file undelete ​recommendat​ions

skydrive and live sync just replace a bunch of my code with older files that were on skydrive. Is there a file undelete utility that can be recommended?

thanks,

@SteveRichter:I've used Runtime GetDataBack for years. It's ugly as hell, but it works.

There are so many of these out there that I haven't had the patience to sit and try them all.

just to understand what I am up against, when a file is replaced with a newer version, is the replaced file recoverable? Or is it only when a file is deleted that it can theoretically be recovered?

When I read that the system eventually reuses the deleted space, does it first use all the free space on the drive before overwriting deleted space?  As in, an 80GB drive with 20GB of space used would first write to the 60GB of free space before writing over deleted space?

@SteveRichter:

As far as I know, you don't reuse the same place when replacing a file. It is simply writing somewhere else and change the pointer to the new one. Doing a delta kind of operation is more like a database where special software is used. So yes, the data is still somewhere in your HDD.

Actually you should see files in your recycle bin if you are using WL Mesh. I am sure of it because sometimes I rename my IE fovarite file and the other machine will have two files, one in recycle bin and one in fovorite folder.

Or you also can activate file versioning on your folder, which will keep track of all version of files on that particular folder. Not sure this works on Home OS or not, but, I know this is a basic Server OS feature.

@magicalclick: AFAIK drives are opportunistic. They will write to wherever is faster. So, if it's faster to use free space, then it will, if it's faster to overwrite something, then it will. The drive only thinks in terms of sectors.

where is the recycle bin folder found? I have the drive in a 2nd PC as the E: drive. So I don't see the recycle bin of that drive in windows explorer.

@SteveRichter:

there is only one recycle bin. Your E drive's recycled bin files will show up in your one and only recycle bin. That doesn't mean the files are in C, it is still in E. The recycle bin shows from multiple drives.

@kettch:

I think the OS writes before you replace the old file. I mean, if it failed to write the new file, at least the old file is still there. That's how I would do if I designed the OS. Meaning replacing 4GB file would temporarly take 8GB of HDD, until the write is complete, the old file would not be removed. But, this is just my assumption.

3 hours ago, SteveRichter wrote

skydrive and live sync just replace a bunch of my code with older files that were on skydrive. Is there a file undelete utility that can be recommended?

thanks,

I'll start with a dig at the OP: Do not use file synchronisation and online file hosting services as a substitute for proper source control. There are free SVN providers out there (even for closed and commercial projects) so there really isn't any excuse.

2 hours ago, SteveRichter wrote

just to understand what I am up against, when a file is replaced with a newer version, is the replaced file recoverable? Or is it only when a file is deleted that it can theoretically be recovered?

When I read that the system eventually reuses the deleted space, does it first use all the free space on the drive before overwriting deleted space?  As in, an 80GB drive with 20GB of space used would first write to the 60GB of free space before writing over deleted space?

Remember a disk is split up into blocks and a file spans a number of blocks. On many NTFS drives the block size is 4KB and that's why the "Size on Disk" value in File Properties is a multiple of 4KB.

Now what happens to the actual data in these blocks depends on the operation:

• If the program opens a file for writing in Append mode, then the file pointer is to the end of data within the last block of the file, subsequent writing extends to the next "best" block (if the drive is fragmented then the next block may not necessarly be the next sequential block)
• If a program opens a file for writing in normal mode (i.e. from the beginning of the first block in the file) then it will overwrite all of the same blocks that made up the file before it was opened, and as before, will extend to other blocks as necessary when writing beyond the end of existing data.
• When a file is "deleted" then the OS just removes the entry in the file table/list structure so that nothing points to the file's blocks anymore.

I'm not familar with how your synchronisation software works, but there are two possibilities for what happened when it synchronsied:

• It opened the file for writing, from the beginning of the data, and overwrote it all with the new data. In which case your data will be gone.
• It deleted the original file and replaced it with a new file with the same name. The data in the original blocks may very well still be there (as a 'new file creation' command might assign different blocks to the file). But because the file name is the same it means that undelete software cannot simply look for a deleted file table/list entry and will have to do a raw scan of the disk's contents.

1 hour ago, magicalclick wrote

As far as I know, you don't reuse the same place when replacing a file. It is simply writing somewhere else and change the pointer to the new one. Doing a delta kind of operation is more like a database where special software is used. So yes, the data is still somewhere in your HDD.

The comment about databases and special software is irrelevant. There are intelligent ways of performing remote differential synchronisation (i.e. methods that don't involve sending the entire file contents when only a few bytes are different) but Microsoft's pet implementation of this (called "Remote Differential Compression") is very recent and so far has only been implemented in Windows Server family. I would not be surprised if WL Mesh did trivial file replacement (but again, we don't know if it deletes the original file or overwrites the file's blocks).[/quote]

Actually you should see files in your recycle bin if you are using WL Mesh. I am sure of it because sometimes I rename my IE fovarite file and the other machine will have two files, one in recycle bin and one in fovorite folder.

Or you also can activate file versioning on your folder, which will keep track of all version of files on that particular folder. Not sure this works on Home OS or not, but, I know this is a basic Server OS feature.

Yes, "Previous Versions" (aka Shadow Copies) would have saved the OP's bacon in this case, however I've found it to be a very unreliable method of maintaining history of a directory.

That said, I understand that the Home Editions of Windows do not expose a GUI for working with Shadow Copies, only the API is present for Windows Backup to use.

1 hour ago, SteveRichter wrote

where is the recycle bin folder found? I have the drive in a 2nd PC as the E: drive. So I don't see the recycle bin of that drive in windows explorer.

Many people confuse "folder" with "directory". A folder is an object in the shell namespace, but a directory is something physically present in the filesystem; generally speaking all directories are folders, but not all folders are directories. The Recycle Bin is an example of such a folder: it exists only in-memory; in reality it 'contains' the contents of the "$Recycle.Bin" directories on all of your mounted drives combined. That said, I don't recommend actually browsing the $Recycle.Bin directories, the data in there is arranged in a special way by the OS.

Anyway, back on-topic:

I personally use Piriform Recuva for my undelete needs. It's pretty-looking, fast enough, and has worked for me in the past. It might work for the OP, but it depends on how it his sync software works. I wish him the best of luck in attempting to recover the data, but do not get your hopes up.

@SteveRichter: In case you didn't see it, right click on your folder, go to Properties. Do you have a Previous Versions tab?

-Josh

The only piece of software that worked for me a couple of years back was Active UNDELETE. No other software cracked the case.