Undelete applications?

[Dark Shikari]

So when trying to back up my laptop hard disk (Windows, NTFS) before sending the thing in for an RMA, I accidentally rm -rf'd a few too many files. Including most of my Windows directory, boot files, etc. All my personal files are fine though.

However, I really don't feel like reinstalling Windows. And I did this all from a separate OS (Windows wasn't booted), so the drive literally has not been written to since the original delete, leaving everything quite ripe for undeletion.

Does anyone know a good undeletion app for Windows/NTFS that:

1. Works on a boot disk or such (so it can cleanly undelete files).
2. Can simply undelete everything recoverable on a drive to its original state.

[Ranguvar]

SystemRescueCd may be the CD for you... Linux-based, supports every FS under the sun, terminal or X, and comes with file recovery (name is a misnomer): http://www.cgsecurity.org/wiki/PhotoRec

Here it is: http://www.sysresccd.org/Main_Page

I've never used it for file recovery though... the two I know to work well are SpinRite for damaged hard disks and other severe problems (CD), and the tools from Runtime Software (Winblows).

[[P]ako]

Most recovery file applications will require a second drive to dump the files onto.

There is a CD bootable version of Easy Recovery (Ontrack). But, as I had said it will ask you for a second drive to recover the files onto. However, it will recover the files and recreate the directory structure.

[littleD]

I advice u something simple. It will be easy if u didt touched c partition.
Download recuva and start recovering from other computer, and get remember roots folders and files on c disc that were deleted (for folder view in recuva). Dig in options to check hidden/sytem files and so on. Copy files on other partition/disc and make sure its all and then copy back to c:.
I dont know any method to recover files deleted on specified time/period of time.

[Dark Shikari]

ako;1219865']Most recovery file applications will require a second drive to dump the files onto.

There is a CD bootable version of Easy Recovery (Ontrack). But, as I had said it will ask you for a second drive to recover the files onto. However, it will recover the files and recreate the directory structure.That's fine, I have plenty of second drives.

[Ajax_Undone]

Chances are pretty slim JSYK I did file recovery for 2 years and sometimes when its gone its gone.. The larger the HDD the worse off you are cuz smaller read/write = less forensics = no recovery... So hope you can recover what you missing... So if its just windows files you lost then after you get it recovered boot into safe w/ Dos and run this from root with the install cd in a drive sfc /scannow This will make sure all important windows files are there and in the correct version. Good Luck...

Sometimes it is easier to just reinstall...

[CruNcher]

Very Powerfull Software (though you need to create the BootCD yourself BartPE/VistaPE) http://services.seagate.com/diysoftware.aspx it can even cache the image in Ram but you need a lot of Ram available for that or it gets pretty slow pretty fast swaping out the pagefile that depends on the drive size and only when you want to view the recovery results without imaging of course ;)
Though of course you should try cheap Software solutions first like the Free Recuva (also needs a BootEnviroment) or Ontrack there was aslo a Open Source Forensics Project but dunno it's name anymore :)
Also a little advertising as i have very good experience with them Seagates Data Recovery Service is Top Notch and Cheap :)

[Ranguvar]

Chances are pretty slim JSYK I did file recovery for 2 years and sometimes when its gone its gone.. The larger the HDD the worse off you are cuz smaller read/write = less forensics = no recovery... So hope you can recover what you missing...

Slim? Huh?

A simple delete operation or format is almost always 100% recoverable from my experience, as long as no data was written after, like DS' case. All the data's still there, just marked as free space. :)

[Sagekilla]

Depends on what kind of "delete" was done. If it was a simple delete (which most are), the data is almost nearly 100% recoverable. In those cases the entry that says a file exist is simply deleted. The more thorough deletes (which zero out the area the information used to be) are almost impossible to recover from though.

Likely, all that happened was the index pointing to everything had all entries deleted, so you should be able to recover it.

[Ranguvar]

Yes, DS said he used 'rm', which (almost?) all versions of are a simple delete.

As for zeroing, one pass I don't believe is all that hard to recover (SpinRite FTW!), but it's far from the 95% chance at 100% recovery of simple deletes without writing afterwards.

[Blue_MiSfit]

Stellar Phoenix is my personal favorite on the Windows side. It's not bootable (i.e. you run it inside Windows), but you could pull your drive and slave it up to another system.

~MISfit

[Dark Shikari]

Stellar Phoenix is my personal favorite on the Windows side. It's not bootable (i.e. you run it inside Windows), but you could pull your drive and slave it up to another system.It's a laptop drive ;)

[Blue_MiSfit]

If it's through IDE, there are cheap little adapters to connect the mini connector to USB.

If it's through SATA, you can natively connect :)

~MiSfit

[CruNcher]

Just to be complete here is the Open Source Forensics i mentioned above http://www.plainsight.info/ :)

[daniel2]

A file recovery option sets into practical use when some important file has got lost from your Windows based system and your backup program has got failed to get that file back. When I deleted my data accidentally I tried Stellar Phoenix Partition Recovery Software to recover my lost data. You can try this software from here: http://www.stellarinfo.com/partition-recovery.htm and after using it check whether your data is recoverable or not. If you are able to view your data, it means your data is recoverable. Then you need to get the full version of the software to save your data.

[mikeytown2]

helix3 (http://www.e-fense.com/helix/index2.html) - live cd that should do what you need (never tried)
winhex (http://www.x-ways.net/winhex/) - for when your motherboard goes up in smoke and you cant get your old raid 0 setup working in the new computer (that was a fun 3 days)

plan b (http://www.download.com/1770-20_4-0.html?query=undelete&rpp=30&sort=totaldl4%20asc&filter=platform=Windows|licenseName=Free&filterName=platform=Windows|licenseName=Free&searchtype=downloads&tag=ltcol)