back to article Microsoft has a cure for data nuked by fat fingers if you're not afraid of the command line

While not able to undelete Microsoft's shuttered stores, accidentally borked files stand a chance at redemption thanks to the Windows File Recovery tool. Undelete has been a thing in the Windows world for many a year, although Windows File Recovery (first spotted by WalkingCat) takes things a little further with support for …

  1. Robert Grant

    What about just another Recycle Bin, inside the Recycle Bin?

    1. logicalextreme
    2. Anonymous Coward
      Thumb Up

      Might be helpful but not for regular users

      The Recycle Bin is for regular users who have an oops moment. Windows File Recovery is for advanced users who are willing to RTFM. I suspect that regular users could bork their system with the wrong options and the last thing we need is more On Call stories.

      In looking into it it seems fairly powerful but it requires the latest feature update which I have not yet been forced to install. When I have to upgrade I'll install it just in case option and test it on one of my USB drives that clutter my junk drawer.

      1. cutterman

        Re: Might be helpful but not for regular users

        This is just DOS' old "Recover" [one of the most dangerous commands ever] in a pretty dress.

        Recovers your files in 10,000 tiny bits - Rec0001, Rec0002, Rec0040,.....Rec9678: and it's up to you to put them in the right order.

        Farking stupid

        Mac

        1. Blackjack Silver badge

          Re: Might be helpful but not for regular users

          So is way less useful than undelete.exe(or was it .bat?) that let you recover files if you just had deleted them.

          I also remember Norton Utilities having an undelete option.

        2. sabroni Silver badge

          Re: Recovers your files in 10,000 tiny bits

          That's segment mode, yeah? You have to request that with the /s flag.

          There's lots of options https://www.thewindowsclub.com/windows-file-recovery-tool/ depending on how much meta data is in the MFT and with the file fragments.

          Looks to me like it can undelete whole files.

          1. Blackjack Silver badge

            Re: Recovers your files in 10,000 tiny bits

            *Looks it up.

            Yeah looks like with Undelete is best to use it right away before other files overwrite the space it was in.

        3. keith_w

          Re: Might be helpful but not for regular users

          did you try it before disparaging it?

        4. Scott Wheeler

          Re: Might be helpful but not for regular users

          The version of RECOVER I knew was worse than that. It would delete everything other than the first 128 files that it found. Then it would rename the survivors as you said.

          1. jake Silver badge

            Re: Might be helpful but not for regular users

            Back in the day, one of the first things I did with any new DOS box was check for RECOVER, and if it still existed, nuke it. I have no idea who ever thought that it would be a useful tool to release to the general public, but they should be taken out behind the barn and flogged.

  2. tony2heads

    Is this any improvement on photorec or testdisk?

    https://www.cgsecurity.org/wiki/TestDisk_Download

    https://www.cgsecurity.org/wiki/PhotoRec

    both of which I have used successfully

  3. I am the liquor

    Ah, good old WinForms

    WinForms keeps plodding along despite being eclipsed by newer, sometime-trendier alternatives like WPF, Silverlight, Electron, or whatever you're supposed to use to design TIFKAM apps these days. There's still no quicker way to knock up a Windows desktop GUI.

    1. logicalextreme

      Re: Ah, good old WinForms

      > There's still no quicker way to knock up a Windows desktop GUI

      There's a joke about paying maintenance in here somewhere.

    2. jake Silver badge

      Re: Ah, good old WinForms

      Hands up everyone who initially parsed that as "lock up" and then nodded sagely ...

      1. logicalextreme

        Re: Ah, good old WinForms

        To Electron's credit, it doesn't seem to bring the rest of the desktop environment down with it when one of its apps has what I like to call an "extended moment".

    3. Zippy´s Sausage Factory
      Flame

      Re: Ah, good old WinForms

      WPF is one of my pet hates. I have to turn off "font smoothing" because it plays havoc with my eyes and gives me a headache (my optician gave me lots of technical detail on why this is, all of which I forgot even while he was still saying it).

