How to: recover a lost file

Crashes vary in severity, but you can often recover lost data. Here's how

TODO alt text

Sooner or later you'll lose data, even if you have the best back-up strategy in the world. Thankfully, all is rarely completely lost should your data get mangled. In most cases there are steps you can take to recover some, most, or all of the missing bits and bytes.

Data loss falls into three broad categories: physical damage to media, accidental deletion, or data corruption. An independent backup will normally negate all of these, as long as it hasn't befallen the same fate as the original.

Curiously enough, it's often people who think that they have the most bulletproof back-up regimes who suffer most when data loss occurs. Complacency can creep in and wreak havoc. Be especially wary of solutions like RAID for a desktop. While certain variants can ensure your data will survive hard drive failure, the more common scenario of accidental deletion might not be covered.

Windows includes its own fail safe against accidental deletion in the Recycle Bin. The problem is that most users know that stuff in the bin has effectively just been put to one side, so they regularly empty it. However, what if it's just been emptied and then you remember a file that you really should have kept? In most cases a simple undelete utility is all you need to save your skin.

Not-so-permanent deletion

When you delete a file from your hard disk you may think that the file is physically deleted. This isn't actually the case. To speed up performance, Windows replaces the first few bytes of the file with a flag that tells it that the space currently occupied by the file is up for grabs. The file vanishes from Windows, but until that space is filled by another file, the original file's contents remain intact.

How long that file remains available for retrieval is an inexact science. Some can be recovered months or even years after they were originally deleted, while others might be overwritten in days or even hours.

If the file is fragmented then you may find parts of it remain while others have been overwritten. Generally, the longer a file has been deleted for, the less likely it is to be recoverable in full. Other factors include the amount of free space and how busy the hard drive is.

Undelete programs can work in slightly different ways, so it's worth trying at least two different utilities to get the data back. This is especially important if you've managed to recover some, but not all, of the file. It's possible that a different algorithm might be able to restore more of the data or uncover different parts of the file.

Some people opt to use a data-shredding program like Eraser to securely delete sensitive files. This overwrites the data to prevent undelete utilities from recovering it. If the most secure settings are used to delete a file, you won't be able to get it back. Some professional services are able to reconstruct data after overwriting, but it's a time consuming and costly process.

Data corruption

Corrupt files can be devastating, depending on which ones they are. A damaged Master Boot Record can render a PC unbootable, but even a relatively benign scrambled Office file can be problematic if the contents are important and the corrupt version has written over the backup. There are ways to get back some or all of a corrupt file, depending on what it is.

Sometimes just opening a corrupt file as plain text can help you find its contents. Browse to the affected file and right-click it. Choose 'Open with… Choose program'. From the list of programs select Notepad. Make sure that the option to always use this program is left clear. Click 'OK'.