General Windows Questions and Problem Solving

  • Thread starter Matej
  • 7 comments
  • 505 views
Matej

Matej

Premium
2,002
Croatia
Zagreb
You can use this thread to ask a question about the system or find a solution to a problem you may have encountered while using Windows. The computers are complicated machines, so any help is appreciated! :)

I'll start first:

When you empty recycle bin, where do all the files go to? I would like to restore a file that accidentally got deleted with a recovery file program, but on a different computer because it works better for these type of programs. So if I know where all the left-off pieces are stored, I could transfer them and do the recovery on that other PC.
 
When you delete any file.
All you really do is mark those sectors used by that file as "Free" so any data recovery program can recover them.
So the files can be stored anywhere on the drive, it depends on where the file system decided to place them.

BUT NOTE: as soon as these sectors are written to by the file system, any chance of recovering files reduces to near 0.
If you want to perform a data recovery it is best that you remove the drive from the system and mount it as "Read Only".

If the files were on the C:\ Drive of the computer you're using stop using it and remove the drive and perform a recovery.
 
Matej
How can you avoid writing on these sectors? By not deleting anything until you restore your file?
Click to expand...

You can avoid it by not doing anything at all that results in disk writes. This includes powering the machine up.

If it's really urgent to recover deleted files, remove the drive and send it to a data recovery service along with a check with many zeroes.

When you delete a file or empty the recycle bin (which amounts to the same thing) the sectors are marked as available and added to the pool of free sectors. When the system writes to the disk, it allocates sectors from this free sector pool. There is no user-level way to determine exactly which sectors will be allocated from the free sector pool. Also note that although the data will still be in the unused sectors until overwritten (which could be a month from now or two seconds from now), there are no pointers to which of the possibly millions of free sectors have the data in question, or the order of the sectors.

This is why data recovery services are expensive and not guaranteed to work.
 
BobK
There is no user-level way to determine exactly which sectors will be allocated from the free sector pool.
Click to expand...

IIRC NTFS uses the first sector marked as free.

But I cant find the source to support this.
But It would make sense since NTFS does get fragmented very quickly.
 
The only way you could feasibly ensure the freed up sectors aren't immediately overwritten would be to instantly hard power off the computer and yank the drive. This is because the OS will undoubtedly be doing something in the next few seconds which will write to the hard drive (defragging, pagefile etc) and could use that space.

It's much easier to recover stuff from secondary or external storage because the OS isn't constantly fiddling with them. Obviously the best way is to not get into the situation in the first place with backups or an Apple Time Machine esque system which allows you to undo file actions.
 
I use get data back it is more advanced, but it has the ability to to quick scans as well as a deep scan.
 

Latest Posts

Back