      As soon as I do, anything Windows Forms cheerfully follows suit and blends in. Anything WPF stubbornly refuses and continues with its uncanny valley not-quite-Cleartype-yet-also-somehow-not-quite-not-Cleartype font smoothing, thereby standing out like the petulant teenager who refuses to take off their Slipknot hoodie for the school photograph.

      1. W.S.Gosset Silver badge

        Re: Ah, good old WinForms

        > headache... optician

        Could be because you're seeing colour more clearly than normal. IIRC ClearType works by intrapixel antialiasing around the core character's border, taking advantage of the 3 micro pixels for each of RG&B. So all of the antialiasing"fill-ins" are a colour, non-black. Until I taught myself to ignore it, I had problems with the constant impression of rainbow out of the corner of my eye.

        (Likewise, I can't tolerate panning shots on any movie. Eyes watering, feels like someone levering my brain out. 25 Hz... Experimenting with a magnificent LaCie monitor back in the day, I established that the minimum refresh rate my brain can comfortably tolerate is 150 Hz. And faster is _much_ more comfortable. )

        1. jake Silver badge

          Re: Ah, good old WinForms

          Internal reflection and refraction in the eye varies between humans ... as does the way the brain parses the noise so induced. Wearing corrective lenses can mitigate this somewhat for some people.

          1. rmullen0

            Re: Ah, good old WinForms

            My eyes are getting in my old age, but, the worst for me in Windows is in a PowerShell window, where you have red text on a blue or black background. Looks blurry as hell. I don't know what it is about those colors together, but, it effs with my eyes.

            1. W.S.Gosset Silver badge
            2. Ken Moorhouse Silver badge

              Re: Looks blurry as hell.

              This is what is known as an infinite loop:-

              Execute commands in any order:-

              1. Have beer

              2. Make typos.

              3. Get errors which are difficult to read.

              At some point you will get a Stack Error, which means you will need to replenish the Beer Stack.

              1. jake Silver badge

                Re: Looks blurry as hell.

                What stack? Beer is interrupt driven.

                1. Ken Shabby
                  Pint

                  Re: Looks blurry as hell.

                  Time to enjoy a case of "Priority Inversion"

  4. vtcodger Silver badge

    Undelete has returned from the dead?

    Sounds like after a mere two decades, the MSDOS UNDELETE command has been summoned back from the dead. One wonders if perhaps some other questionable improvements inflicted on Microsoft users over the years might someday be reversed.

    I suppose there's no chance that the $#@&$ Registry will be replaced by less user antagonistic control structure(s)? That's probably too much to hope for.

    1. Pascal Monett Silver badge
      Flame

      Re: no chance that the $#@&$ Registry will be replaced

      Of course not. That abomination of an excuse for a systems configuration database was made to control DRM and take your PC away from you. There's not a snowball's chance in Hell for that to be removed.

      And this command-line-only undelete thingy can't even work without Windows 1 0 ? What a joke. I would really like to know what part of the Windows 1 0 system is sooo indispensable to a tool that works on NTFS partitions.

      Come on, Borkzilla, the NTFS on your latest OS-as-a-service (hurk!) is the same as what it was on Windows 7. Your tool could perfectly well run on 7 if you didn't put code in to forbid that.

      1. W.S.Gosset Silver badge
        Linux

        Re: no chance that the $#@&$ Registry will be replaced

        Obscure History note:

        the reason the Registry's datastore is called a Hive, is because one of the programmers on the original team had a hatred/phobia of bees. Another chap took the piss.

        1. jake Silver badge

          Re: no chance that the $#@&$ Registry will be replaced

          I thought it was because a couple of the guys Cutler brought over from DEC's UNIX side took one look at it and said "That 'orrible thing gives me hives ... please tell me you're joking!" ...

          1. W.S.Gosset Silver badge

            Re: no chance that the $#@&$ Registry will be replaced

            Nah, I'll take the truly legendary Raymond Chen's word over an random and rather strained story :

            https://devblogs.microsoft.com/oldnewthing/20030808-00/?p=42943

            1. W.S.Gosset Silver badge

              Re: no chance that the $#@&$ Registry will be replaced

              Although...there IS a not too dissimilar story which IS actually genuine, re how the Sopwith Camel got its name.

