Almost Never Too Late to Undelete

Retrieve files you thought were long gone

Handy though it is, Windows' trusty desktop Recycle Bin isn't foolproof: Files that you delete through the command prompt, a DOS program, or any 16-bit software don't go in the Recycle Bin. And of course, after you empty the Recycle Bin, the files that it contained are gone for good. Or are they?

Undelete utilities pick up where the Recycle Bin leaves off. An undelete utility can restore files that you've removed at the command prompt, deleted through a DOS or 16-bit application, or purged from the Recycle Bin. Some undelete utilities can even restore files from reformatted disks. Undelete utilities can work their magic because of the way that Windows deletes files. Even when you empty the Recycle Bin, Windows doesn't physically remove files from disk. Rather, the OS marks those file clusters as available. Until you overwrite a cluster with new data, the file is still on the disk and is often recoverable.

Ready, Set, Undelete
For this comparative, I looked at three standalone undelete utilities—Software Shelf International's File Rescue 2.5, QueTek Consulting's File Scavenger 1.4, and LC Technology International's RecoverNT 3.5—that run on the Windows desktop. (Executive Software declined my invitation to include Undelete 2.0 in this review because the vendor positions the utility as an enterprise network product. I didn't include the undelete tools from Symantec's Norton Utilities or Ontrack's SystemSuite 2000 because those utilities aren't available as standalone products.) The three utilities that I evaluated run under both server and client versions of Windows 2000 and Windows NT 4.0. This review highlights workstations, so I tested the utilities exclusively on Win2K Professional and NT Workstation 4.0.

To put the utilities through their paces, I set up two test PCs: one running Win2K Pro and the other running NT Workstation 4.0 with Service Pack 5 (SP5). Both PCs contained two physical drives: C and D. Because restoring files to their original locations on the D drive could have overwritten the clusters of other deleted files, I created a separate E: partition on which to store recovered files. To create test files, I installed Microsoft Office 2000 on each machine. To test file deletion and recovery for documents deleted from a DOS program, I also installed WordPerfect 5.1 for DOS on both systems.

To cleanly evaluate each of the utilities, I used Symantec's Norton Ghost to create an image of my Win2K and NT environments (i.e., my C drive), which I reapplied after testing each utility. First, I tested each product under FAT16 and NTFS on the NT machine, then I tested each product under FAT16, FAT32, and NTFS on the Win2K machine. For my test subjects, I created 30 files, including Microsoft Word documents, Microsoft Excel spreadsheets, bitmap files, text files, and compressed files. I christened some files with 8.3 filenames and some with long filenames, and I created several directories in which to store the files. For each test, I reformatted the D drive, then copied my test directories and files to that drive.

To test file recovery from 32-bit applications, I used three methods to delete individual files from within a directory and to delete entire directories. To better simulate real-world conditions, I first moved 10 files to the Recycle Bin, emptied the Recycle Bin, then ran a utility to recover the files. Next, I turned off the Recycle Bin so that Windows would immediately remove deleted files, then I deleted a second set of 10 files and reran the utility. Lastly, I deleted the final set of 10 files at the command prompt and reran the utility. I followed this procedure for each product. To test file recovery from DOS and 16-bit applications, I removed files through WordPerfect's DOS file menu and through the File Manager applet in NT, neither of which the Recycle Bin supports.

Results
All three programs were easy to install and use. Each utility gave me the option to install the tool on my computer or to run it directly from a CD-ROM or 3.5" disk. (For the full test procedures, I ran all the programs from media to avoid overwriting deleted-file clusters on the hard disk. I repeated a few random tests running the programs from the hard disk and noticed no performance differences between installing the programs and running them from media.)

Each utility fared well under both Win2K and NT. However, File Rescue and RecoverNT had trouble restoring deleted files on a FAT32 volume, and File Scavenger didn't support FAT at all. Software Shelf and LC Technology said the FAT32 problems occur because Microsoft changed the file system for FAT32 in the final Win2K release, and both companies said they were working on patches to resolve the problems; QueTek told me the company plans to support FAT in the next version of File Scavenger.

When it comes to recovering deleted files, remember the motto, "The sooner, the better." Saving additional files to your hard disk overwrites deleted-file clusters and reduces your chances of a successful recovery. None of the utilities can perform magic, but all the products could often fully or partially recover ASCII text files and could sometimes recover text (but not formatting) in deleted word processing documents—even without all file clusters intact.

Each utility had quirks and limitations, but all three successfully recovered files under most test conditions. RecoverNT—with its ability to restore deleted files even after a disk reformat—was the most powerful utility. As a recovery tool, this product is top-notch, but for simply undeleting files, it's a bit of overkill. File Scavenger is another powerful package that can recover files from a reformatted partition, but I found the complete lack of support for FAT to be a drawback. File Rescue, despite its initial bugs and FAT32 problems, proved to be an effective utility with support for multiple file systems and removable media. Any of these products will prove their worth the next time you need to restore a crucial file.

