So I get the phone call from a friend or relative or client:

"Looks like I accidentally deleted 4 years worth of accounting data. Oh, and I don't have any backups. Can you help?"

What I need is a good Windows tool (for NTFS I think) that scans blocks marked as deleted and attempts to recover the file. And I need one that can be run from a thumb drive or since installing new software has a decent chance of overwriting the data before it can be recovered. Googling for such tools turns up mostly carefully-crafted advertisements for moderately expensive products with a "Free! Demo! Version!" which is not exactly reassuring.

Any recommendations for a good tool?

link|improve this question
Remember that you need to recover any deleted files to a different drive as well. Running the app off a different drive alone is not enough as recovering files back to the original drive will over write unused blocks. – 3dinfluence Aug 6 '09 at 15:30
3  
Not only that, ideally you should not even boot from the affected drive, as even just booting may write things like temporary files. Best to boot from a rescue CD / thumb drive, such as WinPE. – sleske Aug 6 '09 at 16:20
feedback

migrated from serverfault.com Apr 8 '10 at 12:07

This question came from our site for system administrators and desktop support professionals.

20 Answers

I don't know if it is the best one, but I've successfully used NTFS undelete. It's free and open source. It provides an ISO image with the program as well, which allows you to runit directly from a CD-ROM.

NTFS Undelete is free and open source software that allows you to recover deleted files. It recovers files directly from hard drive, and it will work even if you empty Recycle Bin.

One thing you should always be aware of, independently which tool you plan to use: it's very important to make sure that no application writes to the drive or partition where the deleted files were saved.

Edit: Other tools mentioned here:

Recuva (freeware)

Recuva (pronounced "recover") is a freeware Windows utility to restore files that have been accidentally deleted from your computer. This includes files emptied from the Recycle bin as well as images and other files that have been deleted by user error from digital camera memory cards or MP3 players. It will even bring back files that have been deleted by bugs, crashes and viruses!

TestDisk (open-sourcr, free, NTFS and FAT)

TestDisk is a powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). Partition table recovery using TestDisk is really easy.

link|improve this answer
9  
+1 for the "make sure that no application writes" comment. That is very important whatever tool you pick. If it's on your main system drive, turn the PC off now (without doing a proper shutdown, just pull the power out) and use another PC to do the recovery. – Simon P Stevens Jul 17 '09 at 8:27
1  
Edit it with the other mentioned options and I'll accept this – Vinko Vrsalovic Jul 17 '09 at 15:05
Sorry for the delay, I finally got back to review my questions here. – Vinko Vrsalovic Jan 4 '10 at 22:04
1  
TestDisk is awesome, used it to recover files from a variety of filesystems – STW Feb 26 '10 at 4:07
7  
NTFS Undelete is no longer free. The "buy now" pop-up now comes up when you press the "recover" button - no idea what happened – Pekka Jan 19 '11 at 15:15
show 3 more comments
feedback

I recommend Recuva, by Piriform - a company that puts out free software I trust. I haven't used Recuva, but I'm happy with Defraggler.

enter image description here

Note: You can run it from a flash drive. It sounds like you'll need another computer to do the initial installation that you'll then copy over to the thumb drive though.

Details here:

http://docs.piriform.com/recuva/advanced-usage/running-recuva-from-a-usb-drive

link|improve this answer
1  
Of note: product is free. There is no mention on the site about running off a separate device or partition. (I would think every such recovery tool should have text about that next to their download button to protect those who don't know better.) – Michael Chermside Aug 6 '09 at 14:58
1  
+1 for Recuva works great if you have a file system that the system recognizes. Great for undelete type problems. But it doesn't work on raw devices if you don't have a recognized file system. – 3dinfluence Aug 6 '09 at 15:00
Recuva will color code the files, from "yes I can recover that" in green to "not a chance" in red. Makes it easy to do a quick once over of the files you want w/o spending the time to recover them only to fail mid-way. – RateControl Aug 6 '09 at 16:07
Recuva worked brilliantly. A green result did not work, but the a 2nd red result worked for a deleted office doc. This is why I love stack exchange, we could have easily spent hours searching thru non-results in google. – Sydwell 2 days ago
feedback

I haven't used it myself as I deal mostly in Unix and Linux, but Lifehacker recommended an app called Undelete Plus a while back.