              1. jake Silver badge

                Re: no chance that the $#@&$ Registry will be replaced

                Shirley Sopwith Camel (not to be confused with Jefferson Aeroplane, of course!) got their name from the WWI single-seat biplane?

            2. jake Silver badge

              Re: no chance that the $#@&$ Registry will be replaced

              Mine was obviously a joke. Cutler would never hire a UNIX person, much less persons.

      2. JJKing
        Unhappy

        Re: no chance that the $#@&$ Registry will be replaced

        Not only will in not run unless you have Windshit 10 but you also need Play Store installed which is not present on Enterprise. Just peachy.

        Now if only Microshits would put out a tool to recover drives/partitions from a RAW state. Now that would be useful. (Don't say other apps already do that because I tried 8 or 9 and didn't find one that would find even one file. Some didn't even recognise the partition)

        1. sabroni Silver badge
          Happy

          Re: Windshit 10

          Classic! How do you guys come up with this stuff??

      3. BinkyTheMagicPaperclip Silver badge

        Re: no chance that the $#@&$ Registry will be replaced

        The registry was actually introduced in Windows 3.1, then the usage was greatly increased in Windows NT/95, as thousands of configuration files aren't always easy to use.

        This was prior to widespread use of DVD, or anything similar to HDCP, so I don't see why you're pushing the DRM angle.

        I would imagine that they're storing file deletion locations 'somewhere' in NTFS without bumping the file system version number, because as you say the underlying disk format hasn't changed for ages (actually since XP).

        1. crayon

          Re: no chance that the $#@&$ Registry will be replaced

          "as thousands of configuration files aren't always easy to use."

          My notebook, running linux, has about 1700 files in /etc, about 2500 in ~/.config and over 237000 in ~/.local. It has no apparent effect on performance.

    2. Anonymous Coward
      Anonymous Coward

      Re: Undelete has returned from the dead?

      "I suppose there's no chance that the $#@&$ Registry will be replaced by less user antagonistic control structure(s)? That's probably too much to hope for."

      And there I thought I was alone, convinced that fecking registry was a complete joke that shouldn't even have passed the 90s !

      This thing must die !

  5. bill 27

    Ooops!

    Sigh...nothing like having backups. You know, running nightly, keep a week or two on hand just in case?

    1. logicalextreme

      Re: Ooops!

      Your wild-eyed ravings have no place in IT.

      1. jake Silver badge

        Re: Ooops!

        I guess I should go full Luddite and eschew all technology completely, then ... I actually have verified functional near-line off-site backups. And my just in case things really go TITSUP[0], I have crossing copies of a weekly full system data backup in the post ... I snail mail the tapes to my sister on anther continent, and she returns them the day after receiving them, along with her own backups. Yes, it's all encrypted.

        Over-kill for a home system? Probably. But as part of a research platform, it's (mostly) tax deductible.

        [0] The Idiot Thing Seems Uncommunicative ... PANIC!

        1. bill 27

          Re: Ooops!

          I took it as sarcasm. Me, I carry a backup, on a 2TB USB drive, with me when I leave the abode overnight, and have another in a fireproof safe that I update whenever. Those little USB drives are cheap. Mine are 2TB (have 2 of them), 3TB, 4TB, and 5TB. Then again on my desktop machine I have 2x8TB mirrored drives, which I have multiple backups my personal stuff, one done nightly and the older backups removed after a certain amount of time.

          1. JJKing
            Facepalm

            Re: Ooops!

            I carry a backup, on a 2TB USB drive USB drive, with me when I leave the abode overnight,.........Mine are 2TB (have 2 of them), 3TB, 4TB, and 5TB.

            Sounds like you don't deal with regular users. They never listen when told to do regular backups and they don't want to spend $500 on a NAS ($10 per week for 1 year only) because it is soooo expensive for their business turning over $4 Million a year despite me telling them it is very cheap insurance.

