[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now


Data recovery

Posted on 2006-03-22
Medium Priority
Last Modified: 2013-12-01

some important data on my harddisk have disappeared yesterday. I'm not sure if I deleted them accidently or any virus did it. Is it possible in Windows xp to show which operations (such as delete, create) have been performed during the last time?

The lost data are mostly .txt files and also some Word and PDF files. Do you know any powerful data recovery freeware to get the data back?
I've tried some free demo versions, but they donot seem to work well.

Question by:dataminer
LVL 57

Expert Comment

by:Pete Long
ID: 16255339
File Recovery

When a file is deleted either from the Network, By a program or from the Command Line, is does not get put into the recycle bin. However the file is NOT erased, instead the information that points to the file is erased. By erasing the pointer, the file becomes "Invisible" to the Operating system. Using Third party software these files can be recovered.

NOTE: remove the offending Hard Drive and fit in in a working PC as a slave drive - Deleted files get overwritten FIRST so just installing recovery software can over-write them.

**********Freeware Recovery Tools**********

Deleted File Analysis http://www.execsoft.com/freeware/freeware.asp

PC Inspector http://www.pcinspector.de/file_recovery/UK/welcome.htm
(FAT 12/16/32 NTFS)

OnTrack http://www.ontrack.co.uk/freesoftware/freesoftware.asp
(Also have a Netware version - NOT FREE)

**********TrialWare Recovery Tools**********

Undelete 3.0 http://www.executive.com/undelete/undelete.asp (30 Day trial available)
(NT/2K/XP) - Can run direct from the CD

File Recover http://www.zdnetindia.com/indya/downloads/desktop/info/10204365.html

R-Undelete http://www.tucows.com/preview/254623.html
(FAT12/16/32 NTFS NTFS5 and Ext2FS)

Recover My Files http://www.tucows.com/preview/258313.html

**********Shareware Recovery Tools**********

File Scavenger http://www.webattack.com/features/filescavenger-704-421808.php
(NT/2K/XP) - Supports Reformatted Volumes -Limited to 32Kb file size!

GetDataBack for FAT http://www.webattack.com/get/getbackfat.shtml
(FAT) Works Even After FDisk and Format, Can run Over the network.

GetDataBack for NTFS http://www.webattack.com/get/getbacknt.shtml
(NTFS) Works Even After FDisk and Format, Can run Over the network.

Active@ UNDELETE http://www.webattack.com/get/activeundelete.shtml
(FAT 12/16/32 NTFS) Runs From MMC Console

Active@ UNERASER http://www.webattack.com/get/activeuneraser.shtml
(FAT 12/16/32 NTFS) Runs from DOS Bootdisk

FinalData Plus http://www.zdnet.de/downloads/programs/4/7/en10164547-wc.html

************Commercial Products************

File Restore ($39.00)

HDR Data Recovery ($485.00) Trail available

**********Good Link to More Info***********

Video Tutorial http://www.thepcspy.com/tutorials/article.asp?TID=111
LVL 88

Expert Comment

ID: 16255365
You might be able to turn on auditing (in the policies, but probably only available to xp pro, not home) in order to get events like that logged, but you'd have to have done that prior to it having happened, and it won't be possible to get all the details which you'd probably want!

First check in your recycle bin, maybe the files are there!

I haven't tried recovery with freeware, but you can find out if things are recoverable using getdataback, then you'd have to pay for the software to actually restore the files


Expert Comment

ID: 16255998
Hi There,

Below are Freeware PC Inspector File Recovery  and others  
which you may like to try to download and see if solve your problem
PC Inspector File Recovery is a data recovery program with support for FAT 12/16/32 and NTFS file systems. It recovers files with the original time and date stamp, and can optionally restore them to a network drive and can recover many files, even when a header entry is no longer available. On FAT systems, the programs finds partitions automatically, even if the boot sector or FAT has been erased or damaged. PC Inspector File Recovery offers an easy to use interface that will scan your drive and automatically make files that can be recovered available from a "Deleted" folder in an Explorer Style navigation tree.

Listed are 2  commerical Softwares which are very good recovery tool which you may also consider.

Dependingon your OS you format your drive...
GetDataBack for NTFS V3.01 http://www.runtime.org/products.htm
Recover your files when the data is no longer accessible due to formatting, fdisk, virus attack, power or software failure. Get everything back even when the drive's partition table, boot record, Master File Table or root directory is lost or corrupt.

or GetDataBack for FAT V3.01
GetDataBack will help you retrieve your files if the hard drive's partition table, boot record, FAT, or root directory have been damaged by a virus, formatting, fdisk or power failure. GetDataBack can even recover your data when the drive is no longer recognized by Windows.

