Undeleting / recovering a file

[Guest Peter Hucker]

In DOS and Windows 3.1, if you deleted a file, you could just undelete it again, as long as you hadn't written to that portion of the disk. What has happened in Windows XP which prevents this?

 

I was given a USB memory stick, the owner had deleted the wrong file, and wanted it back. I tried 6 different recovery utilities, one said the file was "overwritten", the others said "poor". The most they recovered was the heading of the word document (it was 7 pages of text).

 

So I tried a test, I got my own USB stick, copied a couple of images and a word document to it, then deleted them. Then I immediately tried to recover the three files. None of the 6 utilities got any of them back. Why???

 

--

http://www.petersparrots.com http://www.insanevideoclips.com http://www.petersphotos.com

[Guest Dan]

RE: Undeleting / recovering a file

 

I use Restoration 3.2.13 to recover deleted files, but I don't think it

supports network or external drives (or disks). I don't think most recovery

software support those types of media. But I could be way off base!

 

"Peter Hucker" wrote:

> In DOS and Windows 3.1, if you deleted a file, you could just undelete it again, as long as you hadn't written to that portion of the disk. What has happened in Windows XP which prevents this?

>

> I was given a USB memory stick, the owner had deleted the wrong file, and wanted it back. I tried 6 different recovery utilities, one said the file was "overwritten", the others said "poor". The most they recovered was the heading of the word document (it was 7 pages of text).

>

> So I tried a test, I got my own USB stick, copied a couple of images and a word document to it, then deleted them. Then I immediately tried to recover the three files. None of the 6 utilities got any of them back. Why???

>

> --

> http://www.petersparrots.com http://www.insanevideoclips.com http://www.petersphotos.com

>

[Guest Peter Hucker]

Re: Undeleting / recovering a file

 

I found several which claimed to specialise in removable media. They did not work. How can a file that's just been deleted possibly be unrecoverable?

 

 

On Thu, 04 Sep 2008 03:05:00 +0100, Dan <Dan@discussions.microsoft.com> wrote:

> I use Restoration 3.2.13 to recover deleted files, but I don't think it

> supports network or external drives (or disks). I don't think most recovery

> software support those types of media. But I could be way off base!

>

> "Peter Hucker" wrote:

>

>> In DOS and Windows 3.1, if you deleted a file, you could just undelete it again, as long as you hadn't written to that portion of the disk. What has happened in Windows XP which prevents this?

>>

>> I was given a USB memory stick, the owner had deleted the wrong file, and wanted it back. I tried 6 different recovery utilities, one said the file was "overwritten", the others said "poor". The most they recovered was the heading of the word document (it was 7 pages of text).

>>

>> So I tried a test, I got my own USB stick, copied a couple of images and a word document to it, then deleted them. Then I immediately tried to recover the three files. None of the 6 utilities got any of them back. Why???

 

--

http://www.petersparrots.com http://www.insanevideoclips.com http://www.petersphotos.com

 

The success of the "Wonder Bra" for under-endowed women has encouraged the designers to come out with a bra for over-endowed women.

It's called the "Sheep Dog Bra"- it rounds them up and points them in the right direction.

[Guest Sergey Wasilenkow]

Re: Undeleting / recovering a file

 

> So I tried a test, I got my own USB stick, copied a couple of images and a word document to it, thendeletedthem.  Then I immediately tried torecoverthe threefiles.  None of the 6 utilities got any of them back.  Why???

 

You can also try to recover your Word document with Easy File Undelete

software:

 

http://www.munsoft.com/EasyFileUndelete/

 

It uses unique modern algorithms to recover files that other software

either recovers incorrectly or is unable to detect.

