Guest Peter Hucker Posted September 3, 2008 Posted September 3, 2008 In DOS and Windows 3.1, if you deleted a file, you could just undelete it again, as long as you hadn't written to that portion of the disk. What has happened in Windows XP which prevents this? I was given a USB memory stick, the owner had deleted the wrong file, and wanted it back. I tried 6 different recovery utilities, one said the file was "overwritten", the others said "poor". The most they recovered was the heading of the word document (it was 7 pages of text). So I tried a test, I got my own USB stick, copied a couple of images and a word document to it, then deleted them. Then I immediately tried to recover the three files. None of the 6 utilities got any of them back. Why??? -- http://www.petersparrots.com http://www.insanevideoclips.com http://www.petersphotos.com
Guest Dan Posted September 4, 2008 Posted September 4, 2008 RE: Undeleting / recovering a file I use Restoration 3.2.13 to recover deleted files, but I don't think it supports network or external drives (or disks). I don't think most recovery software support those types of media. But I could be way off base! "Peter Hucker" wrote: > In DOS and Windows 3.1, if you deleted a file, you could just undelete it again, as long as you hadn't written to that portion of the disk. What has happened in Windows XP which prevents this? > > I was given a USB memory stick, the owner had deleted the wrong file, and wanted it back. I tried 6 different recovery utilities, one said the file was "overwritten", the others said "poor". The most they recovered was the heading of the word document (it was 7 pages of text). > > So I tried a test, I got my own USB stick, copied a couple of images and a word document to it, then deleted them. Then I immediately tried to recover the three files. None of the 6 utilities got any of them back. Why??? > > -- > http://www.petersparrots.com http://www.insanevideoclips.com http://www.petersphotos.com >
Guest Peter Hucker Posted September 4, 2008 Posted September 4, 2008 Re: Undeleting / recovering a file I found several which claimed to specialise in removable media. They did not work. How can a file that's just been deleted possibly be unrecoverable? On Thu, 04 Sep 2008 03:05:00 +0100, Dan <Dan@discussions.microsoft.com> wrote: > I use Restoration 3.2.13 to recover deleted files, but I don't think it > supports network or external drives (or disks). I don't think most recovery > software support those types of media. But I could be way off base! > > "Peter Hucker" wrote: > >> In DOS and Windows 3.1, if you deleted a file, you could just undelete it again, as long as you hadn't written to that portion of the disk. What has happened in Windows XP which prevents this? >> >> I was given a USB memory stick, the owner had deleted the wrong file, and wanted it back. I tried 6 different recovery utilities, one said the file was "overwritten", the others said "poor". The most they recovered was the heading of the word document (it was 7 pages of text). >> >> So I tried a test, I got my own USB stick, copied a couple of images and a word document to it, then deleted them. Then I immediately tried to recover the three files. None of the 6 utilities got any of them back. Why??? -- http://www.petersparrots.com http://www.insanevideoclips.com http://www.petersphotos.com The success of the "Wonder Bra" for under-endowed women has encouraged the designers to come out with a bra for over-endowed women. It's called the "Sheep Dog Bra"- it rounds them up and points them in the right direction.
Guest Sergey Wasilenkow Posted September 5, 2008 Posted September 5, 2008 Re: Undeleting / recovering a file > So I tried a test, I got my own USB stick, copied a couple of images and a word document to it, thendeletedthem. Then I immediately tried torecoverthe threefiles. None of the 6 utilities got any of them back. Why??? You can also try to recover your Word document with Easy File Undelete software: http://www.munsoft.com/EasyFileUndelete/ It uses unique modern algorithms to recover files that other software either recovers incorrectly or is unable to detect.
