Recuva showed nothing at that point for recovery. Once deleted from the Recycle Bin by emptying it, Recuva could "see" them, again with random filenames but with their extensions intact. So recovery at that point is still possible, after the files are deleted from the Recycle Bin by emptying it.

What does all this convoluted mess mean? It means there are instances where Recuva is of absolutely no use to you or me or anyone else in terms of data recovery. It's a free product, and it only works in conjunction with the Windows file system and Recycle Bin as they handle data.

Professional data recovery comes in when you can't get Windows to boot, or the file system is so fucked up (the MFT, the Registry, all sorts of things) and so busted you can't boot the OS. Understand that Recuva is a Windows application that calls upon the very file system and file handlers that Windows itself uses - if you can't get into Windows, you sure as hell won't be able to do data recovery with a Windows-based data recovery application.

Sure, these days you can actually run some of these tools from a WinPE CD/DVD, which is very useful to a large degree, but they still can't touch what true data recovery does which is recover the data outside of the file handlers any given OS uses that might get in the way and pulling the raw data directly off the platters.

By your own admission (meaning Klob) you deleted some files, realized the mistake, and immediately ran Recuva to get them back - it couldn't have pulled them from the Recycle Bin because it can't see stuff in there, it can only pull data from RECYCLER which is the hidden folder which keeps additional backups of data after being deleted. Funny how that works... RECYCLER is basically a duplicate MFT in some respects as it maintains the same type of info the MFT and the very directory structure does, it just truncates the filenames to some random text and keeps the extensions, which gives Recuva something to work with.

But of course, if you continue to use the drive/partition you risk overwriting the data with new stuff, which is the nemesis of data recovery. First rule of data recovery is (no Fight Club references here) STOP USING THE DRIVE. If you have data recovery software, run it off a USB stick. You can easily make any software (at least everything I've tried) into a portable app nowadays pretty easily and that's what I've done with the tools I've purchased in the past decade. I have a Portable R-Studio, Portable EasyRecovery, Recuva (runs off a USB stick natively anyway), TestDisk (same thing), and a few other tools most people outside of government agencies have ever heard of, all running off a 4GB USB stick. :D

So, while it's entirely possible to do data recovery on files that were just deleted and still on the drive, untouched, with a working Windows installation, sometimes that isn't the situation that requires data recovery.

Sometimes people have machines that were dropped. Sometimes people have machines that don't power up anymore, and I don't mean just the power supply or mobo or CPU. I mean systems with dead hard drives that the BIOS can't see, drives that don't initialize, drives that simply don't work anymore.

Recuva can't do Jack Shit for those situations, and that's what pro shops are for. Or people like me...
 
You must log in or register to reply here.
Back
Top