It looks like it handles FAT12/16/32 and NTFS/NTFS5 file formats.

enter image description here

link|improve this answer
Of note: reviews on cnet's site were mixed. Again, no special notes about running from a CD or USB (but no reason to think it won't). – Michael Chermside Aug 6 '09 at 15:00
feedback

I've used R-Studio for that matter. You can install it on any partition (different from one you want to recover).

enter image description here

link|improve this answer
Of note: tool appears to cost $50 for FAT or for NTFS, $80 for both. The bit that lets it run from a separate CD or USB drive has some comments about activation keys and hardware codes. – Michael Chermside Aug 6 '09 at 14:56
I use R-Studio predominantly. It will install to Win, Mac or Linux. It will recover all file types from all partition format types. It is not terribly quick, BUT it does a great job of rebuilding partial files from multiple re-writes and multiple formats. I am able to recover effectively up to roughly 3 formats back, depending on size of dive. Note: if you have a 2 terabyte drive ensure you have loads of memory to recover. – IanN Mar 1 '11 at 18:14
feedback

Depending on the type of file deleted, PhotoRec is very good.

enter image description here

link|improve this answer
Great-looking tool. Unfortunately, in my PARTICULAR case, it's accounting data and it looks like this tool won't handle that. But let's leave the answer here for the next person who MAY have lost video or image data. – Michael Chermside Aug 6 '09 at 14:46
It does more than video and image data. The list of files it can recover includes MS Money, Quicken and QuickBooks. – MattB Aug 6 '09 at 15:08
feedback

I've always used TestDisk. It does undelete on Fat, NTFS and ext systems. It's a lot more powerful than basic undelete, it does all kinds of different kinds of data recovery for recovering lost and damaged partitions etc.

Free & Open source.

link|improve this answer
feedback

PC Inspector File Recovery -- Free

I've used this in the past and its worked great. Keep in mind that you'll want to RECOVER your files to an external drive or USB key.

enter image description here

link|improve this answer
feedback

You can try NTFS Undelete. It is free and open source. It recovers files directly from hard drive, and it will work even if you empty Recycle Bin.

There is also Magic Rescue. It is not an undelete in the traditional sense but very helpful if you have to recover files.

If you need to recover a specific type of file, there are tools that do a better job than the generic ones. To recover JPEGs I had good success with recoverjpeg (which runs on linux but can recover from every image).

link|improve this answer
feedback

Pandora Recovery has proven useful to me in the past.

enter image description here

link|improve this answer
Of note: This looks to be $20 and comes pre-installed on a USB drive so it should be very easy to apply in this sort of situation. – Michael Chermside Aug 6 '09 at 17:31
feedback

If it's Vista or Windows 7 they should try "Restore Previous Versions" by right-clicking the containing folder.

link|improve this answer
Because Previous Versions relies on the same technology that System Restore uses (VSS), Previous Versions are available in all editions of Vista/7, it's just that Microsoft doesn't always provide a nice UI for browsing them. For those systems, the freeware ShadowExplorer can fill in the missing piece of the puzzle. This, of course, supposes that the user hasn't disabled System Restore altogether. – afrazier Mar 9 '11 at 19:03
feedback

For such tasks I'm using Back2Life, a plugin for TotalCommander.

enter image description here

link|improve this answer
Of note: Both TotalCommander and the plugin cost ($53 total) HOWEVER they can be used FIRST, and paid for later (very helpful). It comes with instructions for installing so it can run from a USB drive. – Michael Chermside Aug 6 '09 at 17:35
feedback

I've used Runtime Software's GetDataBack (NTFS and FAT) for years and it's helped a bunch of times.

enter image description here

Not free, but it will go all the way through, until you need to actually copy the recovered files someplace, before they make you pay. Which is good because at least you can see if it's going to help before shelling out the money (it's not that expensive, ~$80).

link|improve this answer
feedback

Active File Recovery has saved me before...

Not free, but also not that expensive...

link|improve this answer
feedback

Glary Undelete has served me well in the past.

enter image description here

link|improve this answer
feedback

DiskDigger is a data recovery program that is small, portable, easy to use and above all free, unlike 99% of these kinds of applications out there, try it.

link|improve this answer
feedback

I'm using this excellent standalone freeware Restoration -- you can carry this nifty little app in your thumbdrive with you anywhere, and recover accidentally deleted files instantly! Works with Windows XP.

SideNote:

When you delete files, your system doesn't actually removes them from the harddisk memory. Think of your files as if there's an 'on' and 'off' switch on all of them.

Deleting normally via 'Empty recycle bin' merely puts those files into an 'off' status, where they stay in the harddisk's memory until its position on the harddisk is being rewritten by your system (eg. when a new file is copied onto your harddisk).

In this case, when you use restoration immediately after an accidental delete, there's no worry that your files' position have been rewritten, thus you still have a chance of getting those files back.

link|improve this answer
feedback

This guide will save your life. It contains information on how to recover data with the use of a few tools. It's all open source and on Ubuntu. I prefer Foremost.

Foremost, originally developed by the US Air Force Office of Special Investigations, recovers files based on their headers and other internal structures. Foremost operates on hard drives or drive image files generated by various tools.

It was able to recover around 90% of my data, and it has successfully recovered data on many of my client's computers.

PhotoRec is great also. It can recover almost everything. Plus the GUI is helpful.

