How to recover deleted folder by code?

Hi Experts,
I just had tested a code which deleted an entire folder of mine!!
(C:\Application)
and created two files under that folder
Any way to recover?
LVL 5
bfuchsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

AlanConsultantCommented:
Hi Ben,

I take it that the folder is not in the recycle bin?

Assuming not, then do you have 'Previous Versions' available on that drive?  Right-click the parent folder (C:\) and select properties, then 'Previous Versions' tab.  If you have that turned on, you can restore from one of those.

Alan.
0
AlanConsultantCommented:
Hi Ben,

If neither of the above are possible, then you are into more serious recovery options such as Easus File Recovery (there are a lot of other similar options out there - I just happen to have used this one, but I cannot say it is better than something I have not tried):

https://www.easeus.com/data-recovery-software/

Do you have a 'proper' computer - in other words, one that you can remove the HDD from?

If so, I would probably shutdown, and remove the HDD, then image that drive from OUTSIDE of the OS installed thereon, before doing anything else - that way you have a backstop worst case image you can return to.

If you aren't familar with imaging, now is a good time to start :-)

Easus also have backup / imaging software:

https://www.easeus.com/backup-software/

However, I personally prefer to use Linux and dd the drive as I find it to be rock solid, and has been for twenty years or more.

Alan.
0
bfuchsAuthor Commented:
Hi,
Do you mean the attached?

Is it safe? Dont I risk to lose a chance to recover (In case I happen to run the code more then once, so this will not be the previous version..?)

Thanks,
Ben
Untitled.png
0
What were the top attacks of Q1 2018?

The Threat Lab team analyzes data from WatchGuard’s Firebox Feed, internal and partner threat intelligence, and a research honeynet, to provide insightful analysis about the top threats on the Internet. Check out our Q1 2018 report for smart, practical security advice today!

AlanConsultantCommented:
If you click on properties, then 'previous versions', you should see all the dates / times you can choose from.
0
bfuchsAuthor Commented:
There are no previous versions..

So next step is what? Try that software you posted?

Thanks,
Ben
0
AlanConsultantCommented:
Hi Ben,

I think so.  As I mentioned above, I would recommend you image the HDD first.  That way, whatever you try in terms of recovery, if it does not work and does more harm than good (very possible), you can always return to exactly where you are when the computer was shutdown.

Are you familar with Linux and dd?  If so, use that, either by pulling the HDD or by booting a live distro on your machine (I usually go for Ubuntu 16.04.3 LTS as it works on almost any hardware) and dd the entire internal drive to an external drive.  It will take a while - count on hours.

Alan.
0
bfuchsAuthor Commented:
Hi

That way, whatever you try in terms of recovery, if it does not work and does more harm than good (very possible)
This is what I'm concerned at the moment..
Are you familar with Linux and dd?
Not at all..
So I guess the safest would be I should call an IT guy and stop using for the time being..?
Any other suggestions?

BTW, I downloaded that software mentioned, and its middle of the scanning process (hope that's OK).

Thanks,
Ben
0
AlanConsultantCommented:
Hi Ben,

If you mean the Easus file recovery software, then if it were me, I would not use the machine at all, I would shut it down, and image it before doing anything else.

The reason is that, when that folder was deleted, the OS marked the disk area where it was (maybe still is) as 'free' and available for use.  Anything that is running will likely create temporary files, and those temporary files might get put into the space where the folder was, obliterating it and making it impossible to ever recover.


Alan.
0
bfuchsAuthor Commented:
Hi,

Too late, by now the scanning is over..
(So far dont see my lost folder listed there..)
So you recommend I shut down?
Any damage by leaving it open? (will only use for checking up emails)

FYI- This was the culprit, and seems my concerns there were right..
https://www.experts-exchange.com/questions/29065599/Looking-for-ways-how-to-get-some-tasks-automated-w-o-users-intervention.html#a42350479

Thanks,
Ben
0
AlanConsultantCommented:
Hi,

I would still shut down and make an image (I would be of the mindset - why not?)

Every second Windows is running, it is doing stuff in the background, and any of that stuff might over-write that folder even if it is still recoverable (which seems from what you say above).

If you can make an image before the deleted folder is damaged, you could still recover it separately from the image (via a VM for example) then copy back to your machine later, but only if it has not been damaged.

If the machine has still been running these last few hours, then the chances are diminishing fast.  You would ideally have needed to shutdown immediately after checking the recycle bin and 'previous versions',


Alan.
0
Gustav BrockCIOCommented:
I've had some success with this from the Crap Cleaner people:

Recuva® Recover your deleted files quickly and easily

I can add, that in the article I wrote about zip/unzip:

Zip and unzip files and folders with VBA the Windows Explorer way

I have included a red warning when I noticed how dangerous a trivial error could be.

/gustav
0
bfuchsAuthor Commented:
Hi Experts,

At the moment I still dont have a way to recover.
Tried both software suggested and nothing shows up.

@Alan,
Our IT guy tried recovering from the results of Easus
See attached what I get..

Thanks,
Ben
Untitled.png
0
AlanConsultantCommented:
Bi Ben,

My guess is that it has been over-written.

Probably best to restore from backup (hoping you have one).


Alan.
0
bfuchsAuthor Commented:
Hi Alan,

Is there any way to get at least a list of files that were there (just the file names)?
Should I refrain from adding new stuff to that folder while its not recovered, or it has nothing to do?
Any other suggestion before giving up on full recovery?

Thanks,
Ben
0
AlanConsultantCommented:
Hi Ben,

No way to know to be honest.

From what was said above, the machine was left running for some time after the event, so my best guess is that the space will have been over-written.

The screen shot you posted showed 7,000+ files / folder identified, so you might be able to get filenames from there somewhere?

If you do re-create it, I suggest putting it on a server which has 'Previous Versions' active and is subject to automatic backups at least once a day.  If you want it to appear on your local drive (for testing etc), then create a symbolic link to the server folder - Access should not be able to tell the difference.


Alan.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
bfuchsAuthor Commented:
Thank you very much Alan!
Hope to get back soon on the other post..
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
IT Administration

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.