Undeletion is a feature for restoring
computer file
A computer file is a computer resource for recording data in a computer storage device, primarily identified by its file name. Just as words can be written to paper, so can data be written to a computer file. Files can be shared with and transfe ...
s which have been removed from a
file system
In computing, file system or filesystem (often abbreviated to fs) is a method and data structure that the operating system uses to control how data is stored and retrieved. Without a file system, data placed in a storage medium would be one larg ...
by
file deletion
File deletion is the removal of a file from a computer's file system.
All operating systems include commands for deleting files ( rm on Unix, era in CP/M and DR-DOS, del/ erase in MS-DOS/ PC DOS, DR-DOS, Microsoft Windows etc.). File ...
. Deleted data can be recovered on many file systems, but not all file systems provide an undeletion feature. Recovering data without an undeletion facility is usually called
data recovery
In computing, data recovery is a process of retrieving deleted, inaccessible, lost, corrupted, damaged, or formatted data from secondary storage, removable media or files, when the data stored in them cannot be accessed in a usual way. The dat ...
, rather than undeletion. Undeletion can both help prevent users from accidentally
losing data, or can pose a
computer security
Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, the ...
risk, since users may not be aware that deleted files remain accessible.
Support
Not all file systems or operating systems support undeletion. Undeletion is possible on all
FAT
In nutrition science, nutrition, biology, and chemistry, fat usually means any ester of fatty acids, or a mixture of such chemical compound, compounds, most commonly those that occur in living beings or in food.
The term often refers spec ...
file systems, with undeletion utilities provided since
MS-DOS 5.0
MS-DOS ( ; acronym for Microsoft Disk Operating System, also known as Microsoft DOS) is an operating system for x86-based personal computers mostly developed by Microsoft. Collectively, MS-DOS, its rebranding as IBM PC DOS, and a few ope ...
and
DR DOS 6.0
DR-DOS (written as DR DOS, without a hyphen, in versions up to and including 6.0) is a disk operating system for IBM PC compatibles. Upon its introduction in 1988, it was the first DOS attempting to be compatible with IBM PC DOS and MS-D ...
in 1991. It is not supported by most modern
UNIX
Unix (; trademarked as UNIX) is a family of multitasking, multiuser computer operating systems that derive from the original AT&T Unix, whose development started in 1969 at the Bell Labs research center by Ken Thompson, Dennis Ritchie, and ot ...
file systems, though
AdvFS
AdvFS, also known as Tru64 UNIX Advanced File System, is a file system developed in the late 1980s to mid-1990s by Digital Equipment Corporation for their OSF/1 version of the Unix operating system (later Digital UNIX/Tru64 UNIX). In June 2008 ...
is a notable exception. The
ext2
The ext2 or second extended file system is a file system for the Linux kernel. It was initially designed by French software developer Rémy Card as a replacement for the extended file system (ext). Having been designed according to the same pr ...
file system has an add-on program called e2undel which allows file undeletion. The similar
ext3
ext3, or third extended filesystem, is a journaled file system that is commonly used by the Linux kernel. It used to be the default file system for many popular Linux distributions. Stephen Tweedie first revealed that he was working on extend ...
file system does not officially support undeletion, but utilities like ext4magic, extundelete,
PhotoRec
PhotoRec is a free and open-source utility software for data recovery with text-based user interface using data carving techniques, designed to recover lost files from various digital camera memory, hard disk and CD-ROM. It can recover the files ...
and ext3grep were written to automate the undeletion on
ext3
ext3, or third extended filesystem, is a journaled file system that is commonly used by the Linux kernel. It used to be the default file system for many popular Linux distributions. Stephen Tweedie first revealed that he was working on extend ...
volumes. Undelete was proposed in
ext4
ext4 (fourth extended filesystem) is a journaling file system for Linux, developed as the successor to ext3.
ext4 was initially a series of backward-compatible extensions to ext3, many of them originally developed by Cluster File Systems for ...
, but is yet to be implemented. However, a trash bin feature was posted as a patch on December 4, 2006. The Trash bin feature uses undelete
attributes in ext2/3/4 and Reiser file systems.
Command-line tools
Norton Utilities
Norton UNERASE was an important component in
Norton Utilities
Norton Utilities is a utility software suite designed to help analyze, configure, optimize and maintain a computer. The latest version of the original series of Norton Utilities is Norton Utilities 16 for Windows XP/Vista/7/8 was released 26 Oc ...
version 1.0 in 1982.
MS-DOS
Microsoft included a similar UNDELETE program in versions 5.0 to 6.22 of
MS-DOS
MS-DOS ( ; acronym for Microsoft Disk Operating System, also known as Microsoft DOS) is an operating system for x86-based personal computers mostly developed by Microsoft. Collectively, MS-DOS, its rebranding as IBM PC DOS, and a few ope ...
, but applied the
Recycle Bin approach instead in later operating systems using FAT.
DR DOS
DR DOS 6.0
DR-DOS (written as DR DOS, without a hyphen, in versions up to and including 6.0) is a disk operating system for IBM PC compatibles. Upon its introduction in 1988, it was the first DOS attempting to be compatible with IBM PC DOS and MS-D ...
and higher support UNDELETE as well, but optionally offer additional protection utilizing the FAT snapshot utility
DISKMAP
DR-DOS (written as DR DOS, without a hyphen, in versions up to and including 6.0) is a disk operating system for IBM PC compatibles. Upon its introduction in 1988, it was the first DOS attempting to be compatible with IBM PC DOS and MS-DO ...
and the resident
DELWATCH deletion tracking component, which actively maintains deleted files' date and time stamps and keeps the contents of deleted files from being overwritten unless running out of disk space. DELWATCH also supports undeletion of remote files on file servers. Since
Novell DOS 7
DR-DOS (written as DR DOS, without a hyphen, in versions up to and including 6.0) is a disk operating system for IBM PC compatibles. Upon its introduction in 1988, it was the first DOS attempting to be compatible with IBM PC DOS and MS-D ...
the kernel will store the
first letter of deleted files in the directory entries in order to further assist undeletion tools in recovering the original name.
PTS-DOS
PTS-DOS
PTS-DOS (aka PTS/DOS) is a disk operating system, a DOS clone, developed in Russia by PhysTechSoft and Paragon Technology Systems.
History and versions
PhysTechSoft was formed in 1991 in Moscow, Russia by graduates and members of MIPT, infor ...
offers the same feature, configurable by a
SAVENAME CONFIG.SYS
CONFIG.SYS is the primary configuration file for the DOS and OS/2 operating systems. It is a special ASCII text file that contains user-accessible setup or configuration directives evaluated by the operating system's DOS BIOS (typically residing ...
directive.
FreeDOS
The
FreeDOS
FreeDOS (formerly Free-DOS and PD-DOS) is a free software operating system for IBM PC compatible computers. It intends to provide a complete MS-DOS-compatible environment for running Legacy system, legacy software and supporting embedded system ...
version of UNDELETE was developed by Eric Auer and is licensed under the
GPL
The GNU General Public License (GNU GPL or simply GPL) is a series of widely used free software licenses that guarantee end users the four freedoms to run, study, share, and modify the software. The license was the first copyleft for general u ...
.
Graphical programs
Graphical user environments often take a different approach to undeletion, instead using a "holding area" for files to be deleted. Undesired files are moved to this holding area, and all of the files in the holding area are deleted periodically or when a user requests it. This approach is used by the ''Trash can'' in
Macintosh
The Mac (known as Macintosh until 1999) is a family of personal computers designed and marketed by Apple Inc., Apple Inc. Macs are known for their ease of use and minimalist designs, and are popular among students, creative professionals, and ...
operating systems and by the
recycle bin in
Microsoft Windows
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...
. This is a natural continuation of the approach taken by earlier systems, such as the limbo group used by
LocoScript
LocoScript is a word processing software package created by Locomotive Software and first released with the Amstrad PCW, a personal computer launched in 1985. Early versions of LocoScript were noted for combining a wide range of facilities with ...
.
This approach is not subject to the risk that other files being written to the filesystem will disrupt a deleted file very quickly; permanent deletion will happen on a predictable schedule or with manual intervention only.
Another approach is offered by programs such as ''Norton GoBack'' (formerly ''Roxio GoBack''): a portion of the hard disk space is set aside for file modification operations to be recorded in such a way that they may later be undone. This process is usually much safer in aiding recovery of deleted files than the undeletion operation as described below.
Similarly, file systems that support "snapshots" (like
ZFS
ZFS (previously: Zettabyte File System) is a file system with volume management capabilities. It began as part of the Sun Microsystems Solaris operating system in 2001. Large parts of Solaris – including ZFS – were published under an ope ...
or
btrfs
Btrfs (pronounced as "better F S", "butter F S", "b-tree F S", or simply by spelling it out) is a computer storage format that combines a file system based on the copy-on-write (COW) principle with a logical volume manager (not to be confused ...
), can be used to make snapshots of the whole file system at regular intervals (e.g. every hour), thus allowing recovery of files from an earlier snapshot.
Limitations
Undeletion is not fail-safe. In general, the sooner undeletion is attempted, the more likely it will be successful. This is because the more a system is used, the more data is written to the drive and potentially allocated to that deleted space.
Fragmentation of the deleted file may also reduce the probability of recovery, depending on the type of file system (see below). A fragmented file is scattered across different parts of the disk, instead of being in a contiguous area.
Mechanics
The workings of undeletion depend on the file system on which the deleted file was stored. Some file systems, such as
HFS, cannot provide an undeletion feature because no information about the deleted file is retained (except by additional software, which is not usually present). Some file systems, however, do not erase all traces of a deleted file, including FAT file systems:
FAT file systems
When a file is "deleted" using a
FAT
In nutrition science, nutrition, biology, and chemistry, fat usually means any ester of fatty acids, or a mixture of such chemical compound, compounds, most commonly those that occur in living beings or in food.