File Rescue 2.5
File Rescue can recover files from hard disks, 3.5" disks, Zip drives, Jaz drives, and other removable media. The product performed well throughout most of my testing, although I found a couple of bugs with the version that I tested. You can order the utility on CD-ROM or download the program from Software Shelf's Web site. I ran the program from CD-ROM.

To test File Rescue, I first formatted my D drive as a FAT partition, copied my test files to the D drive, then deleted the files. The software presented a basic user interface (UI) that gave me several file-recovery options. First, I selected the drive on which to search for deleted files. You can choose to scan one drive or all drives. The program can scan a drive for specific files, files that match a certain pattern, or all deleted files. You can use wildcards in the search field to scan for multiple files. I chose to search for all deleted files on the D drive.

The scan lasted only a few seconds. Then, a recovery window, which Figure 1 shows, opened. This window displayed the name, directory, size, last-modified date, and recovery condition for each deleted file that the software discovered on the D drive. The recovery condition rates the odds (i.e., Excellent, Good, Poor, or Hopeless) of restoring a file; File Rescue gave most of my files a Good rating. I could sort this file list by any of the displayed criteria.

To undelete files, I selected them from the file list and clicked Undelete. The program then prompted me to enter a target directory in which to save the restored files. By default, the software designated my temp directory as the recovery location; instead, I selected the E: partition. File Rescue successfully undeleted all the selected files. (I opened each file in its native application to verify that it was fully readable.)

I noticed that although the program had found and recovered all the files that I'd deleted individually (i.e., files I'd deleted from within directories that I'd left intact), it hadn't found any deleted-directory files (i.e., files from within directories that I deleted). When I contacted Software Shelf, the company acknowledged a bug that prevents the recovery of files from deleted directories. The company emailed me a new version of the program's undelete executable file, which fixed the problem. I reran the tests with the new file and could recover files from deleted directories. Software Shelf told me that the new executable would soon be available for download and incorporated into the CD-ROM version.

After testing the software on a FAT partition, I reformatted my D drive as NTFS and repeated the test process. File Rescue restored all 30 deleted files, including compressed files.

Next, I booted up my Win2K machine and repeated the testing process under FAT16, FAT32, and NTFS. Under FAT16 and NTFS, File Rescue came through like a pro, restoring all 30 files. However, the software stumbled under FAT32: The utility failed to locate a few of the files, and many of the files it did restore were corrupt. (When I tried to open the files in their native applications, either the application couldn't recognize the files or the files displayed garbage characters.) The vendor directed me to the developer, who acknowledged the glitch and said an incompatibility with Win2K's FAT32 version causes it and that he was working on a fix to provide better compatibility with FAT32.

Other than the deleted-directory bug and the problems with FAT32, File Rescue performed well in my tests. The utility recovered all the files that I deleted from a 3.5" disk, as well as the files that I deleted using NT File Manager and WordPerfect's File menu.

You can download a free version of File Rescue, which lets you recover as many as five files simultaneously, from Software Shelf's Web site. The full-featured commercial version costs $68 per client license to download or $75 on CD-ROM. File Rescue requires 32MB of RAM and also supports Windows 9x.

File Scavenger 1.4
File Scavenger is another capable tool that can recover recently deleted files and files from a reformatted disk. The product has just one limitation: The version I tested supports only NTFS. You can install the product on a hard disk or run the utility on a 3.5" disk from Windows. I ran the utility from the 3.5" disk.

When I tested File Scavenger under NTFS on my NT machine, the software displayed a simple UI that prompted me for information. First, I specified the files that I wanted to recover. You can specify an individual file or use wildcards to scan for a range of files. Next, I specified the drive that I wanted to scan. File Scavenger can scan only one drive at a time. I chose to scan for all deleted files on the D drive.

Finally, I selected the type of search. The program offers a choice between a default Normal Search and an Exhaustive Search. A Normal Search picks up recently deleted files; an Exhaustive Search finds older deleted files and files that were previously on a reformatted drive. I initially chose the Normal Search. The scan lasted only a few seconds, then File Scavenger presented a list of all the recently deleted files. The UI displayed each filename with its original directory, size, and last-modified date; I could sort the results by any of those criteria.

I entered (in the Output Directory field) the name of the output drive and directory to which I wanted to save recovered files. Besides specifying an output directory, you can also choose to restore a file's original directory structure. For example, if you recover a deleted file from a directory called D:my documents and restore it to the E drive, File Scavenger creates an E:my documents directory in which to store the file. This handy option can help organize your undeleted files, especially multiple files that you recover simultaneously.

Next, I selected the files I wanted to recover and clicked Recover. File Scavenger brought back all 30 files, intact and readable by their native applications. The utility's Normal Search also restored the files I deleted using File Manager and WordPerfect. When the program successfully restores a file, a check mark appears next to the filename in the list and the file's status changes to Recovered, as Figure 2 shows.

I then decided to use the Exhaustive Search to test File Scavenger's reformatted-disk capabilities. I reformatted my D drive, copied my test files and directories to the drive, reformatted the drive again (thus erasing all the test files), then ran the Exhaustive Search. This time, the scan took about 3 minutes. File Scavenger found and recovered all the files and directories that were on the partition before the final reformat. The utility also found several files that were on the partition before the first reformat, although most of those files were unrecoverable because their clusters had been overwritten.

