|
Contents > Procedures
3.2.1. Locating Deleted Data
Search for files using one of two methods. If you know names of
deleted files or folders, skip down to the next method below.
Scanning Drive or Folder Locations
If you do not know names of deleted files or folders, scan drive or
folder locations using these steps:
- Select the drive or the folder that you suspect contains the
deleted files and scan it by pressing [Enter].
- This method will detect the names of all files and folders
recently deleted. Once detected, deleted files are marked with a
block-type mark on the left side, as depicted below.
Figure 3-4 Deleted Files Identified
- If the specific files or folders you are looking for are not
detected, try scanning another folder or drive location.
Searching for Files by Name
If you know the name or part of the name of the deleted files or
folders, create a search pattern, similar to a search in Microsoft DOS or Windows.
The asterisk or star symbol (*) is used as a wild-card character.
The search engine looks for the file name, replacing the star with any
number of characters.
The question mark symbol (?) is used
to replace a single variable character. The search engine looks for
the file name and replaces the question mark with another single
character.
Table 3-1 Examples of Searchable Expressions
|
Example
|
Search Results |
|
* |
- All named files and folders |
|
*.TXT |
- All files with the suffix "TXT" |
|
My*.* |
- All files starting with "My" |
|
My p????. |
- All files starting with "My p" text, having eight characters in the file name and no suffix or extension |
|
MyFile.txt |
- Only the file named "MyFile.txt" will be displayed, if found |
Use the following steps to search for files by name:
- In the Logical Drive Information Display, select the drive you
think contains the deleted files and press [Ctrl]+[F]. The Search Dialog screen appears.
- Enter the exact filename or search pattern in the Search Dialogue
Type field and press [Enter]. The search will begin.
- You can stop the search process at any time by pressing [Esc].
- Files matching the search pattern are displayed, similar to the
figure below.
Figure 3-5 Results Matching Search Pattern
- If the specific files or folders you are looking for are not
detected, move the cursor over another dirve or folder area and press
[Ctrl]+[F] to continue
searching.
- If the specified file or folder is detected, press [Enter] to go
directly to the folder location or press [Esc] to cancel further search activity.
Checking For Recover-ability
Use the above procedure to identify deleted files. Identified files
may or may not be recoverable. Use the procedures below to inspect the
content of files and folders to see if the data is worth recovering.
Checking an Identified File Deleted files and folders are marked
with a box icon to the left of the file name.
- Position the cursor on an identified, deleted file.
- Press [Enter] to check the file's recover-ability. A
restored file preview screen will appear.
Figure 3-6 Restored File Recovery Check
If the file’s content can be viewed, similar to above example, the
file is recoverable.
If an error message is displayed, data in the file is corrupted and
the file is not recoverable.
Checking an Identified Folder Check for a folder's
recover-ability in a way similar to the file check procedure:
- Deleted files and folders are marked with a box icon to the left
of the file name. Move the cursor to the identified folder and open
it by pressing [Enter].
- If an error message appears, the folder is not recoverable. If
names of files or sub-folders are displayed, the folder is
recoverable.
(!) Note: Once a deleted file is located, do not write or save any
files to this drive. The process of writing or saving data onto a drive might damage the
header portion of deleted files or folders. If the header is damaged or overwritten,
the file is unrecoverable.
Previous < Contents >
Next
| 
