Undelete Utilities for Windows NT

Recover deleted files

Envision yourself on a Friday afternoon, hurrying to finish a project so that you can beat the traffic home. Halfway through saving a large file, you receive a Disk Full error message. You frantically delete files from your hard disk and empty the Recycle Bin to make room. You finish saving the file, turn off your system, and rush out the door.

On Monday, your boss asks when you'll have the financial report ready. Suddenly you realize that you deleted the financial report in your moment of temporary insanity the previous Friday.

You search your system for the file. You look in the Recycle Bin, but you know it's empty. You get a sinking feeling as you imagine your boss' reaction. You wish you had a way to undelete files that you've accidentally deleted.

This month I evaluate four products that do the seemingly impossible—restore deleted files, even after you've emptied Windows NT's last hope, the Recycle Bin. None of these products requires hexadecimal debugging expertise or other specialized knowledge. Each product takes a different approach to undeleting files. Two of the products provide after-the-fact undelete features, and two of the products provide numerous layers of undelete protection, including a modified Recycle Bin. Two of the products use wizards to guide you through the undelete process, whereas the other two products use a bare-bones approach that takes a while to get used to. Three of the products let you undelete files before you install the full product. This feature is important because when you undelete a file from a drive, the sectors the file was using still contain information concerning the file. However, the system considers this space as free space and lets you overwrite it when you install the undelete program. Unless you have an emergency undelete option, you might overwrite the files you're trying to undelete simply by installing the undelete utility.

You might not need an undelete utility. However, you'll be glad this functionality is available if you ever need to use it. Like the old saying goes, "It's better to have something and not need it than to need something and not have it."

The Test Environment
For my tests, I used a Pentium 166MHz MMX single-processor system with 64MB of RAM, a 4.1GB hard disk, and a 20X CD-ROM drive, with Service Pack 3 (SP3) installed. In addition, I installed ArtiSoft's ConfigSafe for Windows NT, which let me take a snapshot of the system's original configuration. After I completed each product's review I uninstalled the program and used ConfigSafe to restore the system's original configuration. Thus, I tested all four products with the same configuration.

The Tests
I created two text files in WordPad and saved them in the system root directory as text explorer delete.txt and text dos prompt delete.txt. I used NT Explorer to delete the first file, and a command prompt to delete the second file. Next, I emptied the Recycle Bin and rebooted the system before I tested each product. I used each product's default settings to try to recover both files. If a product couldn't restore the files via its default settings, I configured the program until it could restore the files, and I reran the test.

Evaluating the Options
I reviewed each product's ability to restore files after you delete them from the command prompt, in NT Explorer, or via application uninstall procedures (including after you empty the Recycle Bin). I examined whether you can use each product's default settings or whether you need to perform additional configuration to restore files and directories. I determined whether each product could undelete files before you installed the entire product and whether you could undelete files remotely or across a network. I looked for helpful features such as a modified Recycle Bin, which enhances NT's Recycle Bin. Finally, I evaluated each product's installation, user interface (UI), documentation, technical support, and ease of use. Table 1, page 158, summarizes my analysis.

Lodestone Research conducted usability tests on the products. For information about these tests, see the sidebar "Usability Testing," page 162.

Undelete for Windows NT
Executive Software's Undelete for Windows NT is available in two configurations: Workstation and Server. The Workstation version is for standalone systems, whereas the Server version lets an administrator undelete files from systems across a network.

I tested the Workstation software. When I inserted the CD-ROM in my test system, a splash screen described two installation options. The first option is Install Undelete, which installs all the program files. The second option is Install Emergency Undelete, which installs a mere 8KB of Registry information and runs the Undelete program files directly from the CD-ROM. This option lets you recover accidentally deleted files before you install the program and inadvertently overwrite the files you need to recover. Undelete provides pop-up instructions for recovering files, such as not saving changes to currently opened documents (to prevent hard disk activity) and disconnecting the network cable (to prevent remote users from opening and saving document changes).

I clicked Install Emergency Undelete and launched the installation wizard. I had to update the Registry so that I could use the program from the CD-ROM. Then, I clicked Finish and the installation completed. I opened Emergency Undelete from the Start menu. The dialog box that appeared resembles the NT Find dialog box, including a space for the filename, the drive or drives to search in, and the Include subfolders check box. You can use wildcards in place of full filenames.

I knew I had deleted a text file, so I entered *.txt in the filename box and selected (C:) in the Look in box. I clicked Find Deleted Files, and the program began displaying a running list of files that met my criteria. After the search completed, I scrolled down the screen until I found my deleted file. I selected the file, clicked Undelete Files, and selected the drive and directory where I wanted the file restored. In some cases, you need to restore the file to a partition other than the file's original location to prevent the newly restored file from overwriting portions of the old, deleted file. (Otherwise, you can restore the file to the original location.) I was pleasantly surprised by how easily the software lets you undelete files even before you install the full product.

