How to: recover a lost file
14th Aug 2008 | 11:00
Crashes vary in severity, but you can often recover lost data. Here's how
Sooner or later you'll lose data, even if you have the best back-up strategy in the world. Thankfully, all is rarely completely lost should your data get mangled. In most cases there are steps you can take to recover some, most, or all of the missing bits and bytes.
Data loss falls into three broad categories: physical damage to media, accidental deletion, or data corruption. An independent backup will normally negate all of these, as long as it hasn't befallen the same fate as the original.
Curiously enough, it's often people who think that they have the most bulletproof back-up regimes who suffer most when data loss occurs. Complacency can creep in and wreak havoc. Be especially wary of solutions like RAID for a desktop. While certain variants can ensure your data will survive hard drive failure, the more common scenario of accidental deletion might not be covered.
Windows includes its own fail safe against accidental deletion in the Recycle Bin. The problem is that most users know that stuff in the bin has effectively just been put to one side, so they regularly empty it. However, what if it's just been emptied and then you remember a file that you really should have kept? In most cases a simple undelete utility is all you need to save your skin.
When you delete a file from your hard disk you may think that the file is physically deleted. This isn't actually the case. To speed up performance, Windows replaces the first few bytes of the file with a flag that tells it that the space currently occupied by the file is up for grabs. The file vanishes from Windows, but until that space is filled by another file, the original file's contents remain intact.
How long that file remains available for retrieval is an inexact science. Some can be recovered months or even years after they were originally deleted, while others might be overwritten in days or even hours.
If the file is fragmented then you may find parts of it remain while others have been overwritten. Generally, the longer a file has been deleted for, the less likely it is to be recoverable in full. Other factors include the amount of free space and how busy the hard drive is.
Undelete programs can work in slightly different ways, so it's worth trying at least two different utilities to get the data back. This is especially important if you've managed to recover some, but not all, of the file. It's possible that a different algorithm might be able to restore more of the data or uncover different parts of the file.
Some people opt to use a data-shredding program like Eraser to securely delete sensitive files. This overwrites the data to prevent undelete utilities from recovering it. If the most secure settings are used to delete a file, you won't be able to get it back. Some professional services are able to reconstruct data after overwriting, but it's a time consuming and costly process.
Corrupt files can be devastating, depending on which ones they are. A damaged Master Boot Record can render a PC unbootable, but even a relatively benign scrambled Office file can be problematic if the contents are important and the corrupt version has written over the backup. There are ways to get back some or all of a corrupt file, depending on what it is.
Sometimes just opening a corrupt file as plain text can help you find its contents. Browse to the affected file and right-click it. Choose 'Open with… Choose program'. From the list of programs select Notepad. Make sure that the option to always use this program is left clear. Click 'OK'.
In Notepad, you may be able to see important data from the file, among the formatting characters. Copy and paste these into a new document. You won't have any of the original formatting, but often this is all that's needed to rescue the content. You can always re-apply the formatting.
Corrupt zip files
Zip files are often subject to corruption, but they can be fixed. One free tool for fixing broken zip files is pkzipfi x. Download 'pkzipfi x.exe' and copy it to the root of your hard drive. Move your corrupted zip file here too.
Choose Start, (Run) and enter 'cmd' into the command line. Click 'OK'. Make sure that you're at the root of the C drive by typing cd .. [Enter] twice. Now type in the following command: 'pkzipfi x', followed by the filename of the file you want to fix. Press [Enter]. It will be resaved as 'PKFIXED.ZIP'.
If you need to recover an office file, try Easy Recovery File Repair from Kroll Ontrack, which you can get for a limited feature trial. Select the type of file you want to recover and then browse to it. Click 'Next' and the software will attempt to recover the file.
If you've downloaded a file that's turned out to be corrupt, try downloading it again under a different filename. If the new version is no better, use Corruption Corrector, which will try to recover a complete file from two or more corrupt versions. It's free from http://ccorr.source forge.net, but you'll need a Java Runtime Environment installed.
Sometimes a crashed process can lose you data. If Explorer.exe crashes while you have windows open that hold unsaved data, you may lose the contents of the windows and be forced to start over. However, a cunning little tool called Unhider could come to the rescue. It enables you to reopen hidden windows, giving you a chance to save your work before rebooting.
Severely corrupt data could mean that your PC won't boot and you'll need to re-install Windows before you can use it again. You may find yourself in a similar position if you have damaged sectors on your hard drive. If you can't get into Windows you could potentially lose all the data on your Windows drive or partition. This is where BartPE comes in.
The Bart Pre-installation Environment is basically a cut down version of Windows that lets you browse your drive and recover data from it. If you have a CD rewriter, you can install a disc burning plug-in based on the free program CD Burner XP Pro that will let you transfer lost files to disc. Bart PE provides a slow interface that isn't suitable for day-to-day computing, but enables you to rescue lost files prior to a re-installation of Windows or before resetting your computer using recovery discs.
Start by downloading PEBuilder and installling the program in the usual way. Put your Windows XP CD into your CD drive, browse to My Computer, right-click this drive and choose 'Explore'. Copy the i386 folder to the root of your C drive. PEBuilder will use these files to create the basic disc. You'll also need CD burning software like CD Burner XP Pro.
Double-click 'CDBurnerXP_Pro_PEBart_ Plugin.exe' and extract it to the 'PEBuilder3110a\plugin' folder. Install CD Burner XP Pro on your computer and browse to 'Program Files\CDBurnerXP Pro 3'. Copy all of the files, plus the Resources and AVI folders, into the Files folder inside 'PEBuilder3110a\ plugin\cdburnerxprpo3'.
Launch PEBuilder and set the source path to 'C:\'. For the Media output, select 'Burn to CD/DVD' and opt to auto erase RW. Click 'Plug-ins' and select 'CDBurner XP Pro' from the list and click 'Enable/ Disable' followed by 'Close'.
To create your BartPE recovery disc, click 'Build'. This generates the CD image and then burns it to your disc. Test this disc by restarting your PC and booting from it. You should now be able to use the pre-installation environment. This gives you an environment that's very similar to Windows. You can browse your hard drive using the file manager. To recover files from your disk, launch CD Burner XP Pro and copy them to CD or DVD.
There is a Vista alternative to Bart PE, which you can get at VistaPE. However, the XP version will enable you to boot a Vista machine and it provides a lot more tools and has lower overheads. If you have access to a copy of XP, we'd recommend Bart PE. Another alternative is to use a Linux live CD. See 'Spotlight on boot discs' for more information.
Physical damage can be a challenge. Some of the data will have been completely destroyed. Scratched CDs and DVDs can sometimes be restored by carefully polishing out the scratch, as long as it hasn't gone deep enough to damage the foil that actually holds the data. You can also try CD/DVD recovery software that checks and attempts to restore lost data on optical discs.
CDCheck is available as a free trial. Install the software and select the drive you want to check and follow the prompts. For recovery, you'll need to specify an output folder.
You may not be able to get a hard disk to spin up at all. In these cases you have little choice but to call in the experts. There are many data recovery services available, but Kroll Ontrack has specialised in this area for many years. Physically damaged drives can be shipped into Kroll Ontrack's clean rooms for on-site recovery.
These are similar to clinical laboratories. The dustfree environment vastly reduces the chances of damaging the data on the disk. Professional data recovery isn't cheap, but is worth it if your data is valuable.