Using Disk Investigator to Regain Files

• October 9, 2003
• James Skemp
• article, software, tutorials / guides

I've already discussed Disk Investigator in some detail (see Overview of Disk Investigator). However, what I really want to have is an example of the great use Disk Investigator is. In order to do this, I'm going to set up an example - an example of a situation that is not too uncommon - in order to show just how powerful it is. I urge you to follow along, with my example, on your own computer. Please note that for this article I am using Disk Investigator v1.3. I am also using Windows 98, Second Edition (but I have tested this program personally on Windows XP Home, SP1).

The first thing we are going to do is create a folder directly within the hard drive of your computer. Most computers designate this drive by 'C'. On the desktop, click on 'My Computer', then on 'C:'. When you are in the 'C' folder, right click in a blank area, and select 'New', and then 'Folder'. This will create an empty folder on your hard drive. Let's name the folder something like 'diskinvest', or 'empty1'. I'll be using 'empty1' for this exercise, so please just replace 'empty1' with the name that you gave this new folder to follow along.

Let's open this folder ('empty1' - 'C:\empty1'). Now, let's create a new text file, by right clicking in an empty area, and selecting 'New', and then 'Text Document'. Let's name this something like 'empty2' ('empty2.txt'). Now we have created a file, called 'empty2', residing within a created folder, 'empty1'. The full path of this new file is something like 'C:\empty1\empty2.txt'. Now, let's open up the text file and type some gibberish. For my file, I typed "This file is going to be saved by Disk Investigator". For this exercise, you may want to copy and paste the above (without the quotes) into the text file, so that we get the same results.

Let's open Disk Investigator now, and find our file. Disk Investigator will start by "Reading Disk Information . . .", which may take a while on larger hard drives. I've included an image of where you'll want to end up below. If you've used Windows before, you'll have no problem getting to where I am at. If you need clarification on this, please send me an email (I'm not sure if people need to know this, so I'm not going to add it in this edition, however, I will if even one person asks).

Here we see where our file is located on the computer, it's DOS name, it's size, it's modified date, and it's creation date. Right now, nothing else really matters.

Now, click on one of the other folders, on the right side of Disk Investigator (such as 'C' or 'Desktop'). Then, flip back to Windows Explorer, or, on the desktop, go 'My Computer' -> 'C' -> 'empty1'. Now, select our created text file ('empty2') and delete it (with the Delete key for example). Now, either navigate to the 'Recycle Bin', or close the current window (not Disk Investigator) and open the 'Recycle Bin'. You'll notice that 'empty2' is located in the bin. Empty the recycle bin, or delete 'empty2' again to remove it from your bin, and therefore from your computer (...). Close this window.

Now, switch back to Disk Investigator, and go back like we were before (see the above image). This time, you'll notice that 'empty2' is no longer black, but is rather red. In the bottom left hand corner of Disk Investigator we see that red files are deleted files. If we navigate to 'empty1' again, we'll notice that the folder is quite empty.

Now, click on 'empty2' and press the 'View' button. A window will pop up which will have the text files contents contained in it. If you switch back to looking at 'empty1', you'll still notice that the file is gone. Press 'OK' to dismiss the window. Now, making sure that 'empty2' is still selected, press 'Undelete'. Disk Investigator will now ask you where you want the file restored to. I choose the C drive, even though you may not normally want to do this, because I have nothing to lose :) Disk Investigator will popup a window telling you were it restored the file to (in my case, 'C:\Recovered_10_09_03'). If we navigate to this file we'll see that we have recovered our information.

Of course, while the way above will work, I often (if it is a text file, or a document file with text contained in it) just open up the file and copy/paste the information/text that I need. Sometimes, if you have other processes going, you'll notice that the information may not be restored correctly. This is because your hard drive saves data on it until it is overwritten - just because you delete something doesn't mean that it's completely gone. For example, imagine that your computer is like a sheet of carbon copy paper. If you write something on the top sheet, a copy is created on the carbon copy. Now, if you delete/erase the top copies information, that doesn't mean that the carbon copy information is erased. Rather, you have to write over it to 'get rid' of it (by writing over it, in both cases).

I hope that this has helped in using Disk Investigator. It should be noted that you can't recover information within deleted folders, using Disk Investigator, so, please keep that in mind. However, if Word happens to incorrectly save your document, causing corruption, be happy in the fact that you can still go grab an older copy (with luck) :)

Please feel free to email me with any questions you may have regarding the topics covered on this page.

Modified: January 6th 2004; January 25th 2004
Notes: See also my paper titled Overview of Disk Investigator.

• windows