#!# Deleted A File?:: A tiny guide to undeleting deletes //Windows

Greetings all, today I'll be writing a small informational on file recovery. I'm afraid I cannot post pictures on this topic. I will be building a virtual windows xp box over the weekend and I'll use that to add pictures to this thread later on.

About this Guide::
This guide will be a rather brief introductory to file recovery, as I plan on getting into computer forensics. In this guide I will show you how windows removes files. In futures guides I wish to teach you how to find and locate hidden processes, teach you about data encryption, how password recovery (not cracking) works, educate you on file binding. And possibly write a guide on the breakdown of virii so they could be better understood.​

Let us begin on a small informational.

<guide>

When we clear the recyclebin, or shift+delete a file, is it really gone? Did you accidentally delete a file and panic? This will be a small guide, as there isn't a whole lot to explain on file recovery. I will add more later when I can add pictures.

What happens when a file is deleted?

A file is in 2 segments; there is the initial file itself, and there is a locator used by the system to identify the file's location for later use.
When you delete a file, that pointer is removed, and the file is forgotten but still exists. In other words, since that identifier for the file is gone, the space where that file was located is marked again as free space, and will eventually be over written.

Windows gives you a neat utility called the recycler, accessed through the recycle bin. What this is exactly, is it is a FIFO stack. First In, First Out. When you delete a file, this remembers the location on the disk that the file was stored in, allowing for quick recovery. If it gets too full the data on your deleted file will be written over.

Not all deleted files will be remembered in the recyclebin however. For example if you use shift+delete the recycle bin is bypassed altogether.

The only safe way to delete a file/information completely is a process called shredding. It can be a very long and tedious process that takes days to complete. But for most files it doesn't take more than a few moments.

<Shredding>

Shredding is the manual writing over of data, there are a few good shredding utilities out there. I recommend pgp shredder. I will be writing a guide on using their software in the near future so I will not elaborate on it now.​

</Shredding>

Now that you understand what happens when you delete a file? How can you get it back? There are a lot of good utilities out there. I personally suggest using Recovery Doctor.

You can get a copy of it here::
http://www.recoverydoctor.org/download.html

This is only the demo version. But should still work pretty diligently. As soon as I can get pictures going on (I'm guessing saturday) I'll go into it's use a little bit.

</guide>

In depth continuation with pictures~! (as promised).​

Sorry It took so long to get this shit up, Had some problems with virtual box, then I got real busy, and Now I'm just getting over the freaking flue!.


But here it is, it should be semi universal.

<guide>
Alright guys, first thing is first, if you're going to be recovering some software and if you're using any of eEye's 'Blink' products you will need to shut them down. Blink is one of a kind,
thank god for it, but seriously turn it off.

First thing your recovery program will probably ask you is what drive it will be working with. Select your drive and continue.



Once you select your drive of choice ; weather physical or logical shouldn't matter. In this example I'll be recovering a deleted file from windows xp.



Then you need to select a location to save your recovered files. With this software, everything in green is deleted. Simply write click a green file and 'save as'. You'll be prompted by the recovery software on where you'd like to save it.



As the kind dialog in the window suggests, you should always save your deleted shit to a removable storage device; doesn't matter if you use a usb stick, external drive, hell even an ipod/mp3player will do. But for this small guide I just recovered it to my desktop. This is dangerous however; because it can cause the files you're trying to recover to become 'over written'. In other words you're not getting it back. Ever.



</guide>

Ta-Dah! deleted file has now been recovered. That completes this guide on file recovery! If there's anything specific you'd like to know/ask don't be shy, I'm open to private messages.

Sincerely, 1ce

 

This might be very useful in future, if you added pictures it would make it a whole lot better

 

I already knew a method of this when i deleted 2 years worth of photo's whilst trying to move them to my harddrive, i removed them from my recycling bin but they didnt save to the hardrive. This would be a great guide for people who don't know how to do this. Thanks

 

There we go, uploaded a pictures example guide as promised. Hope it helps.