One of the most common data recovery tasks is to restore lost photos. Often, the photos were lost when they were accidentally deleted. But it is all too easy to corrupt a digital camera memory card, perhaps by disconnecting it from the computer before all read, write or delete operations have been completed. This can corrupt the file system and make the memory card unreadable. To restore use of the memory card it is usually necessary to format it, which effectively deletes the photos that were on it.
As in the case when files are deleted, formatting a memory card does not physically delete the existing data, so the lost photos are still recoverable. Memory cards look to the computer just like a removable disk drive, so lost files may be recovered using general deleted files recovery software like Uneraser. But you may also use specialist photo recovery software.
Photo recovery software is usually a bit cheaper to buy, because it does not need to include the capability to identify and recover non-image files. Two good photo recovery software packages that Tech-Pro.net recommends are Photo Recovery and Flash Recovery.
Showing posts with label Tutorial. Show all posts
Showing posts with label Tutorial. Show all posts
Thursday, December 16, 2010
Friday, November 26, 2010
Dangers of Disk Housekeeping
Many computer users like to keep their hard drives tidy by cleaning up redundant files. This is actually a dangerous exercise. Let me explain.
When Windows saves a file to disk, it tries to find a single block of space large enough to store the file instead of fragmenting the data across blocks of space in different parts of the drive. Whether a file is fragmented or not makes no difference to being able to access the file. As long as the file appears in a folder listing, the file system holds the information to be able to link the different blocks together in the right order. But it is faster and more efficient to be able to read a file from one continuous block - though to be truthful, with modern fast PCs and hard drives the difference is hardly noticeable.
Some types of file can't easily be stored in a continuous block, either because they are very large and there isn't a single block of space big enough anywhere on the hard drive, or because the file grows over a period of time and other files have been created that prevent its original space from being extended. Database files and Microsoft Office documents are good examples of files that grow over a period of time.
Microsoft Windows has always included a Disk Defragmenter tool. Its purpose is to improve system performance by ensuring that files on the disk are not fragmented. Although running the defragmenter may not make much difference to the perceived performance of a modern PC, it does have an effect - both good and bad - on the chances of recovering deleted files, and that is what we should be concerned about.
When a file is first deleted, its directory entry and related file system information aren't immediately deleted or overwritten so the file may be recovered intact even if it was fragmented. After these file system structures have been overwritten by new data, however, the only way a file may be recovered is forensically. Essentially what happens then is that the recovery software scans the hard drive examining it block by block. Most files start off with a "header block" that identifies the type of file and contains other information such as the length of the file. When a header block is detected, the recovery software must assume - in the absence of other information from the file system - that the file was not fragmented, and that the file consists of that header block plus however many consecutive data blocks are needed to contain the length of file stated in the header.
It follows from this that the chances of recovering a deleted file, even if it was deleted a long time ago, are much greater if the file was not fragmented at the time it was deleted. At the same time, running Disk Defragmenter severely harms the chances of recovering files that were deleted prior to running it, as the disk space those deleted files occupied are likely to be reused to hold relocated data. The common quiet afternoon task of cleaning up the hard drive followed by emptying the Recycle Bin and defragmenting is actually one of the worst things you can do. Disk housekeeping is one of the most common causes of deleting wanted files and by emptying the Recycle Bin and defragmenting you have just made the job of recovering those deleted files much more difficult.
When Windows saves a file to disk, it tries to find a single block of space large enough to store the file instead of fragmenting the data across blocks of space in different parts of the drive. Whether a file is fragmented or not makes no difference to being able to access the file. As long as the file appears in a folder listing, the file system holds the information to be able to link the different blocks together in the right order. But it is faster and more efficient to be able to read a file from one continuous block - though to be truthful, with modern fast PCs and hard drives the difference is hardly noticeable.
Some types of file can't easily be stored in a continuous block, either because they are very large and there isn't a single block of space big enough anywhere on the hard drive, or because the file grows over a period of time and other files have been created that prevent its original space from being extended. Database files and Microsoft Office documents are good examples of files that grow over a period of time.
Microsoft Windows has always included a Disk Defragmenter tool. Its purpose is to improve system performance by ensuring that files on the disk are not fragmented. Although running the defragmenter may not make much difference to the perceived performance of a modern PC, it does have an effect - both good and bad - on the chances of recovering deleted files, and that is what we should be concerned about.
When a file is first deleted, its directory entry and related file system information aren't immediately deleted or overwritten so the file may be recovered intact even if it was fragmented. After these file system structures have been overwritten by new data, however, the only way a file may be recovered is forensically. Essentially what happens then is that the recovery software scans the hard drive examining it block by block. Most files start off with a "header block" that identifies the type of file and contains other information such as the length of the file. When a header block is detected, the recovery software must assume - in the absence of other information from the file system - that the file was not fragmented, and that the file consists of that header block plus however many consecutive data blocks are needed to contain the length of file stated in the header.
