Recover deleted data

The recycler bin is useful but you will be surprised it is quite often user tends to clear the recycle bin only to realize some data was mistakenly deleted or on the other hand deleted data from pen drives or removable drive, these external drives tend not to have a recycle bin.

If such an incident happens the first thing to do is to stop using that particular drive, due to the fact that once a user deleted a file the operating system dose not literally deleted it but marks that space as available space in other words an empty space, you can relate this to the old magnetic tape drives where you can record a song over another song, hence further usage might cause that space to be overwritten, immediately stop using that particular drive.

Method for external drives

Observe not to use your external drive, in order to recover your data immediately use PC Inspector download it on your internal drive, run it and follow the procedure below.

alkathirikhalid

Fig 1: Language setup

Select your language and press ok as marked with the circle above presented by the green tick.

alkathirikhalid

Fig 2: Selecting a recovery type

Click the tab mark with the circle above to recover deleted files.

alkathirikhalid

Fig 3: Selecting a drive where the file last resided

Select the external hard drive as the above case drive I: 3.81 GB hence it is a 4 GB pen drive click ok presented by the green tick.

alkathirikhalid

Fig 4: Deleted files detected

As seen above I have two deleted files in my pen drive and the colour green means they are still in good condition and can be recovered 100 % while my pen drive appears empty purposely cleared for demonstration in the case where you have previously deleted more files you would need to wait till the program populates the list.

alkathirikhalid

Fig 5: Selecting destination to save the recovered file

Select the file or files and press the save tab on the left side presented as a floppy disk, select the preferred location and press ok presented by the green tick.

alkathirikhalid

Fig 6: Recovery process completed

As seen above the file has been successfully recovered.

Method for internal drives

To deal with internal drives it’s a bit tricky hence the best advice is to stop working on it and in no circumstance should you switch it off as this will force your operating system to auto save programs before shut down and might over write the empty mark spaces that the data to be recovered resides, the recovery procedure is almost similar but the hard disk handling is totally different.

When data or new data is saved it is scattered in pieces of bits all over the hard drive in other words the said files are fragmented hence the operating system will give the available marked empty space as required, the process is similar in most storage devices. You should consider the fact that if the drive is an external one then the chances of getting back the file are higher than an internal drive, this is highly risky if the data deleted is from an internal disk of which the operating system is installed on that particular partition i.e C:

The difference is that when the drive of interest has an operating system running on it, it will constantly have reading and writing activities in the background, this is because the presence of the page file folder, temp file folder, prefetch folder and auto save programs constantly changes hard drive contents.

If the file of interest is of low importance you can use the same recovery procedure as the “Method for external drives” the down side of this process is that the file might not be 100% healthy in terms of being usable/readable as the fragmented data chance of it being over written are higher and might recover an estimated figure of less than 100%.

The things I would advice is to only approach the below procedure as a professional, I do not take responsibilities nor will I be held liable to anyone’s losses.

  1. Force shut down your pc immediately to stop further data reading and writing, our aim is to stop any further writing/overwriting on the drive
  2. Remove your hard disk in the case of a desktop and connect it as a slave drive in order to run the program from another PC on a different hard drive, or in the case of a laptop remove your hard drive and mount it in an external drive casing, connect it via USB to another pc
  3. once the drive of interest is handled as an external drive, only then it is possible to ensure only reading access which would read and extract the lost data with out damaging it’s health

Before opening up any laptop or desktop make sure to discharge your body from any static electricity by simply touching a metal surface or the metal casing of your desktop/tower cover.

alkathirikhalid

Fig 7: Opening the laptop case to remove hard drive

Find the hard drive location, open up the cover and remove the metal casing that holds and protects the hard drive.

alkathirikhalid

Fig 8: SATA (left) and ATA (right) pin/connectors comparison

Distinguish the difference between SATA and ATA drives of which both of them have different mounting pins, this will enable you to know which type of casing will suit your hard drive, remember there are more others in the market and all with different properties but the most common is SATA.

alkathirikhalid

Fig 9: Inserting hard drive to external board

Align the pins and just slide it in gently, due to the lack of SATA casing, I am demonstrating it with an ATA casing.

alkathirikhalid

Fig 10: Close the casing

Secure the hard drive on the hard drive board and gently place it back in the casing to be used as an external hard drive and recover the necessary data as required by following the same steps above.

In many tutorials and DIY, inform users to stop using their machines while excluding the fact that there are authorized background process that will constantly have reading and writing activities in the background, and might affect the recovered data health, the most approachable way is to force shut down your pc and take matters from there.

Thank You.

www.alkathirikhalid.com

About alkathirikhalid

"Knowledge without experience is just information."
This entry was posted in Security. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s