After I finished the emergency undelete, I reinserted the CD-ROM and clicked Install Undelete to install the full program. Installation was straightforward and completed in less than a minute. I rebooted the system and double-clicked the newly created Recovery Bin icon to open Undelete's main screen, which Screen 1 shows. An interesting feature of the product is that when you install it, Undelete automatically supersedes other file-recovery utilities installed on your system.

The main screen automatically displays files that you've deleted and that are in the Recovery Bin. I opened NT Explorer and deleted the file text explorer delete.txt. Then, I opened a command prompt and deleted the file text dos prompt delete.txt. I clicked Executive Software Network Undelete on Undelete's taskbar, and the two files I'd just deleted appeared on the main screen.

Undelete's Recovery Bin has customization parameters that let you set up your system in a hands-on or hands-off manner. You can enable the Recovery Bin for all drives or for individual drives. You can also use valid wildcards to exclude files from insertion in the Recovery Bin by filename or type. The Recovery Bin properties let you decide where to store Recovery Bin files and how much disk space these files can use. You can customize thresholds so that Undelete automatically purges files from the Recovery Bin until you reach the threshold setting for the percentage of the hard disk that is full.

Another useful feature is the Undelete from Disk option. This feature lets you recover files that you deleted from drives on which you disabled the Recovery Bin, files you deleted from directory folders that you excluded from Recovery Bin processing, or files you purged from the Recovery Bin.

Undelete includes almost every type of recovery utility, all in one package. Emergency Undelete lets you recover files before you install the full program. The Recovery Bin includes useful customization options. The Undelete from Disk option lets you recover files that you've cleared from the Recovery Bin. The Server version of Undelete provides additional functionality: You can manage and recover files on user systems across a network.

Norton UnErase
Symantec's Norton UnErase comes with Norton Utilities 2.0 for Windows NT. Norton UnErase offers protection from file and directory deletions. However, the program doesn't have a preinstallation undelete option, so you have no guarantee that you can recover files before you install the full product.

I installed Norton Utilities on my test system. I followed the installation wizard and selected Custom Install. I deselected all the program files except Norton UnErase, and I clicked Next. Then, I needed to specify where I wanted the program to install the files. After the installation completed, I received a prompt to reboot the system, which I accepted. When I logged on to the system again, I noticed that NT's Recycle Bin was now called the Norton Protected Recycle Bin.

I right-clicked the Norton Protected Recycle Bin icon and selected Properties from the drop-down menu. Five tabs appeared: Desktop Item, Norton Protection, Global, C:, and D:. The first three tabs appear on every system, and the drive letter tabs appear for each hard disk on a system.

I deleted both of my test files—the first (i.e., text explorer delete.txt) from NT Explorer and the second (i.e., text dos prompt delete.txt) from the command prompt. Next, I double-clicked the Norton Protected Recycle Bin, which opened the Norton UnErase wizard. Then I had to decide whether to display all protected files on the system's local drives or search for specific file and directory criteria. The default is to display all protected files, which I accepted. The program began its exhaustive search of the system's local drives. On my test system, this search was quick. However, the search might take a long time on some systems. I would prefer that the search feature included an option to select certain drives and exclude others from the search.

After the search finished, I noticed that the file I deleted from NT Explorer appeared among the protected files, as Screen 2 shows. However, the file I deleted from the command prompt didn't appear. The software's documentation claims that Norton UnErase can recover files you delete from the command prompt. After some investigation in the Norton Protected Recycle Bin's properties, I realized that I needed to select the Enable Protection check box in the Norton Protection tab. Because I hadn't enabled the protection option for the drive I deleted the file from, I couldn't recover the file after I deleted it from the command prompt. Symantec needs to install the option to enable protection for all local drives as the default, and let users disable protection for drives if they choose.

You must select Enable Protection for each drive you want to be able to recover files from. I selected drive C and selected the Enable Protection check box. Then, I selected drive D and selected the Enable Protection check box again. Next, I copied the text dos prompt delete.txt file from a 3.5" disk to the system's root. I then used the command prompt to delete this file.

I double-clicked the Norton Protected Recycle Bin icon and followed the Norton UnErase wizard again. This time, the file I deleted from the command prompt appeared in the protected files. I selected both test files and clicked Recover. Norton UnErase quickly restored the files to their original locations.