It follows from this that the chances of recovering a deleted file, even if it was deleted a long time ago, are much greater if the file was not fragmented at the time it was deleted. At the same time, running Disk Defragmenter severely harms the chances of recovering files that were deleted prior to running it, as the disk space those deleted files occupied are likely to be reused to hold relocated data. The common quiet afternoon task of cleaning up the hard drive followed by emptying the Recycle Bin and defragmenting is actually one of the worst things you can do. Disk housekeeping is one of the most common causes of deleting wanted files and by emptying the Recycle Bin and defragmenting you have just made the job of recovering those deleted files much more difficult.
Tuesday, November 23, 2010
File systems
File system (sometimes written as filesystem) is the term used to describe the method used to store files on disk drives and other storage media. There are many different file systems in common use.
If you need to recover deleted files from a non-optical storage device then use a data recovery program written for the type of computer (operating system) that can read the device. So a Windows program like Uneraser will be able to recover files from a drive written by Windows and a Mac program like File Recovery for Mac will be able to recover files from a drive written by a Mac.
The file systems used for optical storage media are not generally supported by hard drive data recovery software so to recover files from CD and DVD you must use a specialized program such as IsoBuster.
- FAT (for file allocation table) is one of the oldest file systems and was originally designed for use with floppy disks under MS-DOS. It is supported by all major operating systems and many other devices. Extended to allow use with hard drives, it is now rarely used due to a low limit on the maximum size of an individual drive or partition and the fact that file names are limited to eight characters plus a three character extension.
- FAT32 is a development of FAT that is able to support larger drives and partitions and file names of up to 255 characters in total length. Introduced with Windows 95, it is falling out of use in computers as it is inefficient when used with large hard drives, lacks any access control features and is prone to corruption. However it is commonly used with memory cards (such as in digital cameras) and removable drives due to its simplicity and it is supported by most major operating systems not just Windows.
- NTFS (for New Technology File System) is so named as it was introduced with Windows NT, the forerunner of Windows XP, Vista and Windows 7. There are many versions of NTFS, each introducing new features. NTFS includes many features considered necessary to support a modern operating system including access rights and encryption. It is fully supported only under Windows though Mac OS and Linux support read access to allow NTFS partitions on a dual boot system to be read.
- HFS (for Hierarchical File System) was developed by Apple for use on Mac OS. There is also a newer version able to support larger files called HFS Plus. It is an advanced file system offering many of the same capabilities as NTFS but is only supported on Mac OS.
- ISO 9660 is an International Standards Organization file system which is used on CDs, DVDs and other optical media. It was designed to be independent of operating system and is supported by all major operating systems.
- UDF (Universal Disk Format) is a file system that is mostly used on DVDs and other high capacity optical media where it is replacing ISO 9660.
If you need to recover deleted files from a non-optical storage device then use a data recovery program written for the type of computer (operating system) that can read the device. So a Windows program like Uneraser will be able to recover files from a drive written by Windows and a Mac program like File Recovery for Mac will be able to recover files from a drive written by a Mac.
The file systems used for optical storage media are not generally supported by hard drive data recovery software so to recover files from CD and DVD you must use a specialized program such as IsoBuster.
Monday, November 22, 2010
Bugged by the bin
Unfortunately that desktop icon showing a full Recycle Bin is a constant reminder that your computer still contains files you threw out, and some people have an instinctive desire to empty it. If you are being bugged by your full Recycle Bin, try this simple solution. Change the icon for the full bin so that it is the same as the empty one.
Right-click the desktop and select Personalize, then in the Control Panel Personalization window click on Change desktop icons. Select the Recycle Bin (full) icon, click Change Icon, select the empty bin icon and click OK. Now you won't be able to see that the Recycle Bin is full so you won't be as tempted to empty it.
- To recover deleted files that are not in the Recycle Bin, use Uneraser
Thursday, November 18, 2010
How files are deleted
To understand how it is possible to recover deleted files it helps to know what happens when a file is deleted. I've mentioned the Recycle Bin already. It's a folder where files are moved to when you delete them from another folder so they can easily be recovered. But what happens to files when you empty the Recycle Bin, delete them from a removable drive, a memory card or a network drive, or use Shift+Delete to bypass the Recycle Bin?
Exactly what happens depends on the system used to organize files on your hard drive or other storage medium (the file system) but the details aren't really important. In essence, two things happen. A flag in the record for that file in the folder is changed to show it as deleted and the space on the drive that contained the data of the file is marked as available for re-use by the operating system. Although the file no longer appears in the folder and has gone as far as the operating system is concerned, the data has not been erased and the file is still fully recoverable.
