Data loss: we've all experienced it. Maybe you emptied the Recycle Bin milliseconds before realising that you'd deleted the wrong folder the day before; or perhaps your hard disk simply packed up, leaving behind it nothing more than an odd clicking sound and a system error screen.
It might have been that the dog really did eat your homework by mistaking your newly burnt DVD for its latest toy. Whatever happened in your case, it resulted in your precious data ascending to that great filesystem in the sky.
Fortunately, dead disks, trigger-happy fingers and scratched CDs don't always mean that you have to wave goodbye to your data. While not every problem has a happy ending, there are many that do. So when disaster strikes, don't reach for the proverbial pistol: read our guide to recovering data instead.
Lost files
Disaster rating: 1/5
Losing a file is a disconcerting experience. If you're looking for a document but can't find it anywhere, stay calm. Stop any programs that are writing huge amounts of data to your hard disk and exit as many applications as possible.
Deleted files aren't really deleted: they're merely marked as disk space ripe for reuse. This means that you want to stop anything that's writing to disk in case it overwrites the lost data. When everything has been stopped, have another search for your lost file using Windows' Search utility.
If it's really not there, your first port of call should be the Recycle Bin. If it's not in there either, or you habitually use the more brutal [Shift]+[Delete] option, you should advance to the 'Truly deleted files' section below. However, some programs may have already come to your rescue.
Word and other Office applications, for example, store temporary versions of files as you're working on them. Finding and extracting usable data from these temporary files can be complex, but it can enable you to retrieve missing data. Visit here for a very comprehensive guide.
Truly deleted files
Disaster rating: 3/5
Although files deleted normally (and therefore simply sent to the Recycle Bin) are easily restored, those 'properly' deleted are trickier to recover. However, it's sometimes possible to resurrect these files using an undelete utility.
To understand how these tools work their apparent magic, you need to know how a filesystem works and what happens when you delete a file. Each disk (or each partition if your disk is divided into more than one partition) contains a system area that contains directory information about all of its files.
For each file, it contains the name of that file and the number of the first cluster (the smallest usable area of a disk) in that file.
Another important system area is the File Allocation Table (FAT), which contains information about all the other clusters associated with a file. The FAT entry for a file's first cluster is the number of the second cluster; in the entry for the second cluster is the number of the third cluster and so on until the entry for the last cluster in the file, which is an end-of-file indicator.
When a file is deleted, Windows does two things. First, it overwrites the first character of the filename in the directory with a question mark to indicate that the entry in the directory can be reused. Second, it overwrites the entries for all the file's clusters in the FAT with zeros to indicate that those clusters are free to be reused. None of the data in the file is actually overwritten or erased, so, if you move quickly, it may be possible to recover the file.
Undelete utilities start by looking in the directory for any filenames that start with a question mark. If the user opts to undelete any such file, the utility goes to the first cluster, as shown in the directory, and reads data from that and subsequent clusters until an end-of-file marker is found.
Note that this method will work only if a file is sequential – if it's fragmented then it can't be recovered since the information in the file allocation table that is needed to find nonsequential clusters will have been overwritten.
It's also important to recognise that although it's possible to successfully recover a file if you act immediately, the longer you leave it the more likely it is that Windows will have overwritten one or more clusters.
