Sunday, July 27, 2008

Can i "undelete" my files?

Recently i did a simple survey among my friends, asking them whether files/data deleted from the computer can be recovered? Most of them (including non-IT profession) knows that it is possible to recover deleted data. They claim that they got to know about it from the "Edison" incident.

But there are still one or two of them unaware that deleted data may still be recoverable (including a IT application analyst with many years of working experience). So i decided to write this post to share some of my knowledge on "file deletion/recovery" (known as Data remanence).

Most Computer system (Operating System, e.g Windows) do not actually remove the contents of a file when it is deleted. Instead, they simply remove the file's entry from the file system directory. The data of the file remains on the storage medium (harddisk, flashdrive, floppy or etc). The data will remain there until the operating system reuses the space for new data. Nowadays with very large harddisk in our system, the space may not even reuse.

Several questions were asked by them during the survey such as "How can we recover those deleted files ?", "Any recommended free tools ?" and "Any ways to delete the files permenantly ?". So below were my answers to those questions.

File Recovery Tools
There are many file recovery tools available in the Internet, some are free and others require license ($$$). I have found 2 Windows-based "freeware" tools (PC Inspector File Recovery and Recuva) to share with you all. PC Inspector File Recovery have better features and personally recommended for IT users, whereas Recuva will be more simple and user friendly.

CONVAR PC INSPECTOR™ File Recovery 4.xCONVAR PC Inspector™ File Recovery 4.x - a data recovery program that supports the FAT 12/16/32 and NTFS file systems. Some "special" features -
> Finds partitions automatically, even if the boot sector or FAT has been erased or damaged
> Recovers files with the original time and date stamp
> Supports the saving of recovered files on network drives
> Recovers files, even when a header entry is no longer available

Piriform RecuvaPiriform Recuva - a Windows utility to restore files that have been accidentally deleted from your computer. This includes files emptied from the Recycle bin as well as images and other files that have been deleted by user error from digital camera memory cards or MP3 players. It will even bring back files that have been deleted by bugs, crashes and viruses!

Secure Deletion
To permenantly delete your data/files, you will need to do secure deletion (or data sanitization). I have talk about this in my previous posting "What is data sanitization? - on April 6 2008". Please refer to this posting to learn more about secure deletion and the tools that i recommended.

Related Posts:
- Edison Chan Sex Scandal. Lesson to be learned! - on February 17, 2008
What is data sanitization? - on April 6 2008

No comments: