By Annika Graf Oct 16, 2005, 12:59 GMT
Darmstadt, Germany - One extra click and the carefully written text disappears, the suddenly blank screen prompting a gasp of horror and a scramble to recover all that hard work.
Accidentally deleting data is annoying, but in most cases, it can be retrieved. Things get more complicated when the data has been damaged or altered by viruses.
Simply deleting, sometimes by unintentionally clicking on the delete key, only puts files in the computer's 'trash' or 'recycling bin' says Guenter Schulz, information technology director of the Fraunhofer Institute for Integrated Publication and Information Systems (IPSI), based in Darmstadt, Germany
'Whoever used the trash can just needs to take a look. Normally, the 'deleted' data can be found there,' he says.
Data can be recovered days or weeks after deletion if the trash can is properly configured to save all deleted items. Even if that is not the case, there is hope that the deleted data can be reconstructed.
'Even if the user deletes a file out of the trash can, it usually only disappears off the screen of the computer,' explains Winfried Kalfa, professor for operating systems at the Technical University of Chemnitz.
Actually, the files remain in the so-called Masterfile Table (NTFS or FAT). The hard drive usually has space for such deleted files. However, when new data is stored on the hard drive, the deleted information is then overwritten. This is true for Microsoft programs, as well as the Mac or Linux operating systems.
Special recovery tools can help rescue data that has vanished from the view of the normal user, explains Schulz. One free program is 'PC Inspector File Recovery' from the data recovery firm Convar. However you need to be careful during installation: If the file is installed on the hard drive from which information is to be recovered, the installation could accidentally overwrite the sought for data, said Matthias Behnke of the Computer Science Research Center (FZI) in Karlsruhe.
'If you only have a single drive available on your PC, for example the 'C:' drive, then your options are limited,' said Schulz. If there is significant risk that important files could get lost or overwritten, you should bring in a computer specialist who can recover the data with the help of a second computer.
If the data has been lost due to mechanical problems with the hard drive, professionals can sometimes rescue the files in a special workshop, said Michael Dickopf of the Federal Agency for Information Technology Security (BIS) in Bonn.
But emergency help is not usually cheap. A diagnosis that gives a list of data that can be saved and the degree of damage costs about 90 euros (107 dollars), says Stephanie Hennig, spokeswoman for German data recovery company Kroll Ontrack. Actual data recovery services in a specialized workshop starts at 800 euros (960 dollars).
If the computer is still up and running, Behnke recommends using the computer's Explorer program to look for recently altered documents.
If a system crashes, unsaved documents can sometimes be saved as temporary data. 'A search based on the files' contents instead of a specific file name is usually more successful in these cases.' The search program should be set to show hidden data as well.
In case a user has simply forgotten where data is stored on his computer, desktop search programs can be useful.
'If desired, programs like 'Windows Desktop Search' or 'Google Desktop Search' automatically keep indexes of many files saved on the computer,' said Schulz. Using the same tools as databases or Internet search engines, these programs seek and find data, e-mails and attachments in the system that are urgently needed.
When a document simply can no longer be read, it is likely corrupted or defective. That can indicate a hardware problem or that a virus altered the files, explains Behnke. 'Either theres something different there, it's simply unreadable or the virus changed the nature of the data.'
Everyday office programs save files with additional data. 'Microsoft stuffs a lot of hidden information into a document, for example for formatting or to track the history of changes to the document,' explains Behnke.
'When this information is corrupted, then it's possible that the original data no longer works.' Sometimes text files can be opened with alternative programs like 'Wordpad'. Basic information, like the text, can often be saved.
Regularly backing up data is most important in saving information, says Behnke. That does not mean creating a mirror image of the hard drive every time it's used. 'It's enough, if every now and then, a complete backup is made which can be used to recreate the system if necessary.'
In the meantime, important files should be saved on DVD, CD, USB sticks or other hard drives. 'It's better to have a little too much security than too little,' advises the engineer.
Your Talkback on this Story