windows trash undelete

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
tofleplof
Posts: 2
Joined: 12 Oct 2015, 08:31

windows trash undelete

#1 Post by tofleplof »

I recently performed a successful recovery for a client which I thought I'd share with you -- it may or may not work for you :
this person had done a thorough clean-up of her files, moved everything to the trash and emptied it before realizing she'd deleted a few hundred important ones needed for her business management. This is what I did :
- Cloned the ntfs partition to an image using ddrescue
- Used the undelete feature in TestDisk 7.0
- Copied the $RECYCLE.BIN folder to a hard drive
here comes the interesting bit :
- inside the $RECYCLE.BIN folder was another folder named S21-5....something. I copied this one back into her $RECYCLE.BIN on her windows partition
- booted back into Windows, opened the trash and prayed the files would show up... They did !!! I simply clicked 'restore all files' and that worked. I wasn't too confident it would work but thought it was worth a go.
Hope this helps someone in the future.
Tof
Locked