I’ve got a file that I deleted earlier today. The recycle bin has been emptied since then, so it’s not a simple recovery. My laptop hasn’t been used since then, apart from browsing Facebook.

I already had Puran File Recovery installed, so I’ve tried using that. It hasn’t found the file I need to recover, although it finds files I deleted months ago. I’ve tried looking for deleted files in the location of the folder where the file was before it was deleted, and also the recycle bin’s folder. It’s not listed in there at all.

Is there another data recovery program that is good, that I can use to get it back? I’m not sure why it’s showing files deleted months ago, but it can’t show me one I deleted only hours ago.

OS? Filesystem?

I’ve had success with foremost, which was developed for the US Air Force Office Of Special Investigations for forensic work. For a more general introduction to file carving, have a look at the Forensic Wiki.

btm said:

OS? Filesystem?

I’ve had success with foremost, which was developed for the US Air Force Office Of Special Investigations for forensic work. For a more general introduction to file carving, have a look at the Forensic Wiki.

Sorry, I should’ve said that. Using Windows 7 64-bit, NTFS.

JTQ said:

btm said:

OS? Filesystem?

I’ve had success with foremost, which was developed for the US Air Force Office Of Special Investigations for forensic work. For a more general introduction to file carving, have a look at the Forensic Wiki.

Sorry, I should’ve said that. Using Windows 7 64-bit, NTFS.

7-Zip should open it for windows

WinRAR opens the .tar.gz file, but it’s all source code and I don’t have a compiler or know how to compile it (even if I did have one).

I’m going through the forensic wiki, but a couple of tools there I’m trying still won’t show the file I deleted only hours ago.

Why won’t it show something erased so recently, but will easily show everything from months ago?

JTQ said:

WinRAR opens the .tar.gz file, but it’s all source code and I don’t have a compiler or know how to compile it (even if I did have one).

I’m going through the forensic wiki, but a couple of tools there I’m trying still won’t show the file I deleted only hours ago.

Why won’t it show something erased so recently, but will easily show everything from months ago?

Sorry, what’s the .tar.gz file? As to why the deleted file won’t appear, I don’t know, and with a lot more details probably won’t. File carving tools aren’t very good at recovering compressed files, IME. Was it compressed?