How to recover deleted files with CnW Recovery software

Most operating systems do not delete the data of a file when asked to delete a file. Instead, the directory entry is marked as deleted, and both the directory entry, and the data area can then be used by newer files. If nothing else is then written to the disk, then the data can be recovered. If new files have been written to the disk, then there is always a possibility that deleted files may be overwritten, or partially corrupted.

Deleted FAT files

With a FAT disk, the first entry of the file is marked with byte E5H. This overwrites the first character of the file name, but compared with loosing the file, this is not too important. On a FAT disk, at the same time as marking the directory, the FAT is cleared down. This can be serious as the file allocation table indicates where the data is stored. The directory stored the location for the start of the file, and short files are normally contiguous, and so a good guess will be to read the file as a sequential file. For a long file, it is common for them to be fragmented and manual joining together of the files may be required.

CnW Software has some very powerful features that allow it to recover files that have been deleted from a FAT32 disk. When deletion takes place a critical pointer is also deleted, and many data recovery programs cannot cope with this - thought at first glance there appear to, they end up with corrupted, invalid files. CnW Recovery routine is very accurate

Deleted NTFS Files

An NTFS disk is normally slightly easier to recover. The directory has a flag to indicate that the file has been deleted. The directory entry also stores pointers to the first 20 or so fragments of a file. This number is very varied, but for a file with only a few fragments, total recovery will be possible. Some NTFS file can have thousands of fragments, and extra chains are stored in other MFTs. The chance of automatic recovery is limited, but may be possible if nothing else has been written to the disk after deletion.

With NTFS deleted file recovery, the program does 2 passes of the disk. The first will restore files that are currently on the disk, and the second pass will recover files that are marked as deleted. This way, it is possible to tell if sections of the deleted files have been overwritten by more recent data. When files are recovered, they are stored in new directories indicating that the data was originally deleted, or has possibly been overwritten. All such files should be treated with caution as it is possible the data may have been corrupted

Raw recovery for deleted files

If a disk is fairly full, then it is quite possible for the directory entry to be re-used. In this case, the recovery methods described above will not recovery deleted files, but there is a final method that can be used. The disk is scanned for unallocated blocks, and each block is analysed to see if it is a recognised file start. If such a start is found, then a new file is restored with a dummy name, and a recognised file extension. There is therefore a chance that apparently totally lost pictures, or documents may be recovered. This may be viewed as a final attempt, but there is nothing to lose by trying, and sometimes, it may save the day.

Summary

CnW Recovery software has the option to recover deleted files when recovering the disk. Each options menu has a check button for Recover Deleted files, and also unallocated space.