undelete plus - file recovery

Undelete Plus - file recovery

UndeletePlus is a tool that can help restore access to previously deleted files.

Homepage

http://undelete-plus.com

Computer Requirements

All Windows Versions

Version used in this guide

2.98

License

Freeware

Installing Undelete Plus

Follow any program-specific directions in theGuideIf there are none, simply click the link belowand choose a location to save the installerFind the installer on your computer anddouble-click it

Undelete Plus:

Required Reading

How-to Booklet chapter 5. How to recover from information loss

Level: 1: Beginner, 2: Average, 3: Intermediate, 4: Experienced, 5: Advanced

Time required to start using this tool: 20 minutes

What you will get in return:

The ability to restore previously deleted files on your computer

The ability to conceal the existence of files and documents on your computer or removable devices

1.1 Things you should know about this tool before you start

Sometimes you (or someone else) may accidentally delete files from your computer. If the files have been deleted using

the standard Windows Delete function, they may still exist on the computer (as discussed in Chapter 6, How-to DestroySensitive Information). UndeletePlus is a tool that can help restore access to previously deleted files.

How to Use UndeletePlus

To launch UndeletePlus:

Select: Start > Programs > TouchStoneSoftware > UndeletePlus > UndeletePlus to activate the following screen:

Undelete Plus - file recovery 06/03/2009 01:24

http://en.security.ngoinabox.org/book/export/html/179 1 of 8

Figure 1: The Undelete Plus main screen

2.1 How to Recover Deleted Files

Undelete Plus lets you scan your hard drive and removable devices to find all recoverable files.

Step 1. Select the drives you want scanned from the left pane. For example, the C:\ drive usually refers to your main

computer hard disk.

Figure 2: The Drives list displaying system drives

Step 2. Click the Start Scan button and Undelete Plus will begin scanning your computer hard disk for recoverable files.

Note: Scanning may take some time to complete.

After the scan is complete, all the recoverable files will be displayed in the right pane of the Undelete PLUS main screen

as follows:



Figure 3: The Undelete PLUS main screen displaying recoverable files

There are several options available to help you filter and locate the desired recoverable files. After the scan is complete,

the left pane displays the different types of recoverable files.

Step 3. Select the file type you would like to recover from the Types list of file types.

Figure 4: The Types list displaying different types of recoverable files

If UndeletePlus locates potentially recoverable Excel or Word files, you will see the relevant option on this menu.

Step 4. Double-click the file type to display its associated files in the right pane as follows:



Figure 5: The Undelete PLUS main screen displaying recovered files according to type

Note: As in the example above, you may find that the files have lost their original names and now appear as Dc13.doc

and so on. This is because it is sometimes not possible to recover the original file name from the Windows operating

system, even though the file itself can be recovered. Look at the file size, creation and modification dates and the path

(folder) it was originally deleted from to help you to identify which one it is.

To sort the search results by the original location of these deleted files:

Step 5. Click Folders in the left pane to activate the following screen:



Figure 6: The Folders list displaying the original locations of deleted files

Step 6: Click the + next to the C:\ drive option to expand the list of folders from which your files were deleted.

2.2 How to Create a Filter for the Scan

Wading through thousands of recoverable files can be a daunting task. However, you can use the Filter option if youknow which file you want to undelete. This will drastically reduce the time needed to look through the search results. For

example, if you want to search the results only for recoverable Word documents (files with a .doc extension), then you

should specify this in the Filter.

Step 1. Click the Filter button beneath the Undelete PLUS - Main screen title bar to activate the following window:

Figure 7: The Undelete PLUS Filter screen

A common filtering method is to use the original name of the file. However, as we have seen before, the file name may

be distorted in its current state.

Step 2. Check the All or part of the file name: check box.



Step 3. Type all or part of the name of the file you want to recover into the text field. You can also use the '*' wildcard

character here, to search for every possible file with a particular extension. For instance, if you are looking for all Word

documents you can type *.doc.

If you don't know the file name but have a good idea when you created or last saved the file, use the second option.

Step 4. Check the When was it modified? check box.

Step 5. Select either Modified Date (when you last saved the file) or Created Date.

Step 6. Enter a date range in the next two scroll lists.

If you can remember the file size, perform the following step. Otherwise, simply proceed to Step 8.

Step 7. Check the What size is it? check box, then enter a file size.

Step 8. Check both Hide Overwritten Files and Hide Temporary Internet Files options because it is highly unlikely thatyou will be looking for system generated files, or files that cannot be restored.

Step 9. Click the Set Filter button.

The list of the files in the right pane will now be reduced to those containing the criteria set in the filter.

Step 10. Click the Start Scan button.

2.3 How to Undelete Files

Step 1. Select a location in which to restore your files. Note: By default, the program will restore the files to the My

Documents folder. If this location is convenient for you, skip the next step.

