Gordon Woolf's Blog

That deleted file can live again

The mysteries of 'Previous Versions' in Windows 7

I just deleted a document and photo I desperately need. And I've rebooted since so they are not in the Recycle Bin. Can I get them back?

Who just said "No"?

That ain't so. If you are using Windows 7 and had read this article, the answer is almost certainly "Yes!"

There's a thing that Microsoft generally doesn't say much about, called "Previous versions", or, in technical circles it’s known as “shadow copies”.

And there may be a reason they say little, although that is not a reason why you should not add it to your backup arsenal. It is part of the system restore setup and system restore has an annoying habit of occasionally switching itself off. So every now and again, especially after any system changes, just check the settings detailed below to make sure everything is still as it should be.

First click on your start icon, then right click on Computer and select Properties. In the left-hand pane select System protection (you may be prompted for administrator permission) and then click on the drive where you keep your data files and then click on the Configure button. To turn on the ability to restore previous versions click the item which states "Restore system settings and previous versions of files". Then click OK.

This will create backups of changed files on that disk whenever there is a system restore point created. That will usually be once a day or when you install a program or when you tell the system to do so.

If you only have one drive then this setting will be turned on by default but there is advice around which tells users to turn off system restore for drives other than C:

What is the downside of having this setting turned on? It takes space and on a slow computer it can slow things at critical times but on the whole Windows 7 handles system tasks, even indexing, far better than earlier forms of Windows. Basically if you can use Win7 efficiently on your computer you will not notice anything extra going on.

The amount of extra space used is controllable from the dialog box mentioned above using a slider. As you increase the percentage used, you will also have bigger backups (and this is not a substitute for regular backups). But space, in the terms of bigger drives is now cheaper than it has ever been. I now regard a 500GB drive as an annual running expense.

In future when you right-click on a file or folder you will see an option to "Restore previous versions" and that will give you a dialog listing all the previous versions available. Select one.

If the file you want has been deleted, then right-click the folder it was in and select "Restore previous versions" and you will get the choice of previous versions of the folder. Double-click a version of the folder which would have contained the file. You will not want to restore the whole lot but you can select an individual file and drag it to another location, such as the desktop.

If you can't remember the name of the file, you can use the search box or select another view of the folder such as by date. To avoid confusion the OS adds a timestamp to the name if it is a previous version.

And if you double-click a previous version of a file it will open in whatever the default editing program is and you can edit it and resave to wherever you want ... or just abandon it if it is not what you want. You cannot just save it back to the previous-version folder, which makes sense if you think about it.

There are some known problems between System restore and Norton's "Product tamper protection" but they mainly interfere with full restoration rather than single file restore. However turning off system restore is one of the common actions of malware so if you think you may have been attacked, check the settings.

An easy way to check the settings is to create a new shortcut on your desktop. Right click any open space on the desktop and click on New and then on Shortcut. In the dialog which opens type in the following:
control.exe sysdm.cpl,@0,4

Now click Next and give the shortcut a name. I suggest: Check system restore

Clicking on that shortcut will open the box which shows what disks have system restore switched on and in the bottom right is a button to create a new system restore point.

System restore only works with disks formatted as NTFS, not FAT32, disks must be larger than 1GB and must have at least 300MB of free space. As new restore points with these shadow copies are created so the existing oldest ones will be deleted. They are temporary. For real security you still need a full backup system in place.

The biggest gotcha is that if you have a dual boot system, then starting another version of Windows will delete any restore points created by the previously running version of Windows. Going back to Win7 should start the creation of restore points again but the old ones will be gone. Similarly, using Disk Cleanup to remove old restore points will also remove the previous versions of files.

The methods described here will also work in the Business and Ultimate versions of Vista but they apply to all versions of Windows 7. The technology on which it is based has been part of NTFS formatting and Windows Server operating systems since 2003. That may help explain why, in larger organisations, the individual right to turn this service on may be restricted.

This article first appeared in PC Update, the magazine of the Melbourne PC User Group for September 2011

Can deleted files be recovered?

When someone asks me whether deleted files can be recovered, I have to ask why he or she wants to know. The reason is that sometimes the questioner wants to be able to because it is a file they've deleted in error and want to get it back, and sometimes it is because they want to give away or trade in a computer and do not want anyone to recover the files. To the first type of question I can be encouraging. If the file has just been deleted and few other changes have been made, there's a good chance that some of the readily available recovery software will work. Normally deleting a file does not destroy the file, it just marks the main index entry as being ready for the space to be reused. Get in quick and it just needs the first character of the file name to be resored to what it was and you may have the file back. If you just deleted it and use the recycle bin or trash can according to operating system, it is even easier, though I would not recommend the method of one office worker I heard of who cleared the desktop for a new task by just dragging everything to the recycle bin, to bring back when needed. Not a good idea. On the other hand, if you want to delete everything because you are worried that your nephew to whom you are giving the computer will find something incriminating, then by all means use some of the deletion software that is around which will just write over each file with random zeros and ones of binary code. If on the other hand you are really worried, then perhaps you should know that one of the reasons hackers can recover old files is that the alignment of heads on drives changes slightly over time. It used to be a major problem with floppy disks (well, it still affects floppies but we've stopped using them so it ceased to be a problem for most of us). You can rewrite as much as you like but if the alignment of the head has changed there could be a tiny sliver of the old file peeping out at the edge of the track. Of course, provided you are not of interest to the security agencies of your own or another country or to major crime syndicates it is very unlikely you need worry about this problem, at least for a few years. If anyone feels a need to really santize hard drives beyond the simple overwriting software I'd still suggest that destruction, with a hammer and hacksaw and deposition of the parts of platters in separate rubbish systems is more than sufficient. Then buy a new or even a secondhand hard drive -- the latter will ensure you are distributing someone else's problems.