            1. bill 27

              Re: Ooops!

              Not anymore, I'm retired, but that doesn't mean I'm not still paranoid. There''s a reason things are called accidents, it's probably not done on purpose according to a schedule. I have got quite a bit of multimedia that would be impossible to recreate. When I was working, we'd tell people that while we'd do nightly backups across the network, if they left a file opened it wouldn't be backed up. So if it was lost...well we'd have the last good version somewhere, most likely. We backed up onto tape and rotated through them about every 6 months. Yes, we tested the tapes to make sure our backups were usable, I knew someone who went to restore his computer and discovered that he had 2 sets of completely unusable backups.

          2. logicalextreme

            Re: Ooops!

            It was definitely sarcasm. I'm not gonna pretend I didn't spend many hours trying to recover as many files as possible kneeling over a laptop on the kitchen floor with the USB and power cables for an external hard drive trailing out of the freezer the first time I lost one.

            1. jake Silver badge
              Pint

              Re: Ooops!

              Of course it was sarcasm. Why did you think I went for the ad absurdum look with the Luddite comment?

        2. Anonymous Coward
          Anonymous Coward

          Re: Ooops!

          "I snail mail the tapes to my sister on anther continent, and she returns them the day after receiving them"

          A customer's staff used to have roll top desks. At the end of the day they could leave everything on the desk - and just lock the lid.

          Then management changed the furniture to ordinary flat desks - with an out-of-hours "clear desk" policy.

          One guy found a solution. At the end of the working day he put his working documents in a large self-addressed envelope. This went into the internal mail system - and was delivered back to him at the start of the next working day. Can't remember why he didn't just put the envelope in a drawer.

  6. Anonymous Coward
    Anonymous Coward

    Delete doesn't...

    ... and restore won't! At least not when you need it badly.

    1. Anonymous Coward
      Anonymous Coward

      Re: Delete doesn't...

      At worst Restore says it has worked - but has completely messed up your system.

  7. This post has been deleted by its author

  8. Ken Moorhouse Silver badge

    ...and Signature (for supported file types)

    This perturbs me. What does this do, over and above what Default does?

    Is it to provide string searching facilities within the lost file? Which could raise privacy issues.

    Hopefully it does not fire up the associated application and load the recovered file into it, which could be disastrous.

    I remember Netware's Filer utility, great life-saver. Sometimes behind the scenes applications delete and rebuild files many times over though, which meant having to know which of a thousand files all with the same filename is the one that's needed.

  9. oldfartuk

    I recall rebuilding the MBR on a borked hard drive, manually, in hexadecimal with a disc editor, on an Amstrad 1640 one day back in the 80's. . That was proper undeleting.

    1. jake Silver badge

      I started saving a copy of the MBR back in '83 with the release of DOS2.0, just for this reason. Even in the days of sub-5 Meg HDDs, the 512 byte file was cheap insurance (and could easily be deleted if I needed the space). Was easy to archive/restore on DOS, even with primitive tools such as debug on a bootable floppy. I still save the MBR (or equivalent), where it seems logical. Saves my happy ass/arse once or twice a year. Recommended.

    2. N2
      Pint

      Pint

      For your efforts

    3. Anonymous Coward
      Anonymous Coward

      A customer had accidentally relabelled their mainframe system disk. Owing to other problems the disk and their development sources had not been archived for a while previously.

      I knew that the relabelling process merely cleared a single flag bit that said there was a formatted System File Area.

      I wrote - on paper - a machine code bootstrap to find the correct place on the disk to set the bit. Then I hand-dibbed a length of "blank" paper tape with the binary values. A one-shot chance to get it right. Ah - the confidence of youth. Hit IPL - and it worked!

      The customer was pleased. Not my management though. This was an overseas posting - and such an easy display of "impossible" skill was taken as an insult to their much higher paid local staff's competence.

