We have all had that moment where we deleted a file only to realize it was the wrong file.  Not to worry, just go to the Recycle Bin and there it is… right click the file and then click Restore. Done, the file is back where it was.

This works most of the time but the Recycle Bin fills up and files start getting deleted permanently.  You can also clean out the Recycle Bin to free up hard drive space. This doesn’t mean that all is lost.  Deleting is somewhat a misnomer.  Windows does not actually erase the file from the drive.  It just renames it and forgets it’s there.  Now that space where the file lived before is open to write more files to it.

The Recycle Bin started in Windows 95 but had its Microsoft origins in MS-DOS 6 with the Delete Sentry.  Now before all you Mac Addicts start yelling, I will recognize that the whole concept was created in Apple’s Lisa operating system in 1982 under the name Trash.  Apple fought to keep the idea to themselves but lost in court.  They could keep the cute little icon and call it Trash but the idea was open for others to imitate.  So I guess that forced Microsoft into being green and start ‘recycling.’

Enough history, the point is that even after the recycle bin has been emptied the files are still available until they are overwritten.  Hard drives have different formatting structures.  Older drives use FAT (File Allocation Table) but newer drive user NTFS (usually thought of as New Technology File System).  Without getting too geeky with file systems, each has a table that records where each file is on the drive. As the name implies, FAT stores the names and locations of files in the File Allocation Table and NTFS stores this in the Master File Table.

If you have deleted a file and can’t find it in the Recycle Bin, then you can download some software that will look at the tables and the hard drives to show you the files available.  One product that I have used successfully is called Recuva from Piriform.  There is a free version and a professional version for about $30.  It is simple to use and generally does a good job with the recovery process.  But remember, since the table has told Windows that the location the file was stored is available, it may have been overwritten and corrupted or no longer available.

Being able to recover deleted files can make the IT person look like a hero so keep something like Recuva in your tool kit.  If you are not an IT person, it may certainly save you a lot of work having the ability to recover a lost file.  There is also software available to recover deleted files from smartphones, tablets, Macs, and Linux computers.

Just remember that the more you use a computer, the more likely a file will be overwritten.  Also remember, if you want to recover a file that could have been used in a fraud or needs to be recovered forensically, you should call us to talk through the process so you do not negatively affect the evidence you are looking for.