In Ubuntu, just run

sudo apt-get install testdisk foremost

and you'll have a killer recovery setup.

link|improve this answer
feedback

Recovering deleted files is an all-too-common task that everyone runs into now and then.

Tl;dr, skip to last section.


The problem is that if your disk is low on free space, then files get fragmented which means that while plain-text files can still be relatively easily recovered (though it still requires quit a bit of work), binary files become all but impossible to recover. Granted, hard-drives are getting larger, which means less fragmentation, but only to a point. Drives are not written further and further out on the platter, then cycled back to the start, but rather, freed space from deleted files starts getting overwritten right away (“right away” meaning anything from the next boot, to the next write). Worse, the larger a hard-drive is, the longer it takes to scan it.


I recently accidentally deleted ~9,000 photos from a drive (stupid FOR command didn’t work as expected), and had to try to recover ~1GB of binary files. I tried over a dozen different recovery apps and got mixed results, and learned a few things. Different recovery apps have different functions and features. (Unfortunately I can’t currently list exactly which programs I tried and the results I got from them because they’re all on my other—SATA—drive which I cannot access because my motherboard died, and my current, backup system is only IDE.)

Some apps scan the file-system to find files that are marked as deleted and try to recover those. Some of these apps recover files regardless of if they have been overwritten, while others only recover those that are still “good” and ignore the others. The problem is that even if a file’s entire (and supposed) cluster chain is still marked as free (ie, has not been overwritten), how do you know if the file was previously contiguous?

Some apps use a different approach and scan all clusters on the disk to find file-types that they recognize (usually directories, photos, office files, and a few others), then recover whatever they can. The problem with these is that few file types indicate in the header exactly how large the file is, so how is the program supposed to know how many clusters to recover? Also, these apps can end up “recovering” files that were deleted long ago and have long since been overwritten, but the directory (marked as deleted) still exists in the directory.

Another thing to look out for is the way and detail with which the files are recovered. Some apps recover the filenames while others just give them sequential, numeric names. Some dump everything in a big folder, while others reconstruct the folder-system.

A quick look at the files shows the problems I mentioned. Some are completely corrupt and/or incorrect (they are not graphic files at all, but rather contain whatever happened to be at that cluster). Some are files that were deleted long ago and obviously contain nothing of interest. Some of the files are only partly good (eg half of the photo is visible, then corruption). Some files are absurd sizes (for example a small GIF file that should only be ~1-2KB is taking up >1GB because the app didn’t know how big the file should be). And so on.


Several of the programs that I tried have been mentioned in the other answers, but there’s at least two that have not been mentioned that I recall that I was impressed with.

I tried out Smart Undelete which I liked because it was capable of reconstructing as much information as possible (filenames, folder hierarchy, etc.) and even had a built-in photo-preview which made things easier. Unfortunately it’s a commercial app that costs $30 if you want to do more than just test. (Most trial software does a real scan and lets you see the results, but then prevents you from actually recovering many, if any files.)

Another one is Undelete360. It’s a program written by a single person and it’s free. While the skinned app smacks of cheaper, flashy, wanna-be software, I was impressed that it did about as good a job as the best of the commercial apps. Aside from some of the other programs that have been mentioned on this page, I would suggest trying this one. It even has a portable version which is good/ideal (why a recovery app would want to be installed as opposed to simply being run is beyond me; anyone novice enough to be unable to run an EXE and need a Start-menu shortcut is too green to do data-recovery and avoid messing things up further).

Make sure to sequester the volume/partition/drive/etc. that has the deleted files as much as possible (ie, don’t write anything to it anymore). Make sure to install and run the recovery software from another location, and don’t forget to set the recovery folder to somewhere other than the original volume. This way, you can safely run multiple recovery apps and see which one gives you the best results, and more importantly, get better results between them than using just one.

link|improve this answer
feedback

File Recovery worked for me once, but the results of trying to get files back can vary a lot! Depending on the way you deleted the files.

It worked great when I formatted the wrong hard drive during the Windows installation, but I didn't do anything with the drive after I made the mistake. So I was sure everything could be recovered. If you really have to restore something important, I'd almost say: plug the drive in another computer and use that system to scan the drive.

If you shift+delete in a Windows system, but are also doing other things at the same time I'm not so sure any of these programs can succesfully recover them. Plus note: it can take quite some time to scan your entire hard disk if it's very large! For a 500 Gb drive you can expect to let the computer run overnight...

link|improve this answer
feedback

EaseUS Data Recovery worked perfectly bringing back every file perfectly, restoring the partitions, everything. Just as it was. The only snag--well two snags, was that the program cost $70 at the time and and it took about 15 hours to do the recovery. I just looked at the website and they are having a sale giving 30% off, roughly $50 bucks for the product.

It finds and lists the deleted files, partitions, and directories fairly quickly. You check what you want, it does the rest.

enter image description here

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.