TR Forums

Hi guys! I recently deleted some photos from my pc is there a way of recovering them?

PhotoRec.

Any more writes to that disk could overwrite the deleted files, so I'd do it now if I were you.

If the machine is powered off, not booting it with that drive being written to will help you, so best to use a boot CD or USB, e.g. Knoppix, which includes PhotoRec.

If it is still running,

1. plug in a USB drive if possible, or connect to a writable network drive, so you don't overwrite your deleted stuff with PhotoRec!
2. go to https://www.cgsecurity.org/wiki/TestDisk_Download and download it, hopefully to a location not on the affected disk
3. extract the files from the archive including the sub-directories
4. run it as an administrator/root

The linked page has better instructions, as well as the download links.

Googd luck!

Recover from your backup? I use Backblaze personally after CrashPlan stopped selling to consumers.

Usacomp2k3 wrote:

Recover from your backup? I use Backblaze personally after CrashPlan stopped selling to consumers.

Assuming you're not being inadvertently obtuse would lead to asking you why do you think OP has a usable backup (when that's an assumption contrary to the scenario implicit in the OP's question) ?

Hopefully, it's not for the self-benefit to get in a sarcastic or deliberately obnoxious response to someone who just joined 6 weeks ago and for all we know just had all their precious photos deleted.

There are lots of choices, including expensive data recovery services.

As Topinio said, don't boot from the hard drive or write to the hard drive. Use a boot CD or USB instead. I'd suggest Recuva, but it's a Windows program, so you can't use it with a Linux boot CD such as Knoppix.

If you don't have a backup, learn from this experience and have one from now on.

Look at https://www.ccleaner.com/recuva

Here's a list of options:
https://www.techradar.com/news/the-best ... y-software

I had success reading a faulty flash drive full of photos I wanted to recover with Test Disk/PhotoRec utility which is #5 on the list.

The short answer is yes.
The long answer is maybe.
The longer you have run the system, the more likely the files are gone forever.

You can find software that can recover files as when systems delete a file they usually just put a placeholder entry in the file tables that sort of says what was there.
the likelihood of recovering much usable is slim.

I've had good luck with GetDataBack NTFS in the past, but I haven't used it in a few years once I got a good backup strategy in place to prevent this type of scenario.

As others have said, if you can limit or completely stop using the drive in question your chances of recovery skyrocket. Your best bet if you need to keep using the system is to make a copy of the drive onto another drive (that you can keep in isolation) so you have a point in time to recover from.

Waco wrote:

I've had good luck with GetDataBack NTFS in the past, but I haven't used it in a few years once I got a good backup strategy in place to prevent this type of scenario.

As others have said, if you can limit or completely stop using the drive in question your chances of recovery skyrocket. Your best bet if you need to keep using the system is to make a copy of the drive onto another drive (that you can keep in isolation) so you have a point in time to recover from.

Just to clarify that last bit, it needs to be a raw image copy. Doing a file-based copy or using an "intelligent" cloning tool will not copy the sectors related to deleted files, and defeats the whole point of making the copy.

I've had good luck with Zero Assumption Recovery and have a license, which I've successfully used in anger: https://www.z-a-recovery.com/

The image-recovery portion is free.

I have never had good luck retrieving files from an SSD. The OP doesn't say that specifically, but TRIM seems to mangle "ghost" data that you could previously retrieve from spinning rust. Definitely put the drive in an external enclosure and then see what you can get from it with one of the already-mentioned applications in this thread. Unfortunately this post is just to temper expectations if you are asking about an SSD.

just brew it! wrote:

Just to clarify that last bit, it needs to be a raw image copy. Doing a file-based copy or using an "intelligent" cloning tool will not copy the sectors related to deleted files, and defeats the whole point of making the copy.

I should have clarified that further, thanks!

derFunkenstein wrote:

I have never had good luck retrieving files from an SSD. The OP doesn't say that specifically, but TRIM seems to mangle "ghost" data that you could previously retrieve from spinning rust. Definitely put the drive in an external enclosure and then see what you can get from it with one of the already-mentioned applications in this thread. Unfortunately this post is just to temper expectations if you are asking about an SSD.

Oh yes, TRIM absolutely mucks up any recovery attempts. Even without any further writes once the deletions have happened, any TRIM-enabled drive that is powered on will be happily garbage collecting what was left of your deleted files as time goes on.

Neutronbeam wrote:

Look at https://www.ccleaner.com/recuva

I'll second this recommendation. I keep the portable version of this handy in case of emergency. (Like if a file gets deleted before it's had a chance to be backed up.)