Introduction

Altap Salamander: Plugins: Undelete: Introduction

Getting Started with Undelete Plugin

The Undelete plugin allows you to recover deleted files from NTFS, FAT12, FAT16, FAT32, and exFAT partitions. On NTFS partitions, it also restores ADS (alternate data streams), compressed, and encrypted files. You can recover files and directories from all local volumes (mounted to drive letters or to directories, or even not mounted) and also from disk image files.

See File System and Menu Extension sections in Using Plugins for a description of basic work with file system plugins and menu extensions.

Principles and Limitations

Each file on a disk is stored in short blocks called clusters. After a file is deleted, its clusters are only marked as free: the actual data are left on the disk until the clusters are used again for a different file. If used early enough, the Undelete plugin is able to find the clusters of the deleted file and copy them to a new file on another volume.

It is important to avoid writing any data to the volume containing the deleted file so that the deleted clusters are not overwritten. This also means that deleted files should only be recovered to a different volume in order to avoid overwriting the files by themselves. If there are no alternate volumes on your computer usable for the recovery, removable media (e.g. diskettes, USB disks) and network drives are also good candidates.

On FAT partitions it is unfortunately not possible to reliably identify all clusters of a deleted file, especially if the file was very large. A heuristic algorithm has to be used whose results may be incorrect. Note that this applies to all undelete programs.

In general, successful recovery of deleted files is not guaranteed and the recovered data may be damaged. You should always check if the obtained data are valid.

The chance to recover deleted file is displayed in the Condition column (switch panel to Detailed view):

Good | File is not deleted, or is MFT-resident, or is deleted but no collision with other deleted or existing files was detected. | There is a chance to recover the entire file.
Fair | Some clusters of the deleted file conflict with clusters of other deleted files. | There is a smaller chance to recover the entire file.
Poor | Some clusters of the deleted file conflict with existing files. | Some parts of file are certainly damaged.
Lost | All clusters of the deleted file are used again by existing files. | Zero chance to even partially recover such file.
Unknown | Damage estimation failed or was not performed at all. |
© 2001-2019 ALTAP. All rights reserved.


Recovering Deleted Files and Directories

You can recover deleted files and directories from NTFS, FAT12, FAT16, FAT32, and exFAT partitions. See Introduction for details on the principles of recovering.

To recover deleted files and directories:

  1. Open the Undelete dialog box:
    Menu: Plugins/Undelete/Recover Deleted Files and Directories
    Shortcut key: Ctrl+Shift+U
  2. Choose a volume or a disk image you want to analyze.
  3. Choose the OK button.
  4. Select files and directories you want to recover.
  5. Use the Copy command (the F5 key) to recover them to the specified target directory (should be on another volume).

See Also

Undelete dialog box

© 2001-2019 ALTAP. All rights reserved.


Restoring Encrypted Files from Backup

Recovery of encrypted files (EFS on NTFS volumes, see File Systems for details) is possible directly to another NTFS volume or, if not available, temporarily to FAT or exFAT volume. Since FAT and exFAT volumes do not support Encrypting File System (EFS), the encrypted files are recovered in raw (backup) format. These backup (*.bak) files can then be decoded to an NTFS volume, even back to the original one.

To restore encrypted files from backup:

  1. Select the files in backup format (*.bak).
  2. Open the Restore Encrypted Files from Backup dialog box:
    Menu: Plugins/Undelete/Restore Encrypted Files from Backup...
  3. Enter path to an NTFS volume where you want to restore the original files to.
  4. Choose the OK button.

Note that you can restore a complete directory structure containing both standard and encrypted files from NTFS to FAT or exFAT. The function Restore Encrypted Files from Backup can transfer the whole structure back to an NTFS volume, decoding encrypted files from their backups while copying standard files along with them.

See Also

Restore Encrypted Files from Backup dialog box


Undelete Configuration dialog box

Altap Salamander: Plugins: Undelete: Dialog Boxes

Undelete Configuration

You can customize Undelete plugin in this dialog. See Configuring Plugins for general information about configuration.

Options

Alternative temporary directory for viewing files
Deleted files being viewed must first be recovered to a temporary directory (usually located on the system disk, e.g. C:\). Since volumes containing deleted files should not be written to, an alternative temporary directory located on a different volume must be used when viewing deleted files on the system disk. You will automatically be asked to specify the alternate directory the first time it is needed.
Always reuse previous cluster scan information on FAT
The Undelete plugin is looking for directories also in the vacant clusters of FAT volumes. If you use the Refresh command to analyze the volume again, you can skip this scanning as it usually takes a long time.
Do not warn when undeleting to the same logical disk
Select this option if you want to take the risk of overwriting some parts of deleted files and directories by recovering them to the same volume. It is possible to damage even the same file you are just recovering, so this option is not recommended. See Introduction for details on the principles of recovering.
Do not warn before undeleting encrypted files to FAT or exFAT
FAT and exFAT volumes do not support encrypted files, so it is not possible to fully recover NTFS encrypted files to them. It is however possible to store the encrypted files in a raw (backup) format, see Restoring Encrypted Files from Backup for details on further processing of these files.


Undelete dialog box

Altap Salamander: Plugins: Undelete: Dialog Boxes

Undelete

Choose a volume or a disk image you want to analyze.

Options

Disk Image
Clear this check box if you want to analyze a volume. Choose the volume from the list of available volumes. Select this check box if you want to analyze a disk image. Enter file name of the disk image in the edit box below.
Scan vacant clusters on FAT partitions
When checked, the plugin scan also vacant clusters of FAT volumes when for looking for directories. It is ignored on NTFS and exFAT volumes.
Show existing files and directories
When checked, both deleted and existing files and directories will be displayed.
Show file with zero size
When checked, also files with zero size will be displayed.
Show empty directories
When checked, also empty directories will be displayed.
Show metafiles
When checked, there will be special {Metafiles} virtual folder, containing some file system metafiles. You can ignore this folder for ordinary recovery tasks.

See Also

Recovering Deleted Files and Directories

© 2001-2019 ALTAP. All rights reserved.


Restore Encrypted Files from Backup dialog box

Altap Salamander: Plugins: Undelete: Dialog Boxes

Restore Encrypted Files from Backup

Use this dialog box to restore encrypted files from backup.

Options

Restore file to:
Enter the path to an NTFS volume where you want to restore the original encrypted files to.

See Also

Restoring Encrypted Files from Backup

© 2001-2019 ALTAP. All rights reserved.