[Guest AlmostBob]

Re: Undeleting / recovering a file

 

disks are magnetic powder on a metal plate, there is magnetism after the

file pointers are removed, until some other magnetic pattern is written on

that spot.

memory sticks are not magnetic, there is not much to reclaim from a ram chip

 

 

--

Adaware http://www.lavasoft.de

spybot http://www.safer-networking.org

AVG free antivirus http://www.grisoft.com

Etrust/Vet/CA.online Antivirus scan

http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

Panda online AntiVirus scan http://www.pandasoftware.com/ActiveScan/

Catalog of removal tools (1)

http://www.pandasoftware.com/download/utilities/

Catalog of removal tools (2)

http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?CID=40387

Blocking Unwanted Parasites with a Hosts file

http://mvps.org/winhelp2002/hosts.htm

links provided as a courtesy, read all instructions on the pages before use

 

Grateful thanks to the authors and webmasters

_

 

"Peter Hucker" <none@spam.com> wrote in message

news:op.ugyvt5jm4buhsv@fx62.mshome.net...

>I found several which claimed to specialise in removable media. They did

>not work. How can a file that's just been deleted possibly be

>unrecoverable?

>

>

> On Thu, 04 Sep 2008 03:05:00 +0100, Dan <Dan@discussions.microsoft.com>

> wrote:

>

>> I use Restoration 3.2.13 to recover deleted files, but I don't think it

>> supports network or external drives (or disks). I don't think most

>> recovery

>> software support those types of media. But I could be way off base!

>>

>> "Peter Hucker" wrote:

>>

>>> In DOS and Windows 3.1, if you deleted a file, you could just undelete

>>> it again, as long as you hadn't written to that portion of the disk.

>>> What has happened in Windows XP which prevents this?

>>>

>>> I was given a USB memory stick, the owner had deleted the wrong file,

>>> and wanted it back. I tried 6 different recovery utilities, one said

>>> the file was "overwritten", the others said "poor". The most they

>>> recovered was the heading of the word document (it was 7 pages of text).

>>>

>>> So I tried a test, I got my own USB stick, copied a couple of images and

>>> a word document to it, then deleted them. Then I immediately tried to

>>> recover the three files. None of the 6 utilities got any of them back.

>>> Why???

>

> --

> http://www.petersparrots.com http://www.insanevideoclips.com

> http://www.petersphotos.com

>

> The success of the "Wonder Bra" for under-endowed women has encouraged the

> designers to come out with a bra for over-endowed women.

> It's called the "Sheep Dog Bra"- it rounds them up and points them in the

> right direction.

[Guest Peter Hucker]

Re: Undeleting / recovering a file

 

On Fri, 05 Sep 2008 10:52:23 +0100, AlmostBob <anonymous1@microsoft.com> wrote:

> disks are magnetic powder on a metal plate, there is magnetism after the

> file pointers are removed, until some other magnetic pattern is written on

> that spot.

> memory sticks are not magnetic, there is not much to reclaim from a ram chip

 

Nonsense. The reason the data is left on the disk is it's not touched. Only the index is. The same happens with chips.

 

P.S. sorry the rest is snipped, but you put your sig above the quoted text.

 

--

http://www.petersparrots.com http://www.insanevideoclips.com http://www.petersphotos.com

 

You know, sometimes I get the sudden urge to run around naked.

But then I just drink some Windex. It keeps me from streaking.

[Guest AlmostBob]

Re: Undeleting / recovering a file

 

 

 

 

_

 

"Peter Hucker" <none@spam.com> wrote in message

news:op.ug0oyp1i4buhsv@fx62.mshome.net...

> On Fri, 05 Sep 2008 10:52:23 +0100, AlmostBob <anonymous1@microsoft.com>

> wrote:

>

>> disks are magnetic powder on a metal plate, there is magnetism after the

>> file pointers are removed, until some other magnetic pattern is written

>> on

>> that spot.

>> memory sticks are not magnetic, there is not much to reclaim from a ram

>> chip

>

> Nonsense. The reason the data is left on the disk is it's not touched.

> Only the index is. The same happens with chips.

>

> P.S. sorry the rest is snipped, but you put your sig above the quoted

> text.

