lost file!!!!!

Have a colleague in work who shift+del a massivlely important file, he has used 3 or 4 differenet 3rd party software to recover this file but to no avail

Any ideas??

Lee H

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

wastedtime

It is probably to late now if you delete a file, then start installing programs and for the most part keep the computer writing to the hard drive the file will be lost. In a case like that I would do a hard shutdown immediately then get something like knoppix STD and boot to that. If you are able to make a copy of the HD then try to use some of the file retrieval utilities it has (don't remember off hand what they are). Also you may try installing that HD on another computer and us some of the 3rd party software on the hard drive from there. Hope that helps.

2BEDB411

As unbelievable as it sounds, I just witnessed something about a week ago. A client accidently deleted a custom mailfolder. She was using Outlook on our LaN,, but for some reason her configuration was to save locally. So recover from server backup wasn't an option.

The local folder was nowhere to be found. I'm familiar with the extensions.

I again asked the burning question "why do people use a mail utility as the primary, (and only ) means to save 500 customers" contact information ? "

A suggestion, that I ignored, was to do an XP "rollback". I stated " thats' a registry rollback, not a file recovery service, unless of course you're missing a system file"

Well a peer of mine gave it a whirl, and the data returned. Unbelievable!
One for the books, there.

Kaminsky

I thought XP rollback was for any file, not just system files. Must have been a file that was there before the snapshot was saved. If it had been a newer file, it wouldn't have worked.

File delete (on the physical disk itself) is done in the system by just removing the pointer to the file in the index structure. The file itself isn't actually removed, the space is just tagged as available for use by other files so it is in a precarious state. Once any new install or file save uses those memory blocks, it's all over. It depends on where that file is actually sitting on the disk and how close to the "Next to be used" area it is. Defrags will typically only move files with links to the directory structure so it is possible to even go through a defrag and still recover the file theoretically as it is all down to luck as to where it is actually sitting on the disk itself.

Expensive file recovery software (and I mean expensive!) can get parts of files back once some of the file has been saved over (as used in Police Forensics). You could probably find something on the net that will put that link back in the directory structure if the rest of the file space hasn't been written over yet. However, you do run the risk of overwriting your file with the software you are putting on to recover it.

2BEDB411

Kaminsky wrote:

I thought XP rollback was for any file, not just system files. Must have been a file that was there before the snapshot was saved. If it had been a newer file, it wouldn't have worked.

File delete (on the physical disk itself) is done in the system by just removing the pointer to the file in the index structure. The file itself isn't actually removed, the space is just tagged as available for use by other files so it is in a precarious state. Once any new install or file save uses those memory blocks, it's all over..

Yep. Thats' also why doing a file or directory "move" happens instantly. Nothing moves. The index pointer just changes. Now, if you do a copy, the file has to be re-written in another area. And you get the cheezy Windows "folder to folder" animated gif to amuse you.

The principal you explain above is critical to understanding permissions and inheritance as well. If the file is re-written, it needs permissions and gets them from the parent. If the pointer simply re-directs, the file is not recreated, thats' why the origional permissions retain. So understanding what you have stated above is important when I train people on permissions.

The exception is when a file or Dir is moved or copied from one disk to another, It is always rewritten, (permissions from root/ parent) because each partition has its own MFT .