cgsecurity.org

Good day,

I few days ago I deleted by accident a folder full of very important .odt documents in my laptop. I have been using (through Ultimate Boot CD) both Photorec and Testdisk. Unfortunately, in my best attempt, I only got like five or six of those files.
Now, I think that the rest (at least many more, since they are like hundreds or even more) should stiil exist. The delete just happened a few days ago, and since then I did not use my laptop for nothing except the few attempts with Photorec and Testdisk (copying any file I got to another drive, not to the same).

So, I would like to ask for general advice and for some specfic doubts as well. First of those, when I have used Testdisk I have not seen any file in red whatsoever (I used "h" to unhide stuff and that, but nothing changed), and an informatic friend of mine said that because I use Windows rather than Linux is that the red (deleted) files do not appear (and so, apparently Testdisk is useless for me).
Other of the doubts is related to Photorec: It was with this software that I managed to recover the five or six wanted files that I mentioned before (in a process that I found weird, because Photorec was almost three hours searching but in less that the first hour it had already found the few files that would ended being the total amount found). Because the files are .odt, I asked to Photorec to only search for .zip files (since I red that .odt, in Photorec, where included in that category); and I was thinking that perhaps that was a mistake...?

And with the doubts said, I would like to get some advise and perhaps other ways to attempt the undelete. I am quite the ignorant in this matters, and I hoping some more expert forum people could see if I am doing something wrong or if it is all lost for my files.

That is all. I hope I have explained myself well enough (and not too extensively), and that any of you will desire to help me. And sorry beforehand if I am not giving any relevant that should be known in order to help me (which, of course, I will provide as soon as I can once you ask me).

In any case, thank you for the attention

What is the maker of your disk and what is the model?

Hi,

I am not fully sure that I understand the question. I understood that you are asking for the hard disk drive in which the files were. I do not clearly know how to find the model and maker of it. I found something that said that is a: HGST HTS545050A7E680 (is that the model, maybe?).

Just in case, I will give you more info about the laptop. The maker is HP, and the model is a HP 15 Notebook PC.

Sorry if I am not answering what you asked, but please, be more specific. Maybe the question is very obvious for you, but I am quite the ignorant in this field.

I looked up the data of your disk HGST HTS545050A7E680 which is an old school rotating device, a HDD. If you had a SSD your operating system would most likely issue a TRIM command to your disk upon your delete operation which would tell the SSD which sectors of your deleted files are unused. The firmware of the SSD would then probably delete its internals blocks where the content of your sectors were stored. In such a case there is nothing to restore anymore.

Your disk, a HDD, behaves differently. If your files were stored in a Windows FAT oder NTFS-filesystem, the location (cluster numbers) where your ods-files are stored, would be marked as free but not necessarily overwritten. Once the operating system needs new clusters to store stuff, the file system driver would allocate free clusters out of its pool of free clusters which contain the clusters as well, where your file content was stored.
The more write activity is happening on the partition where your ods-files where stored, the less likely is the chance to recover anything because your clusters could have been allocated in the mean time.

Be aware that not only the data clusters could have been overwritten but the file entries with metadata that you see in Windows Explorer or some linux shell could have been overwritten as well by new file entries.

That should give you same explanations.

Furthermore, Photorec stops when finding a new file header. If your files were fragmented, Photorec can only find the beginning of your files but will not be able to guess what the next cluster is when it is located at a total different place instead of being just the next one.

Therefore it may very well be that the clusters that contain your ods-files still exist on your disk but the needed clusters can't be identified.

Your "informatic friend" is wrong.

Linux is the better than Windows for data recovery purposes as it is or can be configured in a way that the recovery object does not get auto-mounted or even worse - written upon!