Articles

retrieving deleted files 9 months old

January 14, 2011 at 13:12:31
Specs: Windows Vista

Word documents were deleted sometime between 6 to 9 months ago from a council computer system - is it possible for these word documents to be retrieved? How long will the council have saved deleted documents for

See More: retrieving deleted files 9 months old

Report •


#1
January 14, 2011 at 13:41:40

What is a "council"?

Have you checked recycle bin?
Any backups?

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's


Report •

#2
January 15, 2011 at 01:13:00

deleted files are not in recycle bin! A council is a local government authority - part of my question was how long the council would keep deleted information for? I have spoken with some people who have advised that deleted files backups are normally only kept for no longer than 3 months but I don't know if that is correct or not!

Report •

#3
January 17, 2011 at 21:59:12

How long would depend on their bylaws and any legal obligation they are under.

To my knowledge they are not bound under any legal obligation to keep backups whatsoever

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's


Report •

Related Solutions

#4
January 18, 2011 at 04:57:43

have you check Shadow copies

Report •

#5
January 18, 2011 at 06:51:54

if they aren't don't backups they aren't doing shadow copies

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's


Report •

#6
January 18, 2011 at 09:26:56

If they do backups would a document that was hidden be backed up?

Report •

#7
January 18, 2011 at 09:48:16

A document hidden? Not likely.

Depending on the backup software being used, backup normally backups up everything including system/hidden files as well as things like system state which is a collection of system files.

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's


Report •

#8
January 18, 2011 at 12:13:31

On the computer today I found a lot of files that had been hidden - many of them were corrupted and could no longer be read! My understanding is that these would not be copied during backup as they cannot be seen - not sure at all how they have been corrupted and why they are hidden! Some were on my path some on colleagues! It's like someone is up to something but don't know what!

Report •

#9
January 18, 2011 at 12:45:00

Could you explain what you are using to see these "hidden" files and what is telling you they are corrupted?

Are you trying to use data recovery software?

My path and colleagues? What do you mean by this?

What backup software was being used?

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's


Report •

#10
January 18, 2011 at 14:19:39

I followed the guidelines for viewing hidden files! the corrupted files could not be opened properly! Not all the hidden files were corrupted! not using data recovery software! we all have our own individual paths on the computer which is shared with other work colleagues! not sure what back up software is being used!

Report •

#11
January 18, 2011 at 16:12:03

by guildlines you went to tools and options then chose under view for view hidden files right?

How are you determining some of these files are corrupt? They don't open? Not unusual since a number hidden files are system files you are not to be touching.

"individual paths" like to a server share?

What is going on bosscat? Why are you involved in this? It appears you have a basic user understanding of computers but no understanding of how this system is put together that you are trying to find 9month old files on.

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's


Report •

#12
January 19, 2011 at 00:18:18

Yes- the files are corrupt as they do not have the full title name of file - you can see that they are files that have belonged to colleagues or myself but the have a ~ before them! Yes it is a server share!
I am involved as someone copied some of my files "saved as" to make it look as if I had not made the documents until a later date - they then deleted my originals! IT are now trying to restore server to earlier date to see if they can find files that should have existed then - my concern is that they wont be able to find the files as someone may have hidden them, renamed them, corrupted them, emptied their content etc before deleting them!

Report •

#13
January 19, 2011 at 08:39:53

Interesting.

If not using data recovery software then you are looking at temp files. Not going to be a lot of recovery there.

If you have not saved the files in question if you go to its properties and advanced then owner you can see who last saved these files.

Backup, unless configured otherwise, will backup all files except open ones which means if they were marked hidden they would be backed up also.

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's


Report •

#14
January 20, 2011 at 05:23:48

What about the ~ before the file names - does this mean that they are being over written because they have been deleted? Does this mean that it might not be possible to retrieve the files that i originally made over 9 months ago depending on when someone deleted them as they may have been completely overwritten?

Report •

#15
January 21, 2011 at 09:36:47

Please reply!

Report •

#16
January 21, 2011 at 09:47:05

If the file is corrupted then it is corrupted. You may be able to use a HEX editor to find peaces of the clear text and copy it to a new file. You will probably need to use a data recovery company that can use a Bit Reader to access loss data on the drive. This will cost you some dollars though.

You may want to review your backup policy with your network admin. Make sure they keep the data for a specified retention schedule. We use statutes of limitations to determine ours. May want to do the same.


Report •

#17
January 21, 2011 at 10:25:33

Bosscat the tilde in front of the file, in your situation, is a temp file that should have been deleted when the program making it exited but did not delete the file.

This is not to be confused with viewing the drive with a hex editor and seeing files with tildes in front of them. In this case this is an example of a deleted file whose space has been marked as available.

Since its been nine months since these files were possibly deleted, I don't believe you would have any chance of recovery with a data recovery software. That operation has to happen as soon as possible after the deletion if there is any hope of recovery.

There is NO recovery for overwritten files since overwriting occupies the same space, more or less, the original did.

Still no word on the backup restore???

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's


Report •

#18
January 21, 2011 at 11:10:02

No word on the back up restore which tends to suggest that they have not been able to recover data from that far back either from back up or from restore! Will just need to wait and see! Thanks for your explanations - very helpful!

Report •

#19
January 21, 2011 at 11:38:11

Sorry to hear this. Let us know how it works out Bosscat. Thanks

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's


Report •

#20
January 22, 2011 at 02:07:27

Will do! Thanks!

Report •


Ask Question