Gordon Woolf's Blog

That deleted file can live again

The mysteries of 'Previous Versions' in Windows 7

I just deleted a document and photo I desperately need. And I've rebooted since so they are not in the Recycle Bin. Can I get them back?

Who just said "No"?

That ain't so. If you are using Windows 7 and had read this article, the answer is almost certainly "Yes!"

There's a thing that Microsoft generally doesn't say much about, called "Previous versions", or, in technical circles it’s known as “shadow copies”.

And there may be a reason they say little, although that is not a reason why you should not add it to your backup arsenal. It is part of the system restore setup and system restore has an annoying habit of occasionally switching itself off. So every now and again, especially after any system changes, just check the settings detailed below to make sure everything is still as it should be.

First click on your start icon, then right click on Computer and select Properties. In the left-hand pane select System protection (you may be prompted for administrator permission) and then click on the drive where you keep your data files and then click on the Configure button. To turn on the ability to restore previous versions click the item which states "Restore system settings and previous versions of files". Then click OK.

This will create backups of changed files on that disk whenever there is a system restore point created. That will usually be once a day or when you install a program or when you tell the system to do so.

If you only have one drive then this setting will be turned on by default but there is advice around which tells users to turn off system restore for drives other than C:

What is the downside of having this setting turned on? It takes space and on a slow computer it can slow things at critical times but on the whole Windows 7 handles system tasks, even indexing, far better than earlier forms of Windows. Basically if you can use Win7 efficiently on your computer you will not notice anything extra going on.

The amount of extra space used is controllable from the dialog box mentioned above using a slider. As you increase the percentage used, you will also have bigger backups (and this is not a substitute for regular backups). But space, in the terms of bigger drives is now cheaper than it has ever been. I now regard a 500GB drive as an annual running expense.

In future when you right-click on a file or folder you will see an option to "Restore previous versions" and that will give you a dialog listing all the previous versions available. Select one.

If the file you want has been deleted, then right-click the folder it was in and select "Restore previous versions" and you will get the choice of previous versions of the folder. Double-click a version of the folder which would have contained the file. You will not want to restore the whole lot but you can select an individual file and drag it to another location, such as the desktop.

If you can't remember the name of the file, you can use the search box or select another view of the folder such as by date. To avoid confusion the OS adds a timestamp to the name if it is a previous version.

And if you double-click a previous version of a file it will open in whatever the default editing program is and you can edit it and resave to wherever you want ... or just abandon it if it is not what you want. You cannot just save it back to the previous-version folder, which makes sense if you think about it.

There are some known problems between System restore and Norton's "Product tamper protection" but they mainly interfere with full restoration rather than single file restore. However turning off system restore is one of the common actions of malware so if you think you may have been attacked, check the settings.

An easy way to check the settings is to create a new shortcut on your desktop. Right click any open space on the desktop and click on New and then on Shortcut. In the dialog which opens type in the following:
control.exe sysdm.cpl,@0,4

Now click Next and give the shortcut a name. I suggest: Check system restore

Clicking on that shortcut will open the box which shows what disks have system restore switched on and in the bottom right is a button to create a new system restore point.

System restore only works with disks formatted as NTFS, not FAT32, disks must be larger than 1GB and must have at least 300MB of free space. As new restore points with these shadow copies are created so the existing oldest ones will be deleted. They are temporary. For real security you still need a full backup system in place.

The biggest gotcha is that if you have a dual boot system, then starting another version of Windows will delete any restore points created by the previously running version of Windows. Going back to Win7 should start the creation of restore points again but the old ones will be gone. Similarly, using Disk Cleanup to remove old restore points will also remove the previous versions of files.

The methods described here will also work in the Business and Ultimate versions of Vista but they apply to all versions of Windows 7. The technology on which it is based has been part of NTFS formatting and Windows Server operating systems since 2003. That may help explain why, in larger organisations, the individual right to turn this service on may be restricted.

This article first appeared in PC Update, the magazine of the Melbourne PC User Group for September 2011

Is the future in The Cloud?