Step 2. Locate the Undelete selected file(s) to: option on your screen

Step 3. Click: next to the Undelete selected file(s) to: next to the folder name to change it.

Step 4. Browse to locate the folder to which you want to restore your files. You may at this point want to create a folder

to store the recovered files. This way you will be able to find the recovered files easily. The program will remember this

location every time you run it.

Step 5. Click the entry in the right pane of the main screen to select the file to be recovered. When selected, the file will

have a check mark beside it as in the example below:

Figure 8: The Undelete PLUS main screen displaying files selected for recovery

Step 6. Click the Start Undelete button.

The file(s) will then be undeleted into the folder you specified earlier. There is a handy short cut to this folder.



Step 7. Click Open in the bottom right corner of the window.

A Windows Explorer window will open with your restored file.

Note: It is recommended that you restore files to another disk on your computer or a USB memory stick. This is a

precaution to ensure that you do not accidentally overwrite other as yet undeleted files on your computer.

Tip: If you have just wrongly deleted a document or a number of files, it is recommended that you immediately run

Undelete Plus. Do not reboot the computer or start any new programs. This will minimise the risk of Windows writing

over the deleted files with new information.

FAQ and Review

Elena and Nikolai find Undelete Plus an easy enough program to set up and use, but they are still not sure exactly what

files it will restore, and how to identify them.

Q: When I selected the file type WINDOWS, I got a list of different kinds of files, but I wasn't sure what they all were.Can you explain what kinds of files Undelete Plus has retrieved, and how I can identify the ones I want to recover?

A: Undelete Plus will find all previously deleted files on your computer that can be recovered. Remember, in Chapter 5 ofthe booklet we discussed why a normal Windows deletion is insufficient and how files can be restored. If you do not seta filter for your search, UndeletePlus will display all recoverable files, including past programs that you uninstalled fromyou computer, unnecessary system files and of course, your documents as well. Any file in the Windows section of theresults is best left alone. These are system files and will not contain anything that is of relevance to you.

Q: In particular, can you tell me how to find a file I was working on when the computer crashed? Can I use Undelete Plusfor this?

A: Unlikely. A crashed document is not a deleted one. However, it is worth performing a search with a filter on the dateof creation set. You could also try to view your computer's temporary files. In Windows XP, this can be done byperforming the following steps:

Step 1. Select: Start > Programs > Accessories > System Tools > Disk Cleanup

Figure 9: The Windows Disk Cleanup feature

Step 2. Choose your drive, and when the program loads (it could take a relatively long time to load, especially if this is

the first time you are running it).

Step 3. Click the View Files button.



Please see some additional guides for restoring crashed Word documents and other Office files:

http://www.amset.info/tips/office-recovery.asp

http://support.microsoft.com/kb/827099

Q: What kinds of files will Undelete Plus not restore?

A: Undelete Plus cannot restore deleted files that have been overwritten by other files. In Windows, when you delete afile, it marks that particular space on the hard drive as open to be overwritten by new data. It then writes new data to thedrive (new documents, installed programs) in a random fashion. There is then a small probability that it will overwrite thespace taken up by the document you previously deleted (and now want to restore).

Q: If I use a computer in an Internet cafe, and then somebody else comes along and uses Undelete Plus on it, how can Iensure that they won't be able to recover copies of files I've been working on and then deleted?

A: You will need to use a secure deletion program. Please refer to the manual chapter on Eraser and CCleaner. You canalso carry a portable version of CCleaner with you on a USB stick.

Q: Can I use this program to undelete files I've deleted from a USB key, DVD or CD? If so, how?

A: Yes, if your USB memory stick or CD/DVD drive is plugged in it will appear automatically within the Undelete Plusdrive menu in the left pane.

Q: The files listed for undeleting all have a status listed next to them (very good, bad, overwritten etc.). Which of thesestatuses are an indication that I cannot recover the file in question?

A: A bad or overwritten status means that the file cannot be recovered.

Q: How long will files remain on the computer in a form in which they are recoverable?

A: Until the space they take up on the hard drive is overwritten with new data. If, for example, you delete a bunch ofdocuments and then copy a movie onto your hard drive, it is probable that the movie will overwrite the deleteddocuments, rendering them impossible to recover.

Q: Are there any other uses for this program?

A: Undelete Plus or other data recovery programs can be used to obfuscate (hide from plain view) the existence of fileson your computer, USB memory stick or even a digital camera. If you have been taking photographs or carry informationwith you the existence of which you do not want anybody to know about, then you can delete them (using your computer)wait until the situation improves and then undelete (recover) them.

Tip: Be careful not to write any new data to the device that you want to restore files from. It is best to test this

procedure out a few times before trying it with important data.

3.1 Questions to test yourself with after completing the chapter

How is Undelete Plus able to recover deleted files?1.

Which files cannot be recovered?2.

How can you display only the results you are looking for after a completed scan?3.

What should you not do on your computer or digital device if you want to restore files from it?4.