If you act immediately you realize your mistake using a deleted files recovery software like Uneraser, you have a 100% chance of recovering that deleted file. This is the easiest task for recovery software. The file's record is still present in the folder containing all the details of the file including it's name, type, size, date created and date modified and the location of the file's data. All the recovery software has to do is clear the deleted flag from the record, remove the space holding the data from the free disk space pool and your file is back where it was originally.
As time passes since the file was deleted, two things will happen. The record containing the details of the deleted file will be reused to store information about a new file. And the space that held the file data will start to be overwritten by other data. There is no way to predict how long that will take. When testing data recovery software I have been surprised at some of the long-forgotten files that have been recovered. But I have also found more recently deleted files that could not be recovered perfectly because some of the original data had been overwritten. It depends on things like the size of the hard drive relative to the space you are using, how much you use the computer, whether you create many big files and where on the hard drive the file you deleted was stored.
To have the best chance of recovering deleted files, act as quickly as possible. Ideally you should stop using the computer and either take the hard drive out and attach it to another PC to run the data recovery or you should use bootable recovery media. We will look at these options in future postings.
Exactly what happens depends on the system used to organize files on your hard drive or other storage medium (the file system) but the details aren't really important. In essence, two things happen. A flag in the record for that file in the folder is changed to show it as deleted and the space on the drive that contained the data of the file is marked as available for re-use by the operating system. Although the file no longer appears in the folder and has gone as far as the operating system is concerned, the data has not been erased and the file is still fully recoverable.
If you act immediately you realize your mistake using a deleted files recovery software like Uneraser, you have a 100% chance of recovering that deleted file. This is the easiest task for recovery software. The file's record is still present in the folder containing all the details of the file including it's name, type, size, date created and date modified and the location of the file's data. All the recovery software has to do is clear the deleted flag from the record, remove the space holding the data from the free disk space pool and your file is back where it was originally.
As time passes since the file was deleted, two things will happen. The record containing the details of the deleted file will be reused to store information about a new file. And the space that held the file data will start to be overwritten by other data. There is no way to predict how long that will take. When testing data recovery software I have been surprised at some of the long-forgotten files that have been recovered. But I have also found more recently deleted files that could not be recovered perfectly because some of the original data had been overwritten. It depends on things like the size of the hard drive relative to the space you are using, how much you use the computer, whether you create many big files and where on the hard drive the file you deleted was stored.
To have the best chance of recovering deleted files, act as quickly as possible. Ideally you should stop using the computer and either take the hard drive out and attach it to another PC to run the data recovery or you should use bootable recovery media. We will look at these options in future postings.
- Read how to recover deleted files on Tech-Pro.net
Wednesday, November 17, 2010
Remember the Recycle Bin
In effect, the Recycle Bin is a special folder where files go when you delete them so they are not really deleted and may easily be recovered. Unfortunately the Recycle Bin does have some limitations. Files are only deleted to the Recycle Bin if they were on your main hard drive, not removable drives, USB Flash drives, memory cards or network drives and only if they are deleted from the desktop or Windows Explorer, not from within an application. Very large files, for example videos, often are not moved to the Recycle Bin. And it's easy to bypass the bin by holding the Shift key whilst deleting.
What's more, the little icon on the desktop showing a full Recycle Bin encourages tidy minded people to empty it. With today's large, fast hard drives there is little to be gained from this, and emptying the Recycle Bin makes it somewhat ineffective as a recovery tool for deleted files.
I would not be surprised if some people have resorted to using data recovery software like Uneraser to recover deleted files that could have been restored from the Recycle Bin. Either they forget about the Recycle Bin or they fail to spot that the file they want is in it.
It can be difficult to find a file if there are a large number of items in the Recycle Bin. But Windows provides several ways to help you find the file you want. If you select Details View of the Recycle Bin folder then you can sort the items into alphabetical order of name, location or file type, into order of date deleted or last modified, or into size order. This can make it it easier to spot what you are looking for. There is also a search function to locate files containing specified text.
So remember the Recycle Bin when you lose a file and don't be in too much of a hurry to empty it. And if you can't find the file you need, try Uneraser.
Monday, November 15, 2010
Don't panic!
The answer is: don't panic. Although there is no guarantee that any lost can be recovered, these days the chances of recovering deleted files are pretty high. The best data recovery software uses advanced techniques and forensic recovery methods that can detect and restore your data if at all possible. In this blog we will look at what to do when you discover files are missing, how data recovery works and what data recovery tools to use.
- See Tech-Pro.net's article on how to recover deleted files
Subscribe to:
Posts (Atom)