You can set several options in the Norton Protected Recycle Bin. The Norton Protection tab lets you configure a protection period. You can protect files for 1 to 999 days from the date you initially delete them. The default is to purge files 7 days after you delete them. After the protection period expires, the system purges deleted files. You can exclude files, file types, and directories from protection. Click Exclusions and select the files or file types you want to exclude. The Global tab lets you configure settings for all drives. To configure drives separately, you must use the drive tabs. You can use the percentage sliding bar, which is located in the individual drive tabs or the Global tab, to set the Norton Protected Recycle Bin's maximum size for each drive. The default setting is 10 percent. After I enabled the appropriate settings, I had no problems recovering files on my test system, regardless of how I deleted the files.

Norton UnErase is the most useful part of the Norton Utilities package, because accidental deletion of files is one of the most common support problems. However, I was disappointed that Norton UnErase doesn't include a CD-ROM-based undelete option. You're taking a risk with the deleted files the first time you install the program. If you install the program on the hard-disk sectors that contain the deleted file or directories, the program will overwrite the files and might make them impossible to recover. In addition, the Enable Protection option needs to be the default setting for all drives. Until you enable this option, you can't recover files you delete from the command prompt. Finally, Norton UnErase provides only local drive protection. Administrators can't undelete files across the network. These problems keep Norton UnErase from being a full-featured solution for recovering deleted files.

RecoverNT 3.0
Just as I was preparing to test Sunbelt Software's RecoverNT 2.6, I discovered that version 3.0 was available. I downloaded the 1.05MB zipped file from the company's Web site.

A drawback of electronic software distribution is that users don't have a printed manual or README file until after they unzip the files. RecoverNT's download page contains valuable information about recovering files. For example, you need to minimize or eliminate file activity on a system that you are trying to recover files from so that you don't overwrite the deleted files you're trying to recover. Sunbelt suggests that you unzip RecoverNT's files to a separate system, then copy the executable and Help files to a 3.5" disk. Running the executable file from a 3.5" disk lets you scan the system the deleted files reside on, and recover the files without overwriting them during the full program installation.

I copied the zipped file to a separate system and unzipped the file into a directory. Then I copied the files to a 3.5" disk. I inserted the disk into my test system and double-clicked the RecoverNT executable file. The main screen, which Screen 3 shows, appeared within 5 seconds.

The first step in recovering files is to click the Open folder icon on RecoverNT's main toolbar. Then, highlight the appropriate drive from the list of available drives on the system, and click Select. The software performs a sector-by-sector scan of the drive and creates a virtual file system in memory. This process can find file data for files that you deleted days, weeks, or months ago, as long as you haven't overwritten the data with another file. However, the process takes a long time and you can't customize it to scan only certain folders in the drive. After the scan finished, the software displayed the drive's directory structure. I clicked All Files to display deleted and nondeleted files. I then sorted the files by date, placing the most recently deleted files at the top of the list.

How you find deleted files with RecoverNT depends on how you deleted the files. Files retain their original names if you delete them from the command prompt or through an application that doesn't support the Recycle Bin. NT automatically renames files that you delete from NT Explorer, My Computer, or an application that supports the Recycle Bin. The text explorer delete.txt file was now called DC021.

I scrolled through the list of files and located the two deleted files. I double-clicked the files to restore them to their original locations, and I renamed the DC021 file text explorer delete.txt. You can recover as many files as you want in this manner before you install the full version of RecoverNT.

To install the full program, I unzipped the RecoverNT files on my test system, clicked the setup file to launch the installation wizard, entered the path where I wanted the files installed, and clicked Next. The installation completed within 10 seconds. The procedure for opening RecoverNT, scanning drives, and recovering files is the same for the full installation as it is when you use a 3.5" disk.

RecoverNT 3.0 lets users with Internet access scan and transfer recovered files from remote drives. Systems administrators can recover damaged drives and deleted files from systems on a LAN running TCP/IP. Open the Network RecoverNT program from the Start menu, supply a password, and click OK to open the logon screen and main window. The first line in this window displays the IP address of the system on which the program is running. You need to give this IP address to all remote RecoverNT users.

After the server is running on the remote screen, select Open Network Drive from the File menu to connect. You must enter the server's IP address and password and click OK to initiate the scan process on the remote system's hard disk. Navigating the network drive is the same as navigating local drives. For data integrity purposes, you can save files that you recover from the remote drive to only the local drive—not to the remote system or network. I didn't encounter any problems using the program to scan and recover files from remote systems, although the long scanning process tied up both systems' resources.

