How to recover deleted folder by code?

bfuchs
bfuchs used Ask the Experts™
on
Hi Experts,
I just had tested a code which deleted an entire folder of mine!!
(C:\Application)
and created two files under that folder
Any way to recover?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
AlanConsultant

Commented:
Hi Ben,

I take it that the folder is not in the recycle bin?

Assuming not, then do you have 'Previous Versions' available on that drive?  Right-click the parent folder (C:\) and select properties, then 'Previous Versions' tab.  If you have that turned on, you can restore from one of those.

Alan.
AlanConsultant

Commented:
Hi Ben,

If neither of the above are possible, then you are into more serious recovery options such as Easus File Recovery (there are a lot of other similar options out there - I just happen to have used this one, but I cannot say it is better than something I have not tried):

https://www.easeus.com/data-recovery-software/

Do you have a 'proper' computer - in other words, one that you can remove the HDD from?

If so, I would probably shutdown, and remove the HDD, then image that drive from OUTSIDE of the OS installed thereon, before doing anything else - that way you have a backstop worst case image you can return to.

If you aren't familar with imaging, now is a good time to start :-)

Easus also have backup / imaging software:

https://www.easeus.com/backup-software/

However, I personally prefer to use Linux and dd the drive as I find it to be rock solid, and has been for twenty years or more.

Alan.
Hi,
Do you mean the attached?

Is it safe? Dont I risk to lose a chance to recover (In case I happen to run the code more then once, so this will not be the previous version..?)

Thanks,
Ben
Untitled.png
Amazon Web Services

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

AlanConsultant

Commented:
If you click on properties, then 'previous versions', you should see all the dates / times you can choose from.
There are no previous versions..

So next step is what? Try that software you posted?

Thanks,
Ben
AlanConsultant

Commented:
Hi Ben,

I think so.  As I mentioned above, I would recommend you image the HDD first.  That way, whatever you try in terms of recovery, if it does not work and does more harm than good (very possible), you can always return to exactly where you are when the computer was shutdown.

Are you familar with Linux and dd?  If so, use that, either by pulling the HDD or by booting a live distro on your machine (I usually go for Ubuntu 16.04.3 LTS as it works on almost any hardware) and dd the entire internal drive to an external drive.  It will take a while - count on hours.

Alan.
Hi

That way, whatever you try in terms of recovery, if it does not work and does more harm than good (very possible)
This is what I'm concerned at the moment..
Are you familar with Linux and dd?
Not at all..
So I guess the safest would be I should call an IT guy and stop using for the time being..?
Any other suggestions?

BTW, I downloaded that software mentioned, and its middle of the scanning process (hope that's OK).

Thanks,
Ben
AlanConsultant

Commented:
Hi Ben,

If you mean the Easus file recovery software, then if it were me, I would not use the machine at all, I would shut it down, and image it before doing anything else.

The reason is that, when that folder was deleted, the OS marked the disk area where it was (maybe still is) as 'free' and available for use.  Anything that is running will likely create temporary files, and those temporary files might get put into the space where the folder was, obliterating it and making it impossible to ever recover.


Alan.
Hi,

Too late, by now the scanning is over..
(So far dont see my lost folder listed there..)
So you recommend I shut down?
Any damage by leaving it open? (will only use for checking up emails)

FYI- This was the culprit, and seems my concerns there were right..
https://www.experts-exchange.com/questions/29065599/Looking-for-ways-how-to-get-some-tasks-automated-w-o-users-intervention.html#a42350479

Thanks,
Ben
AlanConsultant

Commented:
Hi,

I would still shut down and make an image (I would be of the mindset - why not?)

Every second Windows is running, it is doing stuff in the background, and any of that stuff might over-write that folder even if it is still recoverable (which seems from what you say above).

If you can make an image before the deleted folder is damaged, you could still recover it separately from the image (via a VM for example) then copy back to your machine later, but only if it has not been damaged.

If the machine has still been running these last few hours, then the chances are diminishing fast.  You would ideally have needed to shutdown immediately after checking the recycle bin and 'previous versions',


Alan.
Most Valuable Expert 2015
Distinguished Expert 2018

Commented:
I've had some success with this from the Crap Cleaner people:

Recuva® Recover your deleted files quickly and easily

I can add, that in the article I wrote about zip/unzip:

Zip and unzip files and folders with VBA the Windows Explorer way

I have included a red warning when I noticed how dangerous a trivial error could be.

/gustav
Hi Experts,

At the moment I still dont have a way to recover.
Tried both software suggested and nothing shows up.

@Alan,
Our IT guy tried recovering from the results of Easus
See attached what I get..

Thanks,
Ben
Untitled.png
AlanConsultant

Commented:
Bi Ben,

My guess is that it has been over-written.

Probably best to restore from backup (hoping you have one).


Alan.
Hi Alan,

Is there any way to get at least a list of files that were there (just the file names)?
Should I refrain from adding new stuff to that folder while its not recovered, or it has nothing to do?
Any other suggestion before giving up on full recovery?

Thanks,
Ben
Consultant
Commented:
Hi Ben,

No way to know to be honest.

From what was said above, the machine was left running for some time after the event, so my best guess is that the space will have been over-written.

The screen shot you posted showed 7,000+ files / folder identified, so you might be able to get filenames from there somewhere?

If you do re-create it, I suggest putting it on a server which has 'Previous Versions' active and is subject to automatic backups at least once a day.  If you want it to appear on your local drive (for testing etc), then create a symbolic link to the server folder - Access should not be able to tell the difference.


Alan.
Thank you very much Alan!
Hope to get back soon on the other post..

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial