Recovering deleted files on Windows NTFS drives
We all know that when you delete a file from a hard disk all you really do is delete one character from the index which points to the file and update a file allocation table which then allows the old data to be overwritten by new as required.
So if you make a mistake and need to recover a file this can be achieved so long as no new data have been written over the top of the old file. So speed is of the essence!
Whist it's quite possible to use a hex disk editor to edit the file tables there are a number of free and commercial tools which make this an easy and painless task.
One of the best - and free - ones we've come across is NTFS Undelete, which is also Open Source.
The developers web site can be found here - http://www.ntfsundelete.com/
and as an aside, if the files one is trying to recover are corrupt or damaged in some way, then have a look at Roadkil's Unstoppable Copier - freeware, works with Windows 7 and can be run from a USB key. Excellent!
It recently saved my hide when I had to recover a users Outlook PST from a V2i disk image. The disk image mounted OK as a 'drive' but when I tried to copy the PST off to a physical drive it kept failing at about 750MB of the 3.5GB...
But point Unstoppable at it and, it did what it says on the tin - chugged all the way through it and then I could run scanpst to fix the errors.
Result? Happy user!