Emergency file recovery requires more than the correct tool, though. It requires knowing how file deletion occurs, and what you have to do to maximize the chances of a successful recovery.
When a file is deleted from your computer, its contents aren’t immediately destroyed. Windows simply marks the hard drive space as being available for use by changing one character in the file table so that the file entry won’t be displayed in My Computer or a commandline DIR command, etc. If you manage to start an undeletion process before Windows uses that part of the hard drive to write a new file, all you have to do is set that flag back to “on,” and you get the file. Pretty cool, yeah?
Obviously, the sooner you try to restore a file, the more successful you’ll be. But stop a moment and think about the other things that could cause this part of the hard drive to be overwritten. If your hard drive is pretty full, the odds are much greater that Windows will grab your precious unallocated space for its next write. Or, if you defrag the hard drive, you run the risk of unused parts of the drive being overwritten! (This also means that if you are running silent background defrag services like Diskeeper, or if you have defrag utilities scheduled to defrag automatically, you might get blindsided — lose your chance at data recovery — if you don’t halt them until you have your deleted file recovered.
NOTE: This risk from defragging is not necessarily as severe as I previously thought. For example, on one test with a half-full C: partition, I had 8,926 recoverable files before a defrag, and 8,915 recoverable files after. Nonetheless, it’s a good thing I didn’t want to recover the 11 files that were lost in the process!
For that matter, simply starting up Windows or, to a lesser extent, shutting down Windows causes many tiny files to be written. You really want to avoid these processes if at all possible.
So the first rule is: STOP USING THAT COMPUTER IMMEDIATELY! THIS MINUTE! RIGHT NOW! Use another computer to get the recovery tool you will need.
This is also one of the places where well-planned partitioning of your hard drive has a huge advantage. Partitions physically mark off different parts of the hard drive. If, for example, you have your data and program files on their own separate partitions, and it’s a data file that you want to recover (which is usually the case), then Windows startup or shutdown won’t touch that part of the hard drive. If you have the swapfile / pagefile on its own partition, and all of your directories for temporary files on another, then these most-changing and most-written files also will be kept from overwriting the part of the drive holding the files you want to recover. However, if you take that 80 GB hard drive and make it all one big single C: partition, then you run the risk of making your file unrecoverable anytime the swapfile resizes, or any time Windows writes a temporary file of any kind... and this could be pretty much at any moment whatsoever! Partitioning gives enormous advantage in file recovery.
