Finding Wiped Files

[Simon Darkshade]

It seems I have really screwed up.

About a few weeks ago, I got rid of Kazaa Media Desktop as it was not running at all, just giving illegal operation errors. So I just put it in the recycling bin. And emptied it But it seems I also put in there the files I had previously downloaded, in a folder named MyKazaa.

So, I noticed today when playing a playlist of some music stuff, that my Kazaa playlist was empty.

I could not find any of the mp3's in a basic system search.

Is there any hope in hell I have of somehow recovering them from the depths of my system????? I seem to recall hearing once that nothing is ever truly wiped from your hard drive, and that is how they catch people with naughty stuff.

Is this true, and if so, how can I go looking deep inside my computer for it.

Alternatively, is there any way one could just find out the names of the files that have been trashed, so I know what I am missing, and what to get? Does the Recycling Bin keep a "list" of the files that die through it?

Please aid me. I am truly desparate and p1ssed off. I lost the William Tell Overture and the 1812 Overture, to name but a few...

 

[TedG]

Unfortunately, if those files were deleted and emptied from the recycle bin a few weeks ago, they're probably not recoverable. All emptying the recycle bin does is turn the space where those files were into free space, so any writing to the HD can now write to that space, so if you've been using your computer for a few weeks now, the files were probably overwritten somehow, like if you installed anything or downloaded/saved files onto your HD.
There are un-erase programs out there, but the irony in that is that installing the un-erase program would likely overwrite where the deleted data was.

 

[Simon Darkshade]

OK. I can live with the fact that I probably can't recover them, IF there is some way of finding out precisely what was lost.
Then I can go about getting them again, somehow.

Is there any way of finding the names of files that have been deleted from the computer, or that have been on there? If there is, then I am fine, as I can list down the files lost, and then download them somewhere, someday. As it is, I can only remember about 14 out of the 19 or twenty off the top of my head...

I have heard that there are ways that you can find out if something has been on a computer, even if it is deleted.

Is there such a way that is applicable to my circumstance???

I hope against all hope that there is...


(Guess which evil dictator is going to be backing up every file of his onto CD in the next day or two... )

 

[Ozz]

The old unerase dos command, would show you
what is in the drive's directory VTOC, erased files
have the first character of the file name overwritten
with a "*", and are not shown in directory commands.

However The VTOC just records the locations of
all parts of a file (unfrag puts them back together,
makes access faster, one head move per file )
once these become open any program can use them.
(flushing them in your trash makes them available).

Sad to say, in windows once it's flushed, it's space
has a high chance of being overwritten by the memory
swapping routines windows uses if not by day to day
computer file saving. Also if you have condensed the drive (defrag) the indexed deleted file enteries will be gone.

 

[Simon Darkshade]

And in English, that means what?

Sorry, the technical talk went right over my head.

Have been able to remember what all the files are, so it is less of a catastrophe now than an inconvenience.

But all the same, I often hear from certain colleagues and even a few people in law enforcement that you can very often find evidence of what has been on that computer, or what has been erased.
I have basically resigned myself to not recovering them, but I'd like to know for sure what I have lost...

So, in simple layman's terms, is there a way of checking what files have been deleted in the lifespan of the computer, or have ever been on there?

 

[Ozz]

Basically it works this way

Your Drive records where a file is in an index on track 18
on your drive. the index has the name of the file and what
tracks and sectors it uses, it also prevents other files from
writing in those locations.

When you delete a file (flush it in your recycle bin). it marks
it in the index by changing the file's names first character with
a "*" and also unlocks the locations the file used. The file is
still there until another program needs some drive space and
uses / overwrites the space where the file was. The entry in
the index will remain there until the index is rewritten (ie.
defrag is run)

When the cops are searching a drive they look at the drive
track by track, sector by sector. File fragments will be found
on the drive and can be rebuilt into files . Some smaller fragments can be found where a area was not fully overwritten. Cops
catch crooks who never clean up their drives.

 

[Ozz]

Originally posted by Simon Darkshade
And in English, that means what?

So, in simple layman's terms, is there a way of checking what files have been deleted in the lifespan of the computer, or have ever been on there?

Sorry, The answer is no.