Also another good one that also reciver disk partitions etc
Acronis Disk Director Suite 10
Acronis Disk Director Suite 10.0 is a comprehensive workstation partition and disk management suite that combines a number of previous Acronis products into one solution:

 Acronis Partition Expert allows you to resize, move, copy, split, and merge partitions without losing your data
 Acronis OS Selector is a multi-boot software utility that allows you to install multiple operating systems on your PC
 Acronis Recovery Expert allows you to recover accidentally lost or deleted partitions
 Acronis Disk Editor is a disk drive repair tool that allows you to perform advanced operations on your hard disk drive, such as restoration of boot records and hexadecimal editing

Best of lucks



Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Author Comment

ID: 16256398
Hi all,

thanks for the quick reply. I followed imacgouf's link and found a "File Scavenger", which seems to perform fairly well. I could find almost all files deleted from today back to the year 2001, EXCEPT the files that I realy want to find!??
Perhaps I didnot really delete them?? But I cannot find them anymore on my harddisk. I guess if I did a "Cut & Paste", the original files should be deleted and thus should also be found by the recovery software.

I checked the recycle bin, my files are not there.


Author Comment

ID: 16256484
or perhaps a virus is so intelligent that it immediately rewrites the files after it deleted them?
LVL 88

Expert Comment

ID: 16256630
Use the "search" utility of windows to look for the files, as you might not have deleted them but rather moved them to some other place.

Author Comment

ID: 16256739
I've searched the whole computer with different possible keywords that are contained in the name or content of the files, but could not find the files.
LVL 88

Accepted Solution

rindi earned 1400 total points
ID: 16256801
maybe you also renamed the files? or you moved the files to an external media like a USB HD or a writable CD?

Author Comment

ID: 16257057
they are thousands of files which I cannot change their names or contents individually. I did not use any USB HD and there is no writable CD in  the drive.

My system works now quite unstable, during the time that I ask this question my computer crashed twice. I must completely shut the computer down and then restart to run it normally.

Could a virus or a hacker be the reason for the data lost?

Author Comment

ID: 16257082
But I then wonder how did they do it so that the files can neither be found nor be recovered.

I recently have problem with the goold desktop which always gives error message like "google desktop cannot ?? successfully" or sth like that. Could this be the reson?
LVL 88

Expert Comment

ID: 16257155
Files get written over when they are deleted and you don't immediately stop using the system. This overwriting can be random so some files will still be recoverable and others won't. Usually if there is a large contiguous space in the deleted area that would be used first when allocating diskspace to new files, so it is more likely that small files that were in fragmented areas on the disk can be recovered than large ones which weren't in the fragmented area.

Download the latest version of HijackThis


run it and save the log. Paste the log to the following website


Follow the following exactly:

At the bottom of the page you'll see a "ANALYZE" button. Click it and you will have an analysis of your log. Now a new button, "SAVE ANALYSIS" will show up at the bottom. Your analyzed log will be saved to a page on that homepage, of which you can post the URL here. I should then be able to see if there is any software causing problems.
LVL 17

Expert Comment

by:Dushan De Silva
ID: 16272837

Expert Comment

ID: 16283307
REcover MyFiles software is the best to recover the deleted files even after re-formatting the drive or deleting the partition try this out


This is a trial software when you run this program it will show you all the deleted files and which can be recovered, in order to recover them you have to buy the license which will cost you 70$

I am not sure whether any freeware is available to retrieve the lost data. When you are running this software search for only those files you want to retrieve as u said textfiles, word docs etc. This is will make the search fast
LVL 88

Expert Comment

ID: 16284615
Use hijackthis to remove the following:

R3 - URLSearchHook: (no name) - _{2C5AA40E-8814-4EB6-876E-7EFB8B3F9662} - (no file)
O2 - BHO: (no name) - {68AE6707-B217-7FC6-8207-6D557CAF2869} - C:\WINDOWS\System32\weyoih.dll (file missing)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\RunServices: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKCU\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted IP range: (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c267.cab

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows how to use a free utility called 'Parkdale' to easily test the performance and benchmark any Hard Drive(s) installed in your computer. We also look at RAM Disks and their speed comparisons.
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Suggested Courses

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question