Thanks HAN :). Hopefully they will not return whilst I'm at work to finish what they started. Speaking of which.......it's that time again :(.
Printable View
Thanks HAN :). Hopefully they will not return whilst I'm at work to finish what they started. Speaking of which.......it's that time again :(.
Sorry to hear about the incident - I hope the culprits are nabbed.
Nabbed? I'm hoping more along the lines of knee-capped :). Cheers.
I have managed to recover some photo's and files using Recuva and undelete, but the .doc files that my daughter is looking for do not even show up on the scan results.
My next question is, is there a difference between deleting a file, or moving it from one pc to another? In other words, when I move a file from one place to another, does it still exist in both directories and only seen from one? Or, does it completely cease to exist from the original directory?
If the second is the case, then that could explain why the scans do not show the files I am looking for.
Oh, that's a good question...
Deleting a file - the file allocation system basically lops off the last digit. The following is my general understanding...
Myfile.doc becomes Myfile.do and therefore invisable to a typlical user.
It wouldn't surprise me that moving a file removes it from the allocation tables.
crunchie: Don't forget to try PhotoRec. It's my understanding it goes about the recovery routine a bit differently than some of the others.
Undelete + worked very well for me. At http://www.undelete-plus.com/help/
I agree...very good question, and I have no idea what the answer is.Quote:
My next question is, is there a difference between deleting a file, or moving it from one pc to another?
Too late to help you Crunchie, but there are things we all can do: Do a Google search for "How Security Marking Can Help Recover Your Stolen Property"
Also, after a theft, watch for the goods on EBay.
Cheers. I will try to not be caught again. Have every intention of marking all my gear from now on.
Rescue the Files You Need; Wipe Out Those You Don't
by Neil J. Rubenking - 01.02.01
http://www.pcmag.com/article2/0,1759,34259,00.asphttp://www.ontrack.com can retrieve your data 99.99% of the time. What it boils down to though is how much you're willing to spend. The cost can easily run into the thousands.Quote:
...
File Deletion
Regardless of the file system, when you delete a file, Windows doesn't remove the file at all, usually. Instead, the operating system moves the file's directory entry and information about the file's original location into a hidden folder that represents the Recycle Bin. The data clusters for the file aren't deleted or even moved. Only the location of the directory entry changes.
When the Recycle Bin fills up, the oldest files are truly deleted, and when you empty the bin, they're all deleted. Although you can bypass the Recycle Bin by holding down Shift when deleting a file, even then the file's data remains! Under FAT or FAT32, Windows marks the FAT entries for the file's clusters to indicate that they're available for reuse,and then marks the file's directory entry as deleted by changing the first character of the filename to a special flag character.Under NTFS, the process is similar; the file's MFT entry, directory entry, and data clusters are marked as available. The file's data remains, though, until the clusters get recycled [overwritten] to store some other file.
...
Advanced Data Recovery
For a file that can't be recovered by ordinary undelete utilities, there are heavier-duty options available. PowerQuest's Lost & Found is designed to recover data from FAT or FAT32 partitions without even booting the operating system. Ontrack offers a free download of EasyRecovery that will recover up to five files and identify files that the full version could recover; EasyRecovery Pro adds NTFS support. If all else fails, you can contract with a data recovery service; these services can often recover data from disks that have been physically damaged by flood, fire, and so on.
Another Ontrack product, CaptureIt, can be used when a legal proceeding requires access to all the data on a particular computer. CaptureIt makes a byte-for-byte copy of the entire drive at a level below the file system. This copy can be stored on a server, digitally signed to prevent modification, and thoroughly analyzed. The computer itself can remain in service, instead of being sequestered as evidence for the duration of the proceeding.
Once the disk clusters that were occupied by a deleted file have been overwritten with new data, the file is gone forever. Or is it? In fact, the old data may still be present on the magnetic media, as a kind of wiggle in the waveforms that represent the data. Using intricate, high-tech equipment, technicians first copy the exact waveform recorded on an area of the disk, without translating the signal into bits and bytes. They then generate a perfect waveform representing the corresponding data bits, subtract the perfect waveform from the actual waveform, and amplify the differences. When successful, this process recovers the data previously stored in the specified area of the disk (Figure 4). Theoretically, you can even repeat the process, obtaining yet an earlier chunk of data. Physical limitations preclude more than seven repetitions of the recovery process. That doesn't mean you can recover seven layers of data, only that you can't recover more than seven. This level of recovery must be performed by experts, and is painstaking and expensive. In most cases, recreating the lost data from scratch is more cost-effective.
...
The author of the above article is making more mess, than good in his explanation.
He says:
Computer never "truly delete" (whatever "truly" means) any file, but as the author says by himself:Quote:
When the Recycle Bin fills up, the oldest files are truly deleted, and when you empty the bin, they're all deleted.
Quote:
and then marks the file's directory entry as deleted by changing the first character of the filename to a special flag character.
I do get what you're driving at but, which adverb should he have used?When you delete a file in Windows, it simply sends it to the Recycle Bin. When the Recycle Bin gets full, the oldest files are then ______ deleted.(Insert which adverb meaning not recoverable by Windows). :confused:
:)
Maybe not adverb at all...just "deleted".
Saying "truly deleted" sounds like some special kind of delete, so files are gone for good...
It must be "some special kind of delete" because the normal [Right-click] | select "Delete" action simply moves the file to the Recycle Bin. The file is not truly gone until it has been removed from the Recycle Bin.
:)