  10. Nursing A Semi

    Takes me back

    Mid to late 90s someone "can't remember if it was me" taught a friend DELTREE, our circle had to name him "Captain Deltree" after he used it about a dozen times to dramatic result. sadly think he deleted undelete along with the rest of the contents of his drive though.

    1. W.S.Gosset Silver badge
      Angel

      Re: Takes me back

      OT:

      Username... I hope your truck gets better.

  11. This post has been deleted by its author

  12. Luiz Abdala
    Windows

    Inquiring minds want to know...

    Is there any advantage of creating a partition exclusively for the trash can?

    Linux uses an exclusive partition for swap, why not one for the trash bin? (for all OS, besides Linux too?) With special read and write permits that do not allow rewriting of previous sectors marked for deletion until the disk is full, then it begins actually deleting things by date. I swear I have seen it before...

    A partition that just mirrors whatever you marked for deletion, that behaves pretty much like a RAID mirror under the sheets, with journalling and whatever thrown at it too, but just salvages data marked for deletion, but with better behaviour than just a folder named "trash" as in Windows. Something that is not destroyed by a single misplaced format command, or whatever.

    Or do we have that already and I don't know?

    Genuine ignorance and curiosity here.

    1. logicalextreme

      Re: Inquiring minds want to know...

      Without the fancy stuff you proposed on top of it, it would require copying the files there on delete, which might not be too fun if you were hoping to quickly jettison a few gigs. Though that could probably be accomplished as a background task as you say and sectors can't be reused until the copy has completed.

      It's a lot of stuff to put on top of the filesystem(s) just to allow for the odd recovery though; I think it's healthy for people to learn to be careful with their deletions and keep backups in whatever form they deem suitable. I think I can count the times I've actually used trash/Recycle Bin functionality on one hand; I just got into the mindset of being sure I wanted to delete things.

    2. jake Silver badge

      Re: Inquiring minds want to know...

      Windows doesn't actually move the "deleted" file to the bin, rather it links to the deleted data from the bin. The bin isn't a single physical location, it's a virtual space that stores links. With that said, there used to be a utility that allows you to do what you suggest. I can't remember its name, and I have no idea if Win10 would even allow such a thing ... Keep in mind that physically moving the data from disk to disk on deletion will increase filesystem overhead tremendously.

      But you are onto something. Proper use of disk spindles and partitions. When I setup my one remaining Windows box back in 2000 (yes, twenty years ago), I did it like this:

      OS on controller1, spindle1, partition1 (with a bootable backup on partition2) ... Registry on controller1, spindle2, partition1 (with a rolling, usable backup on partition2) ... Swapfile and tempfiles on controller2, spindle1, partitions 1 and 2 (WinSwap can also be used as a Linux swapfile, but that's another story) ... and last but not least, user data on controller 2, spindle 2, partition1 (odd day backups to partitions on the other three spindles, external backups on even days, off-site backup on Sunday).

      The OS isn't slowed down by the second drive (spindle) being accessed or written to for registry contents, and the swapfile and temp files are rarely called for by the OS at the same time. User data being on its own spindle just makes sense. The whole kludge separates the cluster-fuck that Windows insists on for its filesystem into four completely separate drives.

      It's ugly, but it works. My old installation of Win2K has never once crashed, lost data, or otherwise given me any file-system headaches in 20 years of near daily operation. (I've physically lost drives, but that's a hardware issue not a file system logic error ... and I've always been able to recover quickly with the above setup.)

      The old girl is airgapped, so fuhgeddaboudit.

      1. rmullen0

        Re: Inquiring minds want to know...

        I don't think I've had any major issues with file system corruption, other than, if you have Fast Startup enabled in Windows 10 and reconfigure drives (I.e. add a second drive or the like). Get ready for massive problems/file system corruption if you do that. I think it uses a hibernate-like file to speed up startup and I think it caches changes to the file system in it. It does it even when you do a shutdown, as opposed to hibernating the system. Personally, I think Fast Startup is extremely dangerous for that reason. I always have to remember to disable it when I setup a new computer.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like