Today's useful utility isn't something you'll use often, but when you do need it this program can save you a lot of grief. The utility is NTFS Undelete, and as you can figure out from the name it allows you to recover deleted files from NTFS partitions. This program has saved my skin on more than one occasion.
The concept of undeleting has been around for a long time, since at least the DOS days. Deleting a file doesn't typically remove a file from the hard drive, it merely erases the index of it in the lookup table. Undelete programs allow you to recover these files.
An undelete program is not guaranteed to work, it's entirely possible the data you're trying to recover has since been overwritten by another file. The more recently the file was deleted, the more likely you will be able to recover it. To have the best chance of recovering the data, the moment you realize you want/need something back, try to minimize writes to the disk. Don't save files, don't run additional programs, don't install anything, etc. But that means your best bet for recovering files is to download and install NTFS Undelete now. Don't wait until you need it before you install it, that will only lower your chances for a successful recovery.
Years ago I tried several Windows undeleting programs. By far NTFS Undelete was the best, and it's free. I suggest you download and install now. They also have an ISO image that you can burn onto a CD and run the program from there. Although I haven't tried it, I wonder if NTFS Undelete would work from WinPE thereby allowing you to undelete while Windows is offline.
And while we're on the subject of recovering files, SysInternals has a utility called SDelete that securely deletes a file to ensure it can't be recovered by programs like NTFS Undelete. So if you're paranoid you can use this program to delete sensitive data.
No comments:
Post a Comment