 

[Padma]

So, in simple layman's terms, is there a way of checking what files have been deleted in the lifespan of the computer, or have ever been on there?

In simple terms: YES.

In practical terms, not unless you are really, REALLY desperate, and really, REALLY rich!

There are techniques that "the Fed's" use that can read what was on a disk even after it has been over-written 3, 4, even 8 or 9 times! But it is VERY expensive, rather slow (there is a lot of manual examination of bit-wise data, IIRC), and only done when it's really important.

So, basically, unless you're willing to blow the kind of money that even large governments wince at, all you can do is let it go, and resolve to be more careful next time.

 

[Simon Darkshade]

Originally posted by Padma

In simple terms: YES.

In practical terms, not unless you are really, REALLY desperate, and really, REALLY rich!

There are techniques that "the Fed's" use that can read what was on a disk even after it has been over-written 3, 4, even 8 or 9 times! But it is VERY expensive, rather slow (there is a lot of manual examination of bit-wise data, IIRC), and only done when it's really important.

So, basically, unless you're willing to blow the kind of money that even large governments wince at, all you can do is let it go, and resolve to be more careful next time.

How expensive are we talking here? You'd be suprised what is in the range...
But I wouldn't spend over $15 000, so it is probably out of the range for the present. Then it would really be the most expensive song in the world
I might pull in that favour that President Bush owes me though...

 

[Ozz]

If your song was a text file part/all could still exist on your drive and be readable (by you,ie not in binary). What you need is a Hex editor track/sector viewer and you could look through your drive for it. Otherwise i'd let it go. You would need to find a assembler/ pre-windows programmer (or the CIA) to go farther
than that

 

[Padma]

Originally posted by Simon Darkshade


How expensive are we talking here? You'd be suprised what is in the range...
But I wouldn't spend over $15 000, so it is probably out of the range for the present. Then it would really be the most expensive song in the world
I might pull in that favour that President Bush owes me though...

Well... I've never actually 'priced' it myself, but talking to some guys in the know, you'd have to add AT LEAST one more zero to that value, probably more, depending on the size of the drive, the time involved, etc.

And you would probably need to pull in that favor, just to make them listen to your request. Actually, I believe there are one or two commercial firms that will undertake this kind of work, but they also charge an arm and a leg, and that's probably on top of the cash!

 

[Ozz]

Originally posted by Padma

In simple terms: YES.

In practical terms, not unless you are really, REALLY desperate, and really, REALLY rich!

There are techniques that "the Fed's" use that can read what was on a disk even after it has been over-written 3, 4, even 8 or 9 times! But it is VERY expensive, rather slow (there is a lot of manual examination of bit-wise data, IIRC), and only done when it's really important.

So, basically, unless you're willing to blow the kind of money that even large governments wince at, all you can do is let it go, and resolve to be more careful next time.

Are they reading previous magnetic traces on the drive?, I bet the costs skyrocket with the number of overwrites. You won't
be getting your original drive back. Pretty cool otherwise.

 

[damunzy]

I have a more practical idea.
Go into DOS by going to | Start | Run | and typing in "cmd" if you have NT/2000/XP or "command" if you have 9x/ME.
Once you are in DOS you want to go to the drive that the music files were on. If it was C drive make sure you are on C and if you are not then type "c:"

Once you are in the correct drive type "cd C:\" where "C" is the drive letter your file are on.

Once you see the prompt "C:\" type in "cd recycled" or "cd recycled" it can vary I have found...not sure why.

Once you are in the directory "C:\recycled" or "C:\recycler", where "C" once again means the dirve you want to be on, type "dir /a".

This will give you a list of all the hidden recycle directories. Even if you completely delete the stuff in your recycle bin files can show up in here. The only time you will lose these files are when they get overwriten which, hopefully, has not happened.
Warning: The directory will look something like "S-1-5-21-854245398-507921405-1060284298-1003" <- no joke.

What you will need to do now is type "cd S-1-5-21-854245398-507921405-1060284298-1003" and don't mistype the directory name. "S-1-5-21-854245398-507921405-1060284298-1003" is going to be different for you so don't type this name.

