Have you ever lost a file or currently have an important document that was deleted, inaccessible, or corrupted? There is still a decent chance or recovering that file.
First step is to stop whatever you are doing. After a data loss, the operating system(OS) on your device no longer protects those file(s). The OS will believe the space where lost data resides is free and can be written over. The next copy operation, installation of new programs, updates, saving files, internet surfing (generates temporary files) and even booting from that drive can overwrite your lost files. The chance of recovering the files are lessened exponentially.
There are many different routes to go for finding viable file recovery software. Recuva by Piriform is my go-to program. It can recover files from your windows computer, recycle bin, SD cards, MP3 players, USB devices. It can recover any type of file that you have lost on rewriteable media. Music, documents, videos, and emails can all be saved. Before you attempt this process, follow these important instructions:
If possible, attempt a backup of the target drive.
Don’t install this recovery software on the drive with the problem.
Do not save the recovered files to the problem drive.
To start the installation, go to www.piriform.com/recuva and download the free version. Start the setup executable file. Save the application to an external device such as a flash drive. Depending on your resources and the severity of the data loss, if your device is still operable, attempt to start the Recuva from the flash drive. If you happen to have a hard drive reader with the hard drive connected to another device externally, that will be the most cautious way to handle this process. The program will prompt you to select the type of file that you wish to recover (pictures, videos, spreadsheets). Simply select the specific file type or do all of the above if you lost everything. The program will also prompt you to select the location of where you believe the files were previously stored on your device. You will be prompted to continue with either a checked or unchecked box that will enable a deep scan. The deep scan is extensive and can take several hours while the quick scan will only take a few minutes. After the scan is complete, the state of the files will be displayed as excellent or unrecoverable. To the right of the state column will display a comment explaining whether or not the file was overwritten. If the file was not overwritten, simply check the box to the left of the screen and click the recover button in the bottom right corner. If you select a file that was written over, Recuva will try its best to recover the file, but most likely will be inaccessible with only part of the file recovered. Save the files to a specified folder (preferably not on the problem drive).
In the event that Recuva fails to recover your files, and they are of the absolute necessity, your next course of action would be to take your drive in to IT professionals. They will most likely create an image of your drive using third party software and run more extensive commercial oriented programs on your device. The file structure will be tested and they will try to determine whether the files can be salvaged.
Thanks for the tutorial and prgram recommendation! Do you have any tools for recovering product keys?
Sure do! I recommend either Produkey (lightweight and portable executable) or bellarc
I have my CHFI from EC Council and love digital forensics. IT work is not my passion though. Thanks for this post!
Anytime man! What's your favorite software if you don't mind me asking?
It depends on the task. There are soooo many utilities to recover files. Part of the CHFI exam is FTK and EnCase work, but I still do not have much experience using them.