Although RecoverNT passed my tests, I was somewhat disappointed in the software. You need to scan entire hard disks, rather than selected directories, to find deleted files. Extensive scans can tie up your system for more than an hour. The procedure to undelete files is vague, and the documentation doesn't clearly explain the necessary steps. I had to piece together the documentation myself. The undelete process needs a user-friendly wizard. Finally, RecoverNT lacks a tool such as a protected Recycle Bin to protect against accidental deletion in the future.

RecoverNT is a useful product for undeleting files and recovering hard disks after they fail, but the product isn't user-friendly. It took me about 2 hours to become familiar with the software, and even then I wasn't confident in my ability to restore deleted files. The documentation needs to be more organized, with clearly labeled headings to guide the user through the information. You can't beat RecoverNT's cost, but you might prefer to pay a little more for software that's easier to use. To evaluate the software, download a trial copy of RecoverNT from the company's Web site and test the software on a noncritical system.

Rescue Undelete
Software Shelf's Rescue Undelete is available from the company's Web site. The program comes in a 1.39MB zipped executable file.

I downloaded the file and copied it to a 3.5" disk. Rescue Undelete doesn't include any documentation or a README file until you install the full product. Thus, you can't undelete files until you install the program on the system you need to undelete files from.

I inserted the 3.5" disk in my test system, double-clicked the executable, and followed the wizard. I had to enter the file installation path and serial number and click OK three times. Installation completed within 20 seconds. The program didn't force a system reboot, so I was able to start undeleting files immediately.

Before I opened Rescue Undelete, I deleted text explorer delete.txt from NT Explorer and emptied the file from the Recycle Bin. Then, I deleted text dos prompt delete.txt from the command prompt. Rescue Undelete doesn't include a special recovery bin to protect deleted files. The program is useful when a user deletes a file from the command prompt or when a user deletes a file from NT Explorer and empties NT's Recycle Bin.

After I deleted my test files, I opened Rescue Undelete from the Start menu. The Choose drive to scan dialog box appeared. All local hard disks were available, and I was able to scan them individually or collectively. I scanned only the C drive because I knew the files I deleted were originally located on this drive. I clicked OK, and the program began scanning the drive. In about 10 seconds, the main Undelete window appeared and listed the files that I could undelete, as Screen 4 shows. In my test, 1270 files appeared for me to sort through. Fortunately, you can sort the results by filename, size, date modified, file condition, and the first cluster identification.

I clicked the Date modified status bar, and Rescue Undelete sorted the files in descending order with the newest files listed first. I quickly located the file text dos prompt delete.txt, which I had deleted from the command prompt. I selected the file and clicked Undelete to restore the file to its original location. Finding the file text explorer delete.txt was more difficult, because when a file from an NTFS partition goes to the Recycle Bin, the filename changes. The filename takes the form of D:drive letterdeleted file number, where D signifies a deleted file, drive letter is the drive you deleted the file from, and deleted file number is a rotating counter of the files you deleted from that drive. For example, I found the file text explorer delete.txt listed as D:?0000048.txt. This filename denoted a deleted text file from an unknown drive that was the 48th file I deleted from that drive. To locate a deleted file, you must narrow down your search according to the date you deleted the file and the file's size. Then, undelete files until you find the one you're looking for.

Rescue Undelete lacks the ability to undelete files using a different system or across a network. Undeleting files is a risky task that is easier if you can use another system to support the undelete process and limit the activity on the system where the accidentally deleted files are located.

Rescue Undelete performs the rudimentary tasks you expect from an undelete utility, but the UI and lack of documentation make the process difficult. The software doesn't have a preinstallation undelete option. Software Shelf needs to provide information about how to undelete files using a 3.5" disk in the event of an emergency. The software unnecessarily searches the entire drive or drives you select each time you initiate a scan. I would prefer an option to scan specific directories and their subdirectories. Rescue Undelete is easy to use in identifying and restoring files that you delete from the command prompt, but finding files that you removed from the Recycle Bin is frustrating and the software doesn't provide tools to help you narrow down the search. Finally, Rescue Undelete is a standalone product, and the version I tested didn't support undeleting from another system or across a network. You can download a trial copy of Rescue Undelete from the company's Web site to see whether the software suits your needs.

The Winner
When I began evaluating these undelete products, I thought they were so cool that determining the best one would be difficult. All four products fulfill their claim of undeleting files. However, the more I used the products and explored their features, the more one stood out from the rest. Executive Software's Undelete is easily my favorite. I found the UI easy to use. The Emergency Undelete utility that lets you recover files before you install the full product is a powerful tool. The enhanced Recovery Bin provides an additional layer of protection to NT's Recycle Bin. Finally, the software supports a variety of IDE and SCSI drive configurations. Undelete's ability to undelete files and manage the deleted files in a user-friendly manner makes this software the clear winner