Once you are in this directory then you will need to again type "dir /a". This will show you what files are contained in this directory.

Now al the files are going to be named like "Dd##.XXX" where "Dd" = "Dd", "##" = a number, "XXX" = an extenstion like .mp3 or .wav (I am guessing that one of those is the extension you are looking for, it might also be .mpa, .r, .mwv, or .mwa to name just a few).

Now you think you found the file you are looking for type "copy Dd##.XXX C:\temp\filename.XXX" where filename = what you want to name is, make it short and containing NO spaces for easy of use. If you do not have the directory it will give you an error, make sure you check for this directory before trying to copy this file to there or make it thru windows explorer.

Now open up windows explorer and open up the folder "c:\temp" and double click on "filename.XXX" and see if it is the song you wanted.

If you want to copy a lot of files at once then you can copy all of them by doing this command "copy *.* c:\temp\".

Now if this is not the file you need then you will need to repeat the steps above until you find the file. If you have checked every single file then I would suggest that you check every harddrive and not just the one that you think the file was on. If you still cannot find it I would suggest you search everything again as you could have missed one of the "S-1-5-21-854245398-507921405-1060284298-1003" directories. I would also recommend that you write the directory name on paper and check off on it after you have checked it. If you still have not found the file then I would hazard a guess that have lost the file you need. The last resort would be to send the HardDrive into a specialty shop which could cost from 500-1500 dollars. Good luck. If you want you can contact me thru an Instant messenger and I can walk you thru the steps. I would also suggest that you do this ASAP b/c they could be sitting on your computer right now but the next webpage you DL could overwrite it!

 

[Simon Darkshade]

Thank you gentlemen, and particularly Pale Horse for that extensive thesis, but I have got around the problem, through sheer Darkshade weird luck.
Guess who the evil bastard is who WROTE OUT HIS PLAYLISTS ON PAPER and then filed them away in his archives.
By the time I had found it, I had already remembered most of the missing stuff as well.
Armed with this intell, I can now redownload the stuff, if I can ever get a file exchange program to work again.

(Grrr. What does it mean when something causes an "invalid page fault in module <unknown>, then it lists a whole lot of "registers", "stacks" and "bytes"...? )

But, the original problem is effectively solved. Praise be to my eccentricity that I had forgotten!

And Pale Horse, my computer doesn't like Instant Message services, or e-mail accounts, music exchange programs, multiplayer patches or anything that makes it interact with other computers. I fear it is mortally traumatised from being bullied in the factory by the other machines or something..

 

[damunzy]

Originally posted by Simon Darkshade
And Pale Horse, my computer doesn't like Instant Message services, or e-mail accounts, music exchange programs, multiplayer patches or anything that makes it interact with other computers. I fear it is mortally traumatised from being bullied in the factory by the other machines or something..

No, it just means you have windows as an OS and it needs to be reinstalled The doctor, me, suggests a complete OS reload every 6 months or less if you frequently (3+ times a month) install demos and betas, even if you unistall them. If you can manage to format the harddrive at this time it is a good thing, as long as you mean to.

Thank you gentlemen, and particularly Pale Horse for that extensive thesis, but I have got around the problem, through sheer Darkshade weird luck.

Well, at least now everyone knows where there files go when they delete them and empty their recycle bin. Good thing I didn't spend too long doing it, since I had just recently had to find a file for my wife going thru the process I described above.

 

[Simon Darkshade]

Originally posted by PaleHorse76
No, it just means you have windows as an OS and it needs to be reinstalled The doctor, me, suggests a complete OS reload every 6 months or less if you frequently (3+ times a month) install demos and betas, even if you unistall them. If you can manage to format the harddrive at this time it is a good thing, as long as you mean to.

So, that would mean taking off all my personal files and work/backing it up, and then formatting the hard drive and reinstalling Windows?
This would stop the screw ups in the programs?
Well, then, there is a lot of burning onto CDs to be done...

 

[damunzy]

It would most likely fix the problems. Now if the problems come from just one program screwing the pooch, then when you reinstall it the problems will start to happen again.

Another way to go about this is to uninstall all of the programs you don't NEED and see if the system is more stable.

What OS are you using?

And have you read that PM?!?! I sent you?