Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Microsoft Windows

Microsoft's New 'Windows File Recovery' Tool Restores Deleted Data (betanews.com) 59

Posted by EditorDavid from the forgotten-but-not-gone dept.
"Anyone familiar with how Windows and other operating systems work might know that files aren't actually deleted, they're marked to allow other data to overwrite them in the future," points out Hot Hardware, noting it's now led to the "quiet" launch of a new free Microsoft tool.

Slashdot reader Mark Wilson writes that the tool even recovers files from drives that were formatted or became corrupt: The command line tool can be used to retrieve data from local hard drives as well as removable media such as USB drives and memory cards... [F]or those who don't mind rolling up their sleeves and getting their hands dirty, it provides a means of getting back files from NTFS, FAT, exFAT and ReFS formatted drives.
This discussion has been archived. No new comments can be posted.

Microsoft's New 'Windows File Recovery' Tool Restores Deleted Data More

Microsoft's New 'Windows File Recovery' Tool Restores Deleted Data

Comments Filter:
  • "Restores Deleted Data " if you can restore deleted data in my world it was never deleted. At least by someone doing it right.

    Just my 2 cents ;)

    • Re: (Score:2)

      by raynet ( 51803 )

      No, you are moving it to trashbin and then just take the trash out :)

    • Re: (Score:1)

      by Anonymous Coward

      Yes ok we get it, your world does not include a familiarity with the majority of computer operating systems. It even spells it out for you in the first sentence of the summary:

      "Anyone familiar with how Windows and other operating systems work might know that files aren't actually deleted, they're marked to allow other data to overwrite them in the future,"

      So you didn't know that before but at least you do now and you can move on.

      • Re: (Score:2)

        by Rhipf ( 525263 )

        I just assume the OP is overly paranoid and 0/1 overwrites all deleted files so that no one can ever "undelete" his/her "sensitive" data.

        P.S. I doubt that they actually do that for all files deleted but rather was just trying to be snarky.

        • I just assume the OP is overly paranoid and 0/1 overwrites all deleted files so that no one can ever "undelete" his/her "sensitive" data.

          P.S. I doubt that they actually do that for all files deleted but rather was just trying to be snarky.

          The sad part is ever since the advent of journaling filesystems, there hasn't really been a good way to wipe just one file in place in the filesystem, because bits and blobs might be kept in a journal somewhere. You're better off wiping a whole FS, or deleting the file and wiping all of the free space on the FS.

    • "Restores Deleted Data " if you can restore deleted data in my world it was never deleted. At least by someone doing it right. Just my 2 cents ;)

      Forcing a write on every sector for some files is overkill, especially on media that might have a more limited number of writes per sector. Marking the space as available/removing the inode is efficient with time and other resources. Want to securely delete something? There are programs for that. Want to free up the space for a new file but don't have the time to wipe the old data? There's sdelete, from Microsoft, which can wipe the free space in the background after you've written the new files. I'd

      • Re: (Score:2)

        by Bengie ( 1121981 )
        If you just use full disk encryption, then the only way to get any files, deleted or not, is to be able to decrypt the drive.
  • the blocks from the old files are allocated to new ones.

    • Re:Restorable until (Score:5, Interesting)

      by EMN13 ( 11493 ) on Sunday June 28, 2020 @04:13PM (#60239224) Homepage

      Perhaps more relevantly, and more predictably anyhow nowadays: Restorable until the OS-issued TRIM command is processed by your SSD.

      In normal usage, you won't be able to recover much from an SSD. Small; sub-block size files: sure; and if you're really lucky files deleted while your drive was swamped and you pulled the plug quick enough.

      • Re: (Score:2)

        by xonen ( 774419 )

        You confuse me. While it makes sense what you say about TRIM, is it actually true?

        For TRIM to work the SSD doesn't have to re-write the block. It just needs to mark the block as 'free'.

        What the SSD does with those free blocks and how it reports them might differ. An SSD could choose to let the OS read existing yet deleted data, mimicking HD behaviour, or the SSD could have the block show up as 'empty' since it's marked as unused, like you suggest. The data may still be there, optionally retrievable by low-l

        • Well there's two problems here, the first one physical, the second with how data is organised on an SSD:

          1) The point of the TRIM command was to mark a page as free on an SSD. The reason this was relevant is because an SSD needs to erase an entire block before writing to it, the TRIM command lets the SSD controller know there's no need to erase a page as the data on it is stale and not needed. For a HDD this means that when *new* data is written to a disk there's a chance the deleted data may be lost. For an

          • Re: (Score:2)

            by tlhIngan ( 30335 )

            2) The drive doesn't know where the data is located anymore. Due to wear levelling algorithms the OS doesn't know the physical location of the data. It's up to the controller to track this as wear levelling algorithms move this data around all the time. Once a TRIM command is issued the controller doesn't need to remember where that data is, the block is marked free for other data. I'm not 100% certain on if the OS gets an error, but if the OS wanted to read the TRIM'd block back I don't think the SSD could

            • Re: (Score:2)

              by EMN13 ( 11493 )

              I tried this on a crucial SSD, and it returns zero's instantly(from my human perspective) after deletion.

              There's good reason to assume all ssd's will do this eagerly, namely that it costs time to do so, and that having more pages free makes wear levelling more effective. For those that don't know; ssd's cannot rewrite data; they can merely clear whole blocks of NAND (iirc typically around 1MB), and then write individual pages (iirc typically 4k). More background https://www.extremetech.com/ex... [extremetech.com] and https [wikipedia.org]

    • Re: (Score:2)

      by gweihir ( 88907 )

      Yes. But MS tries to do that as late as possible. On Linux ext2/3/4, for example, a freed block has a high probability to be used very soon.

