• Home

DataMole
Data Recovery Resource

Undelete

Many people are unaware that deleting a file does not mean that the data are erased from the storage media. Almost all operating systems are designed to retain the data, but remove the reference to it on the media. This is usually done by replacing the first letter of the filename with a tag that indicates that the file has been deleted, and that the space that was occupied by the file is available for use. However, the actual data in the file is not removed or overwritten. If a deleted file needs to be recovered it can very often still be found on the media. The determining factor is really how much data has been written to the media since the file was deleted.

An 'undelete' utility can restore files that have been deleted. Note that this does not include files that are deleted normally in Windows, as they will first be moved to the Recycle Bin. Only once these files have been 'purged' from the Recycle Bin are they deleted on disk. If an undelete utility is not already available on the system, the operation should be attempted from a networked computer or a removable disk; installing anything on the affected disk could possibly overwrite the data in question.

Undelete utilities use low-level media access to read the deleted directory entry, and extract the original location of the file and its size. If the data is recoverable you will need to supply the filename's first letter, which was removed by the delete flag. On NTFS file systems this process is considerably more complicated, and some undelete utilities are not compatible with NTFS. Most modern commercial versions are capable of working with most file systems though.

Important: Undelete utilities are a last resort. Proper backup procedures are the only insurance against data loss.