Guest AlmostBob Posted September 5, 2008 Posted September 5, 2008 Re: Undeleting / recovering a file disks are magnetic powder on a metal plate, there is magnetism after the file pointers are removed, until some other magnetic pattern is written on that spot. memory sticks are not magnetic, there is not much to reclaim from a ram chip -- Adaware http://www.lavasoft.de spybot http://www.safer-networking.org AVG free antivirus http://www.grisoft.com Etrust/Vet/CA.online Antivirus scan http://www3.ca.com/securityadvisor/virusinfo/scan.aspx Panda online AntiVirus scan http://www.pandasoftware.com/ActiveScan/ Catalog of removal tools (1) http://www.pandasoftware.com/download/utilities/ Catalog of removal tools (2) http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?CID=40387 Blocking Unwanted Parasites with a Hosts file http://mvps.org/winhelp2002/hosts.htm links provided as a courtesy, read all instructions on the pages before use Grateful thanks to the authors and webmasters _ "Peter Hucker" <none@spam.com> wrote in message news:op.ugyvt5jm4buhsv@fx62.mshome.net... >I found several which claimed to specialise in removable media. They did >not work. How can a file that's just been deleted possibly be >unrecoverable? > > > On Thu, 04 Sep 2008 03:05:00 +0100, Dan <Dan@discussions.microsoft.com> > wrote: > >> I use Restoration 3.2.13 to recover deleted files, but I don't think it >> supports network or external drives (or disks). I don't think most >> recovery >> software support those types of media. But I could be way off base! >> >> "Peter Hucker" wrote: >> >>> In DOS and Windows 3.1, if you deleted a file, you could just undelete >>> it again, as long as you hadn't written to that portion of the disk. >>> What has happened in Windows XP which prevents this? >>> >>> I was given a USB memory stick, the owner had deleted the wrong file, >>> and wanted it back. I tried 6 different recovery utilities, one said >>> the file was "overwritten", the others said "poor". The most they >>> recovered was the heading of the word document (it was 7 pages of text). >>> >>> So I tried a test, I got my own USB stick, copied a couple of images and >>> a word document to it, then deleted them. Then I immediately tried to >>> recover the three files. None of the 6 utilities got any of them back. >>> Why??? > > -- > http://www.petersparrots.com http://www.insanevideoclips.com > http://www.petersphotos.com > > The success of the "Wonder Bra" for under-endowed women has encouraged the > designers to come out with a bra for over-endowed women. > It's called the "Sheep Dog Bra"- it rounds them up and points them in the > right direction.
Guest Peter Hucker Posted September 5, 2008 Posted September 5, 2008 Re: Undeleting / recovering a file On Fri, 05 Sep 2008 10:52:23 +0100, AlmostBob <anonymous1@microsoft.com> wrote: > disks are magnetic powder on a metal plate, there is magnetism after the > file pointers are removed, until some other magnetic pattern is written on > that spot. > memory sticks are not magnetic, there is not much to reclaim from a ram chip Nonsense. The reason the data is left on the disk is it's not touched. Only the index is. The same happens with chips. P.S. sorry the rest is snipped, but you put your sig above the quoted text. -- http://www.petersparrots.com http://www.insanevideoclips.com http://www.petersphotos.com You know, sometimes I get the sudden urge to run around naked. But then I just drink some Windex. It keeps me from streaking.