>

> --

> http://www.petersparrots.com http://www.insanevideoclips.com

> http://www.petersphotos.com

>

> You know, sometimes I get the sudden urge to run around naked.

> But then I just drink some Windex. It keeps me from streaking.

 

"Some file systems are designed to distribute usage over an entire memory

device without concentrating usage on any part (e.g., for a directory); this

prolongs life of simple flash memory devices. USB flash drives, however,

have this functionality built into the controller to maximise device life,

and use of such a file system brings no advantage"

from http://en.wikipedia.org/wiki/USB_flash_drive

 

If the file system remaps data to maximise device life,

perhaps the forensic software, which is linking to the next 'cluster',

for want of better word,

to undelete

may be mapped to a different data area than the original file was mapped to,

each time it runs getting a different response.

 

 

 

--

Adaware http://www.lavasoft.de

spybot http://www.safer-networking.org

AVG free antivirus http://www.grisoft.com

Etrust/Vet/CA.online Antivirus scan

http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

Panda online AntiVirus scan http://www.pandasoftware.com/ActiveScan/

Catalog of removal tools (1)

http://www.pandasoftware.com/download/utilities/

Catalog of removal tools (2)

http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?CID=40387

Blocking Unwanted Parasites with a Hosts file

http://mvps.org/winhelp2002/hosts.htm

links provided as a courtesy, read all instructions on the pages before use

 

Grateful thanks to the authors and webmasters

[Guest Peter Hucker]

Re: Undeleting / recovering a file

 

On Fri, 05 Sep 2008 23:19:19 +0100, AlmostBob <anonymous1@microsoft.com> wrote:

> "Peter Hucker" <none@spam.com> wrote in message

> news:op.ug0oyp1i4buhsv@fx62.mshome.net...

>> On Fri, 05 Sep 2008 10:52:23 +0100, AlmostBob <anonymous1@microsoft.com>

>> wrote:

>>

>>> disks are magnetic powder on a metal plate, there is magnetism after the

>>> file pointers are removed, until some other magnetic pattern is written

>>> on

>>> that spot.

>>> memory sticks are not magnetic, there is not much to reclaim from a ram

>>> chip

>>

>> Nonsense. The reason the data is left on the disk is it's not touched.

>> Only the index is. The same happens with chips.

>>

>> P.S. sorry the rest is snipped, but you put your sig above the quoted

>> text.

>>

> "Some file systems are designed to distribute usage over an entire memory

> device without concentrating usage on any part (e.g., for a directory); this

> prolongs life of simple flash memory devices. USB flash drives, however,

> have this functionality built into the controller to maximise device life,

> and use of such a file system brings no advantage"

> from http://en.wikipedia.org/wiki/USB_flash_drive

>

> If the file system remaps data to maximise device life,

> perhaps the forensic software, which is linking to the next 'cluster',

> for want of better word,

> to undelete

> may be mapped to a different data area than the original file was mapped to,

> each time it runs getting a different response.

 

Ahhhhh! That makes sense. Thanks.

 

So the act of deleting a file form one cluster causes it to do a re-distribution of everything else? Or does it do this in the background while it's powered up?

 

--

http://www.petersparrots.com http://www.insanevideoclips.com http://www.petersphotos.com

 

At the end of a tiny deserted bar is a huge scouse bloke - 6ft 5in tall and 350lbs. He's having a few beers, when a short, well dressed and obviously gay man walks in and sits beside him.

After 3 or 4 beers, the gay fella finally plucks up the courage to say something to the big Liverpudlian.

Leaning over, he cups his huge ear. "Do you want a blow job?" he whispers.

At this, the massive Merseysider leaps up with fire in his eyes and smacks the man in the face, knocking him off the stool, he proceeds to beat him all the way out of the bar.

Finally he leaves him, badly bruised, in the car park and returns to his seat as if nothing had happened.

Amazed the bartender quickly brings over another beer. "I've never seen you react like that" he says. "Just what did he say to you?"

"I'm not sure" the big scouser replies." Something about a job."