Recover lost or deleted files on your PC

Whether you've accidentally deleted your files, run format on something you shouldn't have or, Flying Spaghetti Monster forbid, dropped a hard drive, there's still a chance that you can get your data back.

First, a warning: to increase your chances of data recovery, it may be best for you to go for a professional data-recovery company. From Kroll Ontrack's Adrian Briscoe, general manager Asia Pacific:

The first step of data recovery is really with the client. If you suspect data loss or a serious mechanical problem with a hard drive, the first thing to do is to turn the computer or device off. Don't use the device or let "the IT-savvy friend" try to recover data. If the data is really important to you, then the highest chance of a successful recovery is with a professional data-recovery company.

That said, if it's a simple file loss, rather than a hardware failure, then there are things that the user can do if they decide not to opt for professional recovery. It should be said that there's an element of prevention here — if you perform some steps before the disaster ever occurs, then you'll be in a much better place.

Undeleting files

Needless to say, this wouldn't be an issue if you backed up regularly, but, if you're reading this article, it means that you haven't. Still, there's one preventative measure that you should employ right now if you're running on a Windows system.

Install an undelete program.

You see, when you delete a file on Windows, the file isn't actually gone; just the pointer that tells Windows how to find it. The data is left intact, and the space is marked as "empty" and to be overwritten in the future.

Here's the tricky bit: as Windows randomly writes to the disk, it could overwrite a portion of your deleted file, corrupting your data. So you want nothing writing to your disk at all. Browsing a website will write to your disk. Playing a song may very well do it, as Windows remembers your most recent documents.

And so, ironically, installing an undelete program after you've deleted something has a chance of corrupting the data it was intended to undelete. You really need that program installed before you need it.

If you're reading this after a disaster, that puts you in a bad position. Thankfully, there's a workaround: portable versions of the program can be copied to flash drives using another computer, avoiding potentially damaging writes to the hard drive.

On the free side, Recuva is a good place to start for Windows users. For paid tools, we like Runtime's GetDataBack for either NTFS or FAT, which has proven itself reliable many a time. Sadly, Runtime does not cover both file systems in the one program, which is frustrating and expensive if you're running Windows on NTFS, but you want to undelete something from a FAT-formatted USB drive or SD card. It's also significantly more expensive than its competitors, considering its limited capability.

If you're dealing with multiple file systems and operating systems, R-Studio makes more financial sense, not only recovering from significantly more file systems, but also providing Windows, OS X and Linux clients.

By far the most expansive undelete program we've used is UFS Explorer, which, depending on the version used, can recover from myriad file systems and even reconstruct certain RAID 5 set-ups virtually. It also has the major benefit of having Windows, OS X and Linux clients available.

Recovering data from a failed system drive

Great — Windows has failed to start, or has been plagued by a virus. The smartest thing to do is to wipe everything and start again — but how do you get your files off?

The manual way

Your answer is simple: Ubuntu.

Burning an Ubuntu disk (or, indeed, creating a bootable USB drive) can make life a whole lot easier. Once your computer is sent to boot from DVD (or USB), instead of Windows as your operating system, you'll get Ubuntu, which should operate free of the defects that have suddenly crept into your main operating system. There are quite a few differences, but, as an emergency file-recovery desktop, it shouldn't take too long for Windows users to adjust and find what they need.

Also positive is Ubuntu's ability to write to NTFS partitions, not just read them — important to be able to copy files larger than 4GB — and mounting a USB hard drive to back things up to is as easy as plugging the drive in, and waiting for the icon to appear on the desktop.

The automated way

Instead of Ubuntu and manually copying, you could also go to the extreme of imaging your entire hard drive using something like an Acronis True Image bootable DVD, meaning that if you've forgotten to copy a file across in the backup, that image is there for you to extract it from.

There are usually two ways to make an image. The first leaves out "free" space, and as a consequence results in a much smaller image file than the size of your disk — which is fine, if you're not trying to recover deleted data, and just trying to back it up. If you fear for deleted or lost data, though, you're going to have to do a bit-by-bit image, which will take up every bit of space that your hard drive has, file compression aside.

Regardless of what method you try, once you're done, it's time to restart your computer, and format and reinstall Windows, safe in the knowledge that your memories are protected.

What if the hard drive has failed at the hardware level?

While you'll find multiple accounts online about sticking hard drives in freezers to recover files, this covers only a very specific set of circumstances. As Kroll Ontrack's Adrian Briscoe notes:

Freezing hard drives previously worked if there was capacitor overheating on the external PCB of the drive. Most modern-day hard drives are integrated circuits with significantly less "chips" on the PCB.

If you've got true hardware failure, it's likely that your only option from here is to go for professional data recovery. Depending on the complexity of data recovery, the process could exceed AU$1000 — so if you're not willing to pay, be prepared to simply let go of your data and start again.