It was only a few years ago that Bill Gates and others were promoting the always-connected theme and even formed an always-on association to promote the idea of never turning your computer off; computer manufacturers were encouraged to not have a power switch, just a button which could leave the computer able to wake up on a call from the local or wide area network.

At the time I was not only sceptical but wrote articles pointing out the cost to the economy of wasted power usage and dangers from hackers having that always-on access to millions of computers.

They trashed the always-on promotion in response to pressure worldwide and most computers got their on/off switch back. But what they forecast has happened.

I still switch my computers off overnight, but the modem/router stays connected so we can still make and receive VOIP calls and the PCs immediately reconnect to the Internet when they are switched on.

A recent trip reminded me that there are large areas of this country where there are no Internet connections (nor mobile or cell phone coverage) because there are so few people, and where it exists outside capital cities and so the idea of working in the cloud is impossible.

I was wrong the first time. Maybe not this time as I've changed sides. We need better connections outside major cities before it can happen, and probably need a better and smaller way of satellite connection so mobile country connections can be usable and affordable for travellers (a permanent outback resident can opt for a satellite connection now and most large farms/cattle stations etc, even some communities, already have them).

The cloud does make sense, but to be usable outside of city centres it needs technological advances that, in my view, put it at least 3 to 5 years away.

Changes in the way data is stolen

Some interesting facts in the latest Verizon Data Breach Investigations Report, which, for the first time, for 2010, was a joint report by Verizon and the US Secret Service.

This applies only to breaches within the USA of course, but there are still some lessons for us all.

Firstly, of 84 "confirmed breaches of data security" investigated by the US Secret Service, 66% led to arrests. Not all got the publicity of Albert Gonzalez who was sent to jail for 20 years in March this year for stealing more than 90 million credit and debit card numbers. In fact some received no publicity at all as the companies from which the data was stolen were loathe to have their problems revealed.

Most thefts happened in-house: rogue employees such as programmers were involved in nearly half the cases, but they involved only 3% of the records stolen. In other words, the inside jobs were amall jobs. But the report warned about outsourcing:  "Organizations that outsource their IT management and support also outsource a great deal of trust to these partners."

And there was not a single case involving a foreign government.

SQL database queries were used in more than half the cases: programmed queries that pluck data from the system and send it to the requester. This is a bit like the queries you can set up in Access or the old DBase. It seems to mean that the real problem is in the programming used by a vast majority of businesses.

Keyloggers, the programs that record what users are entering via the keyboard, and which can be hidden in other programs or installed without the user's knowledge from compromised websites, and which are often used to scare users, accounted for only 1% of the stolen data -- down from 80% the year before. So the bad guys have found better ways to steal the info.

And what of the other big scare tactic: keep updating or you'll compromise your computer? Well, Verizon and the Secret Service could not come up with a single case which "exploited a patchable vulnerability."

One wonders however whether companies are keeping as close a watch on their data as we might reasonable expect. The report states: "Third-party fraud detection is still the most common way breach victims come to know of their predicament".

As Woody Leonhard states in the Windows Secrets newsletter: "Companies learn of breaches when customers report them. So if you think your data's been stolen, holler yer head off!"

Email: the world will know

One of this country's senior politicians has just found that emails may not be what they seem. In particular a forwarded email may be changed easily before it is forwarded. That should be a warning to everyone who uses email.

To start from the basics: There's a simple Law of Email, which states "Never send anything that you wouldn't want the whole world to know".

They are easy to copy, easy to change, easy to get out of even secure offices since the introduction of USB sticks, which has led some companies to disable the USB ports on their computers, a method which causes more problems than it solves.

Encryption should be used if you are sending confidential information by email, but encryption does not assure security since it has to be decrypted at some stage ("Decryption" rather than the unencryption which I've seen many times). Emails may be decrypted on the main mail server which offers little security within an office.

