I recently received a call from a client who was panicking over some lost data files. She had fired one of her employees after discovering that he was involved in unsavory business practices. As a last act of defiance, the soon-to-be ex-employee deleted a batch of files related to the firm’s major client and then emptied the Recycle Bin.

When I suggested restoring the files from a backup, she told me that the ex-employee hadn’t been copying his files to the file server for some time so the copies on the backup were out of date. She then asked if there was any way that I could recover the deleted files and, if so, could I come over right away. Before I could reply, she promised that she’d make it worth my while to get there as quickly as possible. I told her to not use the computer in question at all and that I’d be right over.

As I hung up the phone, I grabbed my Recover4all Professional Kit, tossed it into my briefcase, and headed out the door. Recover4all Professional is a capable data recovery tool available as shareware from Advanced Utilities, a small German software company. While there are plenty of similar products from big-name companies, I like Recover4all Professional because it’s easy to use, does a thorough job, works with all versions of Windows, and isn’t overloaded with a lot of extraneous features.

Every time I brag about Recover4all Professional, I’m surprised to learn that few of my fellow consultants use this program. In fact, many of them have never heard of it. I think it’s high time to spread the word.

How files are deleted in Windows
Before I show you how to use Recover4all Professional, let’s take a look at how files are deleted in Windows. Doing so will help you understand how the utility works. (You’ll also be able to impress your client should you feel the need to get technical.)

The Windows operating system uses a file allocation table to keep track of all the files on the hard disk. You can think of a file allocation table as an index of the files on your hard disk, in which each entry includes such information as the file’s name, the name of the folder in which the file appears, and its physical location on the hard disk. While there are several file allocation table systems that the Windows operating system can use, including FAT, FAT32, and NTFS, they all basically perform the same operation.

When you delete a file in Windows by dragging it to the Recycle Bin, the file isn’t actually physically moved from its original location nor is it physically removed from the hard disk. Instead, the file is hidden so that it doesn’t appear in the normal file management tools such as Windows Explorer. However, the file still has an entry in the file allocation table, and its physical location on the hard disk is protected.

When you empty the Recycle Bin or directly delete a file, again, the file isn’t physically removed from the hard disk or moved from its original location. The file’s entry is removed from the file allocation table. When this happens, the file’s physical location on the hard disk is no longer protected and the space is available for the storage of other files. If you continue to use the computer normally and save files to the hard disk, that space will sooner or later be overwritten.

Creating your Recover4all Professional Kit
One of the most important things to keep in mind when recovering deleted files from a hard disk is that you want to perform the recovery procedure as soon as you realize that the files are missing—preferably before other files have been saved to the disk. Once you permanently delete a file, the operating system assumes that the space on the disk is available for use by other files. If the operating system does indeed use some or all of that same space to store another file, your chances of recovering the deleted file are diminished if not removed entirely.

Therefore, you don’t want to install Recover4all Professional on the system from which you want to recover a lost file. For that reason, Recover4all Professional is designed to be run from a floppy disk. In fact, when you run the self-extracting installation file, the default destination is the floppy disk drive.

Because floppy disks can easily become corrupted, I prefer to run the utility from a CD. Furthermore, I’ve found that Recover4all Professional is more responsive when running from a CD-ROM drive than when running from a floppy disk. So, after installing and registering the utility on the floppy, I burn the files over to a CD.

My Recover4all Professional Kit then includes both a floppy disk and a CD. That way, if I ever find myself in a situation where the computer I’m working on doesn’t have a CD drive, I can still use the floppy.

Make sure that you have a recovery drive
Before you begin a recovery operation with Recover4all Professional, make sure that you have a separate drive to which you can save recovered files. This is because Recover4all Professional doesn’t allow you to save recovered files to the same drive from which they were recovered.

Recover4all Professional will allow you to save recovered files to any other location that is assigned to a drive letter. This includes the floppy disk drive or a second hard disk installed in the system. You can also use external drives such as Zip drives or USB drives. And of course, you can use a network drive that is mapped to a drive letter.

You can even save a recovered file to a CD-RW drive, provided that it’s configured to accept saved files from any application and contains a CD-RW disk using the UDF format. Bear in mind that this is the standard for most CD-RW configurations, so you should be able to simply insert a CD-RW disk into the drive and point Recover4all Professional to that drive letter.

Scanning for deleted files
Once you’ve created your package, you can attempt to recover deleted files from any computer. To begin, insert the floppy disk or CD into the drive and use Windows Explorer to launch Recover4all-Professional.exe. When you see the main screen, as shown in Figure A, double-click the drive icon of the drive containing the deleted files you want to recover.

Figure A
Recover4all Professional’s user interface is very similar to that of Windows Explorer.

As soon as you do, Recover4all Professional will begin a two-phase scanning operation. During each phase of the operation, Recover4all Professional displays information and a progress bar right above the Details pane to keep you apprised of the status of the scan operation.

During the first phase of the operation, which will take few minutes to complete, the utility will scan the file allocation table and build a picture of the existing directory structure on the hard disk. During this time, you won’t be able to interact with the utility.

When the first phase is complete, Recover4all Professional will display the directory structure in both the Tree and the Details panes. It will then begin the second phase, in which it scans the clusters on the hard disk searching for deleted files. During this time, you can begin to browse through the folders and even recover any of the deleted files that have been found so far. You can also abort the scan operation by clicking the Stop button.

Keep in mind that while Recover4all Professional is scanning the hard disk in the background, any recovery operation that you initiate will run more slowly than if you wait for the second scan to complete. Another thing to consider is that, depending on the size of the hard disk, the second phase of the operation can take several hours.

Recovering deleted files
Once Recover4all Professional has completed scanning the hard disk or has located the deleted files, you can begin the recovery operation. As you peruse the Recover4all Professional screen, as shown in Figure B, you’ll see that the Details pane includes a Recovery Chances column, which lets you know how likely it is that your recovery operation will be a success.

Figure B

You’ll also notice that Recover4all Professional uses different icons, as shown in Figure C, to visually cue you in to what it finds on the hard disk.

Figure C

When you locate the deleted file that you want to recover, select File | Recover. You’ll see the Destination Directory dialog box, as shown in Figure D, and you can select your recovery drive. Click the OK button, and the deleted file will be recovered and saved to the recovery drive. You’ll then see a message dialog box alerting you to the success of the recovery operation

Figure D

Downloading Recover4all Professional
The evaluation version of Recover4all Professional has all the functionality of the registered version except that you can only recover files that are smaller than 10 KB. Registering for the full-fledged version costs just $69, and since the registration process is conducted online via RegNet, the turnaround time is usually just a few minutes. Once you receive the registration information, you can simply convert the evaluation version into a full version by entering the key code.

Recover4all Professional runs under Windows 95/98/Me/NT/2000/XP. It can also recover files from all of the Windows file allocation tables: FAT16, FAT32, and NTFS.

Reaping the rewards
In the case of the data defiantly deleted by my client’s ex-employee, Recover4all Professional allowed me to quickly restore the missing files in pristine condition. The operation’s quick success was due in part to my client calling me as soon as she noticed the files were missing. Since she hadn’t created or edited and saved any documents on the computer and immediately quarantined it after she called me, the files were really in no danger of being completely lost.

That didn’t stop my client from appreciating my quick response by awarding me a gift certificate to dinner for two at a local restaurant—in addition to paying me my standard fee. So not only was my client happy, but my wife was happy too, when later that evening I took her out to her favorite restaurant.