-1

I mistakenly deleted a very important 50 gb file from my 1 tb hard drive, and the file was too big to go to recycle bin. How do I recover it?

  • 3
    This may be a question best suited for a different SE site (maybe superuser?). Are you using Windows Backup or another backup tool? Have you checked the built-in Windows File History tool? As a last resort, you can find file recovery software by googling. Don't use the disk at all if possible until you've recovered the file, to avoid overwriting it. – dwizum Jun 19 '19 at 17:30
5

What you're asking for is called "Carving". This is a program that reads the raw disk (not the directories) looking for start/stop identifiers and attempts to output everything in between the matching filetype start and stop as a file. This is how files are recovered or undeleted, they are still present they're just no longer allocated in the directory after a delete.

Carving needs to be run from another system against the disk being carved. There are numerous carvers available, the classic is "Scapel" but I'm fond of "Photorec". Contrary to its name, Photorec recognizes and recovers hundreds of different filetypes, not just photos. In particular it can be directed to carve only unallocated (deleted) space so you don't end up recovering files that aren't lost.

In your case, a 50GB unallocated space has a pretty high likelihood of being partially over written, and thus unrecoverable, pretty quickly if you continued to use the system. Nevertheless it's worth a try. I would suggest using a bootable Linux system that has file recovery software ready to go. Kali is a good option and you can find numerous Youtube videos to explain file carving.

In the event that file carving fails, there is one other possibility. Windows recovery functions may have a shadow volume of your deleted file. If present, it will be a back version missing the most recent changes but it's easy enough to look for it.

Back versions can be looked for under right-click File/Properties/Previous Versions, but if the file has been deleted you obviously cannot right-click it. Instead you need a Shadow Volume Reader. There are many, but you may want to look at ShadowExplorer.

Good Luck, and let us know your results.

|improve this answer|||||
  • Very good answer. – rockower Jun 19 '19 at 23:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.