The term often refers spec ...
file system, the
directory entry remains almost unchanged except for the first character of the file name, preserving most of the "deleted" file's name, along with its time stamp, file length and — most importantly — its physical location on the disk. The list of disk clusters occupied by the file will, however, be erased from the ''
File Allocation Table
File Allocation Table (FAT) is a file system developed for personal computers. Originally developed in 1977 for use on floppy disks, it was adapted for use on hard disks and other devices. It is often supported for compatibility reasons by ...
'', marking those sectors available for use by other files created or modified thereafter. In case of FAT32, it is additionally erased field responsible for upper 16 bits of file start cluster value.
When undeletion operation is attempted, the following conditions must be met for a successful recovery of the file:
* The entry of the deleted file must still exist in the directory, meaning that it must not yet be overwritten by a new file (or folder) that has been created in the same directory. Whether this is the case can fairly easily be detected by checking whether the remaining name of the file to be undeleted is still present in the directory.
* The clusters formerly used by the deleted file must not be overwritten yet by other files. This can fairly well be verified by checking that the clusters are not marked as used in the ''File Allocation Table''. However, if, in the meantime, a new file had been written to the disk, using those sectors, and then deleted again, freeing those sectors again, this cannot be detected automatically by the undeletion program. In this case an undeletion operation, even if appearing successful, might fail because the recovered file contains different data.
* For
FAT32
File Allocation Table (FAT) is a file system developed for personal computers. Originally developed in 1977 for use on floppy disks, it was adapted for use on hard disks and other devices. It is often supported for compatibility reasons by c ...
devices, the lower 16 bits of the physical address is normally retained in the directory entry, but the high bits of the address are zeroed down. Many recovery programs ignore this fact and fail to recover data correctly.
Chances of recovering deleted files is often higher on
FAT12
File Allocation Table (FAT) is a file system developed for personal computers. Originally developed in 1977 for use on floppy disks, it was adapted for use on hard disks and other devices. It is often supported for compatibility reasons by ...
and
FAT16
File Allocation Table (FAT) is a file system developed for personal computers. Originally developed in 1977 for use on floppy disks, it was adapted for use on Hard disk drive, hard disks and other devices. It is often supported for compatibi ...
as compared to FAT32 volumes due to the typically larger cluster sizes used by the former systems and due to loss of upper 16 bits of logical cluster address for FAT32.
If the undeletion program cannot detect clear signs of the above requirements not being met, it will restore the directory entry as being in use and mark all consecutive clusters, beginning with the one as recorded in the old directory entry, as used in the ''File Allocation Table''. It is then up to the user to open the recovered file and to verify that it contains the complete data of the formerly deleted file.
Recovery of fragmented files (after the first fragment) is therefore not normally possible by automatic processes, only by manual examination of each (unused) block of the disk. This requires detailed knowledge of the file system, as well as the binary format of the file type being recovered, and is therefore only done by recovery specialists or forensics professionals.
NTFS file systems
NTFS
New Technology File System (NTFS) is a proprietary journaling file system developed by Microsoft. Starting with Windows NT 3.1, it is the default file system of the Windows NT family. It superseded File Allocation Table (FAT) as the preferred fil ...
stores file information as a set of fixed-size records (typically, 1KB) within the so-called Master File Table (MFT). File name and file allocation information are encapsulated into these records, providing complete information about each specific file. When the system deletes a file, the entry in the Master File Table is released to be either unlinked or reused, but it still remains on disk.
Until the MFT entry is reused or overwritten, the file can be easily recovered: data recovery software can find the "lost" MFT entry and derive full information about the lost file from it.
Note however, when the SSD
TRIM
Trim or TRIM may refer to:
Cutting
* Cutting or trimming small pieces off something to remove them
** Book trimming, a stage of the publishing process
** Pruning, trimming as a form of pruning often used on trees
Decoration
* Trim (sewing), or ...
function is enabled, file content may be destroyed shortly after deletion to reuse SSD memory cells. This makes file content recovery impossible (only name, date and file size information will remain on the disk).
Prevention
Data erasure is a term that refers to software-based methods of preventing file undeletion.
See also
*
Backup
In information technology, a backup, or data backup is a copy of computer data taken and stored elsewhere so that it may be used to restore the original after a data loss event. The verb form, referring to the process of doing so, is "back up", w ...
*
Deletion of articles on Wikipedia § Deletion review and undeletion
*
List of data recovery software
In computing, data recovery is a process of retrieving deleted, inaccessible, lost, corrupted, damaged, or formatted data from secondary storage, removable media or Computer file, files, when the data stored in them cannot be accessed in a usual ...
*
Paper shredder
A paper shredder is a mechanical device used to cut sheets of paper into either strips or fine particles. Government organizations, businesses, and private individuals use shredders to destroy private, confidential, or otherwise sensitive docum ...
*
Rollback (data management)
In database technologies, a rollback is an operation which returns the database to some previous state. Rollbacks are important for database integrity, because they mean that the database can be restored to a clean copy even after erroneous opera ...
*
Undo
Undo is an interaction technique which is implemented in many computer programs. It erases the last change done to the document, reverting it to an older state. In some more advanced programs, such as graphic processing, undo will negate the las ...
References
{{Reflist
External links
Undelete FreeFreeUndeleteMedia Investigator
Computer file systems
*
DOS on IBM PC compatibles