Guest AlmostBob Posted September 5, 2008 Posted September 5, 2008 Re: Undeleting / recovering a file _ "Peter Hucker" <none@spam.com> wrote in message news:op.ug0oyp1i4buhsv@fx62.mshome.net... > On Fri, 05 Sep 2008 10:52:23 +0100, AlmostBob <anonymous1@microsoft.com> > wrote: > >> disks are magnetic powder on a metal plate, there is magnetism after the >> file pointers are removed, until some other magnetic pattern is written >> on >> that spot. >> memory sticks are not magnetic, there is not much to reclaim from a ram >> chip > > Nonsense. The reason the data is left on the disk is it's not touched. > Only the index is. The same happens with chips. > > P.S. sorry the rest is snipped, but you put your sig above the quoted > text. > > -- > http://www.petersparrots.com http://www.insanevideoclips.com > http://www.petersphotos.com > > You know, sometimes I get the sudden urge to run around naked. > But then I just drink some Windex. It keeps me from streaking. "Some file systems are designed to distribute usage over an entire memory device without concentrating usage on any part (e.g., for a directory); this prolongs life of simple flash memory devices. USB flash drives, however, have this functionality built into the controller to maximise device life, and use of such a file system brings no advantage" from http://en.wikipedia.org/wiki/USB_flash_drive If the file system remaps data to maximise device life, perhaps the forensic software, which is linking to the next 'cluster', for want of better word, to undelete may be mapped to a different data area than the original file was mapped to, each time it runs getting a different response. -- Adaware http://www.lavasoft.de spybot http://www.safer-networking.org AVG free antivirus http://www.grisoft.com Etrust/Vet/CA.online Antivirus scan http://www3.ca.com/securityadvisor/virusinfo/scan.aspx Panda online AntiVirus scan http://www.pandasoftware.com/ActiveScan/ Catalog of removal tools (1) http://www.pandasoftware.com/download/utilities/ Catalog of removal tools (2) http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?CID=40387 Blocking Unwanted Parasites with a Hosts file http://mvps.org/winhelp2002/hosts.htm links provided as a courtesy, read all instructions on the pages before use Grateful thanks to the authors and webmasters
Guest Peter Hucker Posted September 6, 2008 Posted September 6, 2008 Re: Undeleting / recovering a file On Fri, 05 Sep 2008 23:19:19 +0100, AlmostBob <anonymous1@microsoft.com> wrote: > "Peter Hucker" <none@spam.com> wrote in message > news:op.ug0oyp1i4buhsv@fx62.mshome.net... >> On Fri, 05 Sep 2008 10:52:23 +0100, AlmostBob <anonymous1@microsoft.com> >> wrote: >> >>> disks are magnetic powder on a metal plate, there is magnetism after the >>> file pointers are removed, until some other magnetic pattern is written >>> on >>> that spot. >>> memory sticks are not magnetic, there is not much to reclaim from a ram >>> chip >> >> Nonsense. The reason the data is left on the disk is it's not touched. >> Only the index is. The same happens with chips. >> >> P.S. sorry the rest is snipped, but you put your sig above the quoted >> text. >> > "Some file systems are designed to distribute usage over an entire memory > device without concentrating usage on any part (e.g., for a directory); this > prolongs life of simple flash memory devices. USB flash drives, however, > have this functionality built into the controller to maximise device life, > and use of such a file system brings no advantage" > from http://en.wikipedia.org/wiki/USB_flash_drive > > If the file system remaps data to maximise device life, > perhaps the forensic software, which is linking to the next 'cluster', > for want of better word, > to undelete > may be mapped to a different data area than the original file was mapped to, > each time it runs getting a different response. Ahhhhh! That makes sense. Thanks. So the act of deleting a file form one cluster causes it to do a re-distribution of everything else? Or does it do this in the background while it's powered up? -- http://www.petersparrots.com http://www.insanevideoclips.com http://www.petersphotos.com At the end of a tiny deserted bar is a huge scouse bloke - 6ft 5in tall and 350lbs. He's having a few beers, when a short, well dressed and obviously gay man walks in and sits beside him. After 3 or 4 beers, the gay fella finally plucks up the courage to say something to the big Liverpudlian. Leaning over, he cups his huge ear. "Do you want a blow job?" he whispers. At this, the massive Merseysider leaps up with fire in his eyes and smacks the man in the face, knocking him off the stool, he proceeds to beat him all the way out of the bar. Finally he leaves him, badly bruised, in the car park and returns to his seat as if nothing had happened. Amazed the bartender quickly brings over another beer. "I've never seen you react like that" he says. "Just what did he say to you?" "I'm not sure" the big scouser replies." Something about a job."
Recommended Posts