  • Undeleted undelete. (Score:4, Insightful)

    by Presence Eternal ( 56763 ) on Sunday June 28, 2020 @03:46PM (#60239118)

    Thank you so much for implementing a feature your operating systems had forty years ago.

    • Re: (Score:3)

      by Cylix ( 55374 )

      This just makes free what companies have been making a killing off of for ages.

      There are some good open source kits around, but I was in a hurry the last time I made an epic mistake. I made the quick decision of buying some crap software for undelete.

      I was able to retrieve several isos and tax documents for about eighty dollars. I know, shame on me for not uploading to my backups and being lazy.

  • They needed this tool (Score:3)

    by luvirini ( 753157 ) on Sunday June 28, 2020 @03:47PM (#60239124)

    Given the multiple cases where win 10 updates deleted peoples files...

  • I guess it's true what they say (Score:5, Insightful)

    by Waffle Iron ( 339739 ) on Sunday June 28, 2020 @03:49PM (#60239134)

    Those who don't remember the DOS "UNDELETE" command are doomed to repeat it.

  • Maybe/finally something interesting....and while, yes I *AM* signed in and on the machine to install....it won't.

    SOOOO close to actually don't something right/nice.

    • I almost bothered to install it myself, but I have Recuva and I make backups.
      It nearly passed the CBA [onlineslan...ionary.com] threshold.

  • DOS 6 (Score:4, Informative)

    by MachineShedFred ( 621896 ) on Sunday June 28, 2020 @04:01PM (#60239188) Journal

    Hey, I remember when a huge new thing with MS-DOS 6 was the undelete command. Guess we should all thank Microsoft for blowing the dust off a 25 year old concept that they ripped off from Norton to begin with?

  • You have to have an account and a Microsoft-connected device.
  • SSDs have outpaced spinning rust by now, haven't they?
    • Comment removed based on user account deletion

    • Re: (Score:3)

      by Gabest ( 852807 )

      I just tried recovering some deleted files a few days ago from an ssd. I was not the system disk, no bitlocker, and no activity between deletion and restoration. All the files came back zero filled.

      • I just tried recovering some deleted files a few days ago from an ssd. I was not the system disk, no bitlocker, and no activity between deletion and restoration. All the files came back zero filled.

        Oh sure, nice try. We know you that you only deleted them in the first place because they were useless zero byte files.

  • Have we gone back to the 80s? (Score:3)

    by Viol8 ( 599362 ) on Sunday June 28, 2020 @05:03PM (#60239376) Homepage

    How is this sort of tool new?

    • How is this sort of tool new?

      Nobody said this sort of tool was new. They are saying this particular tool is new.

    • Re: (Score:2)

      by pnutjam ( 523990 )
      Nah, best to work on an unmounted disk, so you should probably just use testdisk in your Linux bootable rescue system.

  • The Microsoft support site [microsoft.com] says, "If you want to increase your chances of recovering a file, minimize or avoid using your computer. In the Windows file system, the space used by a deleted file is marked as free space, which means the file data can still exist and be recovered. But any use of your computer can create files, which may over-write this free space at any time."

    So, as expected, the tool only recovers bits that have been disassociated from the file system but which have not yet been overwritten.

  • That turned up (kinda) in latest versions of MS-DOS

  • I downloaded it twice. Opens a cmd box showing the instructions on use. The file winfr.exe is not loaded onto your disk and you can not run it from a command box. I have uninstalled it, unfortunately now the MS store will have it in my list of downloaded apps forever.

    The application is supposed to recover erased files on USB sticks/SD cards. Marketing BS to the max.

    Get something else.

  • Does MS also provide a disk scrubbing tool that prevents any possible recovery?

    It would be especially nice if directories were marked to allow either recovery, or prohibit any recovery .

  • Can we get a portable executable please (Score:4, Insightful)

    by BardBollocks ( 1231500 ) on Sunday June 28, 2020 @09:22PM (#60240080)

    Not this Microsoft Store nonsense...

  • Wow - the shittiness here is endless (Score:3, Insightful)

    by arQon ( 447508 ) on Monday June 29, 2020 @05:41AM (#60241168)

    So, first off, this thing has to be INSTALLED. Because god forbid we're allowed to have programs that just, yknow, RUN any more.

    Probably because it needs a specific version of .NET or whatever, but this is still beyond asstarded for a program that almost nobody is going to have until they actually need it, when the last thing you need at that point in time is hundreds of MBs more disk writes...

    And even just downloading it requires you to "sign in with your MS account"? Seriously?! This thirst for user data is completely out of control.

    • Re: (Score:2)

      by rHBa ( 976986 )
      I didn't RTFA of course but if that's how it works it's retarded!

      If a file is that important I'd just do a hard shutdown/power off (in case Windows runs updates or some other disk write on normal shutdown) and boot of a live disk/USB with PhotoRec or whatever your preferred file recovery software.

      Any other method is defective by design!
  • So there's a Windows native version of PhotoRec now?
  • Am I the only one waiting for a CRISPR upgrade that will make me smart enough to follow a proper backup schedule and not foolishly delete things with a keystroke that I didn't mean to?

Slashdot Top Deals

A committee takes root and grows, it flowers, wilts and dies, scattering the seed from which other committees will bloom. -- Parkinson

Close