When I tested the product under Win2K NTFS, I decided to install File Scavenger rather than run it from the 3.5" disk. The tool's Normal Search found and restored every deleted file and directory.

File Scavenger proved to be a powerful utility for recovering files and directories from both clean and reformatted partitions. The product's one drawback was its lack of FAT16 and FAT32 support; however, a QueTek spokesperson told me that the company plans to support FAT in the software's next version, which at the time of this writing had an estimated release date of October 2000.

You can download a free version of File Scavenger, which restricts you to recovering files less than 4KB in size, from QueTek's Web site. The full-featured version costs $37.49 for 1 client license, $159.95 for 5 licenses, and $279.95 for 10 licenses. File Scavenger requires 32MB of RAM.

RecoverNT 3.5
RecoverNT is a versatile utility, both as an undelete program and as a file-recovery tool: It can undelete recently deleted files and recover files from a reformatted or corrupted drive. You can install the program on your PC or run it from CD-ROM. I ran the program from CD-ROM.

Rather than ask you to specify deleted files to search for, RecoverNT scans an entire drive and displays a list of all deleted files, letting you choose the ones to restore. Running a thorough scan of your drive increases your odds of restoring deleted files, especially older files. However, the scanning process is time-consuming because RecoverNT reads the drive directly, sector by sector, and rebuilds the file system to access deleted data. Running the scan on my 700MB FAT16 partition took more than 10 minutes. However, you can shorten the scan by clearing the Search Disk check box when you choose the drive you want to scan. RecoverNT then runs a cursory scan of your drive; this scan takes only a few seconds and finds only recently deleted files. I tested the program with the Search Disk option on and off. Both methods found all the recently deleted files on my FAT16 partition.

The program's UI displayed a toolbar and a few drop-down menus. To initiate my NT FAT16 test, I selected the D drive from the File menu. After the scan finished, RecoverNT displayed a directory tree; I opened each directory and found the names of all files, both existing and deleted, on the disk. I could switch among four views: Large Icons, Small Icons, List, and Detailed. The first three views displayed only the filenames. The Detailed view displayed the filename, last-modified date, starting cluster, and size. To access a file, you can double-click the filename, and the program immediately restores the file and opens it in its associated application. Or you can save the file to disk by specifying File, Save, then choosing a location. I chose the File, Save option, and the utility then prompted me for the directory path under which to save the file. RecoverNT won't let you save a file on the drive from which the file was restored, so you need to save undeleted files to a 3.5" disk or separate partition.

When you use the Search Disk option, RecoverNT offers five additional views of your found files. The Basic Root view, which Figure 3 shows, displays the directory structure of your disk with both existing and recently-deleted files and directories. The Searched Root view displays files and directories that the software has physically scanned on the disk. This view shows files that are still on a reformatted disk; the Basic Root view doesn't show these files. The Garbage Directory view lists all directories with files that are potentially corrupted and probably irrecoverable. The All Files view, for NTFS volumes only, lists all found files but displays them without their directory structure. The Total Directory view shows everything that the other views show. I opened each recovered file in its native application; all 30 files were intact and readable.

Under NTFS, only the Basic Root and All Files views are available. During the NT NTFS quick scan, the software couldn't find any recently deleted files or directories. I needed to enable the Search Disk option to look for all files; the program took more than 30 minutes to scan the 700MB NTFS partition. After the scan was complete, I needed to change the View setting to All Files to display each deleted file. The program found and recovered all 30 test files; each file was readable.

The program also successfully recovered all files under Win2K FAT16 (with Search Disk on and off) and NTFS (with Search Disk on). However, RecoverNT performed poorly under Win2K FAT32. Four of the six directories that I had deleted were inaccessible, so I couldn't restore the 8 files from those directories. Of the 22 recovered files, only 8 were readable. LC Technology acknowledged the incompatibilities with FAT32 and said the company was working on a patch to fix the problem.

RecoverNT also revived the files I deleted on a 3.5" disk, as well as files I deleted using File Manager and WordPerfect. To test the full recovery process, I reformatted my D drive, copied the test files to the drive, reformatted the drive again, then ran RecoverNT. The program found and recovered all the files and directories that were on the partition before I reformatted it the second time.

One RecoverNT characteristic that I found inconvenient was that on a FAT16 or FAT32 partition, the software stripped the first character of and truncated the long filenames for all deleted files and directories. Under FAT, the other products that I tested followed more typical and convenient renaming behavior; for more information, see the sidebar "What's Left in a Name?" LC Technology said that recovering the long filename information would increase the product's already lengthy scan time too dramatically. Although the company plans to unveil a simpler undelete product that is more similar to File Rescue and File Scavenger, the new product wasn't available in time to review for this article.

RecoverNT sells for $169 per client license, but the vendor offers a discount for multiple licenses. The program requires 16MB of RAM.