Gordon Woolf's Blog

Where did that file disappear to?

After my previous post on whether deleted files are really deleted, I was asked about the opposite: how do I recover a file which has "just disappeared"? The obvious first actions are to look in other places where you often keep files, in the "My Recent Documents" list in Windows start menu, and in the recycle bin or trash can. In all cases remember that the one piece of information you have for certain is approximately when you last worked on the file, so if you sort the files into date order from the most recent it should be near the top. What I've found A few times is that files do not have the name the user thought they had. It is also possible to look for temporary files and there's a great overall guide in the Microsoft knowledgebase at http://support.microsoft.com/kb/827099 which may also be useful to those using programs other than Word.

Can deleted files be recovered?

When someone asks me whether deleted files can be recovered, I have to ask why he or she wants to know. The reason is that sometimes the questioner wants to be able to because it is a file they've deleted in error and want to get it back, and sometimes it is because they want to give away or trade in a computer and do not want anyone to recover the files. To the first type of question I can be encouraging. If the file has just been deleted and few other changes have been made, there's a good chance that some of the readily available recovery software will work. Normally deleting a file does not destroy the file, it just marks the main index entry as being ready for the space to be reused. Get in quick and it just needs the first character of the file name to be resored to what it was and you may have the file back. If you just deleted it and use the recycle bin or trash can according to operating system, it is even easier, though I would not recommend the method of one office worker I heard of who cleared the desktop for a new task by just dragging everything to the recycle bin, to bring back when needed. Not a good idea. On the other hand, if you want to delete everything because you are worried that your nephew to whom you are giving the computer will find something incriminating, then by all means use some of the deletion software that is around which will just write over each file with random zeros and ones of binary code. If on the other hand you are really worried, then perhaps you should know that one of the reasons hackers can recover old files is that the alignment of heads on drives changes slightly over time. It used to be a major problem with floppy disks (well, it still affects floppies but we've stopped using them so it ceased to be a problem for most of us). You can rewrite as much as you like but if the alignment of the head has changed there could be a tiny sliver of the old file peeping out at the edge of the track. Of course, provided you are not of interest to the security agencies of your own or another country or to major crime syndicates it is very unlikely you need worry about this problem, at least for a few years. If anyone feels a need to really santize hard drives beyond the simple overwriting software I'd still suggest that destruction, with a hammer and hacksaw and deposition of the parts of platters in separate rubbish systems is more than sufficient. Then buy a new or even a secondhand hard drive -- the latter will ensure you are distributing someone else's problems.