There are better ways, one of the simplest being to create a PDF of a document, encrypt that and sign it digitally. Warning: simply requiring a password to open a PDF is not securing it; a Google search will reveal programs that will ger around that (which I've needed to do to get an ad into a magazine that was secured by a foolish designer).

If you have this kind of material then you'll need to study the Acrobat help files. There are also some examples of commercial software programs that will make it a simpler task.

On the other hand, there are authors and others who are so scared of someone stealing a single copy of their ebook that they make access difficult for the people who have paid for the file. I would quote from my own experience when running a milk bar/convenience store. If you put a box of lollies on the counter they will sell, but a proportion will be stolen -- move them to the back or anywhere where the customer cannot easily pick them up and they stop selling. There will be a point at which theft is too great but it will always be worth losing a few.

It can also reflect on the trust between a business owner and his customers. In my book Success in Store there are two examples of the relationship between my wife and some local high school students who came regularly for fish and chips. In the first, they left wrappers and cans by the seats on the footpath until one of them saw my wife go out to clean up their mess as they left. "Do you have to do that?" one asked. No one else will do it, she said, and from that day there was no more mess; everything went in the bins.

Similarly, a sheepish youngster returned to hold out a confectionary packet, saying he'd forgotten to pay. Next day one of the other students asked if he'd returned to pay. "He told us on the way back to school and we said 'you don't do that there'."

Fair dealing will do a lot to reduce problems of theft but that does not help with the general continued availability of email and its likelihood to spread far beyond its original intended use.

A recent search for my name in Google, and going far beyond the first two or three pages where most of us stop searching, came up with an email I wrote in 1996 which is 13 years ago, long before the Internet was anything like it is today, and in the earliest days of the web when many exagerated claims were being made about "hits" on web sites. If you are interested, that email is at http://open4success.net/Olnews/mbox2/282.html

That was not the start of email for me as I'd already been using it for the best part of a decade; at that time the problem was that there were not many people you could send emails to but I did use an email-to-telex service to submit articles to some publishers.

In all that time, there have been regular warnings that normal email is the least secure communications system of all. At least with phone recordings you can be fairly sure that what is heard is what you said, and there are legal safeguards on what can be used. With email, forgery is simple, and preservation and distribution is even more simple.
 

Can deleted files be recovered?

When someone asks me whether deleted files can be recovered, I have to ask why he or she wants to know. The reason is that sometimes the questioner wants to be able to because it is a file they've deleted in error and want to get it back, and sometimes it is because they want to give away or trade in a computer and do not want anyone to recover the files. To the first type of question I can be encouraging. If the file has just been deleted and few other changes have been made, there's a good chance that some of the readily available recovery software will work. Normally deleting a file does not destroy the file, it just marks the main index entry as being ready for the space to be reused. Get in quick and it just needs the first character of the file name to be resored to what it was and you may have the file back. If you just deleted it and use the recycle bin or trash can according to operating system, it is even easier, though I would not recommend the method of one office worker I heard of who cleared the desktop for a new task by just dragging everything to the recycle bin, to bring back when needed. Not a good idea. On the other hand, if you want to delete everything because you are worried that your nephew to whom you are giving the computer will find something incriminating, then by all means use some of the deletion software that is around which will just write over each file with random zeros and ones of binary code. If on the other hand you are really worried, then perhaps you should know that one of the reasons hackers can recover old files is that the alignment of heads on drives changes slightly over time. It used to be a major problem with floppy disks (well, it still affects floppies but we've stopped using them so it ceased to be a problem for most of us). You can rewrite as much as you like but if the alignment of the head has changed there could be a tiny sliver of the old file peeping out at the edge of the track. Of course, provided you are not of interest to the security agencies of your own or another country or to major crime syndicates it is very unlikely you need worry about this problem, at least for a few years. If anyone feels a need to really santize hard drives beyond the simple overwriting software I'd still suggest that destruction, with a hammer and hacksaw and deposition of the parts of platters in separate rubbish systems is more than sufficient. Then buy a new or even a secondhand hard drive -- the latter will ensure you are distributing someone else's problems.