FileRestore is designed to recover deleted files. Of course, it goes beyond the Windows Recycle Bin and recovers files even after they have been emptied from there. It can also recover files whose deletion has somehow bypassed the Recycle Bin, for example: deleted at the command prompt, lost with a removed directory, deleted across a network or by an uninstall process.

It runs on any 32-bit version of Windows, including XP, and works with FAT, FAT32, and NTFS file systems. FileRestore recovers files on local drives including Jaz, Zip, floppy drives, and even digital camera storage cards. It must be run under administrator privileges because it provides access to all deleted files on a system, regardless of which user they originally belonged to. To recover files from a file server, FileRestore must be run on the server itself.

FileRestore works best if installed on your system before files have been deleted, because otherwise there is the risk that the installation of FileRestore itself will overwrite deleted files. However, it is possible to install and run FileRestore from removable media or across a network connection. To do this, you install FileRestore on a second machine that has the same type of removable media or a shared drive with the target machine. It is important to emphasize that FileRestore must execute on the target machine even though it may be installed on a network drive or on removable media.

After installation, FileRestore has the same 'look and feel' as the file search feature of Windows. However, it searches for and displays only deleted files. First, you specify the search location, which may restrict the search to specified drives, directories and sub-directories. The search can be narrowed by specifying a file name, which may contain the wildcards '*' and '?'. There is a number of other search criteria that may be specified. For example, you can check a box to 'search for files in deleted directories'; you can also specify ranges for date last modified and file size. Sometimes it is not possible to determine to which directory a deleted file belonged, usually because a parent directory has also been deleted. In this case, it is assigned to 'unknown folder n,' where n is a number, because there may be multiple orphan directories, each corresponding to different directory that no longer exists.

Search results are presented in a table giving filename, original location, size, last-modified date, a recovery prognosis (for example, 'likely'), and a description of the file type. This table may be sorted by clicking on the heading of the column by which you wish to sort the list. The table may also be saved as a report simply by copying it to the clipboard and pasting it into another application such as Word or Excel. FileRestore makes a best attempt at determining whether a file is recoverable based on whether any part of the file has been overwritten. If a file's recovery prognosis is 'likely,' it means that none of the file's data is known to have been overwritten by other files. However, there may still be occasions when FileRestore reports that recovery is 'likely' but corruption of some part of the file has still occurred.

Deleted files may be selected and the full file properties viewed before recovering them to a folder of your choice. With FAT and FAT32 file systems, the first letter of the name of a deleted file cannot usually be determined, but the search facility is intelligent enough to perform matching on the remaining letters and ignore the significance of the first letter in such a case. When displaying such files, the first letter is replaced by '?', and when copying a deleted file to a new location it is replaced by the underscore symbol ('_').

FileRestore does not modify the Recycle Bin or even use delete-tracking technology, so it is completely non-invasive and does not affect the running of the operating system in any way.

We were warned by Winternals that copying files onto a disk, immediately deleting them, and then trying to recover them was an unrealistic test. It seems that files that reside on the hard disk for a very short time have a lower chance of recovery. This may be due to disk caching, which could mean that the files were never really written to disk because the cache was not flushed during the time they existed. To try to eliminate any such unrealistic situations, we rebooted the machine after copying test files onto a disk, and also after deleting them, but before trying to recover them. As you might expect, FileRestore worked every time in this situation. It's not easy to deliberately overwrite part of a deleted file without using a disk sector editor, which would be an unrealistic test also. So we merely looked for files that may have been deleted many months ago and were no longer in the Recycle Bin. In most cases these were recovered intact, but inevitably sometimes they had been at least partially overwritten.

FileRestore's prognosis for recovery is pretty accurate but there must be situations where it gets it wrong through no fault of its own. An example would be if part of a deleted file is overwritten by the latter part of a new file, which is subsequently overwritten (not deleted) by a shorter file, such as when a document is shortened and then saved. In such a case, there would be no way to determine what had happened: the original disk sectors used by the file to be recovered would not be in use by another file, nor would they ever have been allocated to another deleted file.

For the price quoted, you are licensed to use FileRestore on a single machine, but volume discounts are available. Winternals has another product called Disk Commander that can restore files from formatted partitions, corrupted drives, and systems that fail to boot.

SC On-Line
SC Magazine
www.scmagazine.com