PDA

View Full Version : Recovery of deleted TrashCan Files



TomH
03-01-2007, 04:03 PM
Everyone,

I am currently evaluating the FileRecover program and have one main observation. Files deleted from within an application (ie deleting IE 7.0 history files) seem to be recoverable but files that are deleted from the desktop trashcan do not.

1. I create a microsoft word,excel, or publisher files,
2. Save it to the disk,
3. Exit out of the ms applications.
4. Use file manager to browse the directory where the file was created.
5. Delete the file to the trashcan.
6. Select empty trashcan.
7. Startup FileRecover.
8. Select DeepScan.
9. The file deleted in step 6 is not found

I am running all the defaults.

I am running XP Pro with service pack 2 and all the latest updates. This is a computer running in a workgroup not a domain so I don't feel any group policies should be effecting me. The application was installed as a logged in adminitrator on the machine and the files in question are created and deleted from the same logged in account.

What am I doing wrong?

Tom

Support
03-01-2007, 04:55 PM
TomH,

In regards to your query, this is just to let you know that your query has been escalated to our Technical Support Representatives who will be able to assist you further regarding File Recover.

Kind Regards,

PC Tools Support

AChen
03-05-2007, 04:58 AM
Hi TomH,

Recently created and deleted files are harder to recover than older files. This is because of how Windows is designed.

The Windows OS keeps an index of all files (both current and deleted files) in a Master File Table (MFT). When a new file is created and deleted, it is inserted into and freed from the 'beginning' of the MFT. Windows will then reuse space from the MFT when it needs space for a new file, and always looks for "freed" space at the beginning of the MFT.

Windows will read and write from your disk all day long, for various background system activities. So when you delete a file, it is highly likely that the beginning index entry in the MFT is reused within minutes of deleting file - and therefore unavailable to recover.

File Recover will list all deleted files that are recoverable. It uses a special algorithm to skip certain non-recoverable files.

A deleted file that is corrupted or partially re-used by the Windows operating system will not be readable. This is not a factor of File Recover software, but a factor of how the Windows operating systems will recycle part (or the entire) of deleted files.

File Recover does recover deleted files that remain intact on your hard disk. A percentage of 'larger' recovered files will have missing header information, or be otherwise cross-linked or corrupted. There is no workaround for this issue.