The IT Nerd

I got this question in my inbox this morning:

Hey IT Nerd. I saw on your Twitter feed a tweet about undelete utilities in relation to the Mayor Rob Ford scandal. I’d like to know how easy is it to recover a deleted file. 

Thanks for the question. Just to wrap some context around this, there is an ongoing scandal involving Toronto Mayor Rob Ford where he for months denied a video of him allegedly smoking crack and using racial and homophobic slurs existed after The Toronto Star and Gawker saw a copy a video with all of the above that was being shopped around by a drug dealer. Last Thursday the video surfaced via the Toronto Police who used a recovery tool of some sort to undelete the video in question along with another one from a hard drive of someone arrested in a gang sweep in June. That lead to this tweet from yours truly:

@TOMayorFord has just learned that undelete utilities work really well to recover videos that don't exist. #CrackGate

— The IT Nerd (@The_IT_Nerd) October 31, 2013

So, here’s the facts on deleting files and getting them back. If you delete a file, it can be recovered. It’s just a question of how hard you need to work to get it back. In many cases, it’s as simple as running a utility such as Recuva which does a great job of bringing back files from the dead. But if you’re dealing with a hard disk that was formatted, you’ll need something more industrial strength. One of the ones on my list is Ontrack EasyRecovery as I’ve found that it does a great job of getting stuff back.

That of course begs the question. If you want to erase something, how do you make sure it stays erased? There’s only three options for that:

• If we’re talking about a single file, then use a tool called Eraser. It is a very easy application to use.
• If you want to reduce the chance that the contents of an entire disk can be recovered, try using Darik’s Boot and Nuke. I wrote an article about this utility here.
• If you want to eliminate the chance the contents of an entire disk can be recovered, I would use Darik’s Boot and Nuke and then physically destroy the hard drive. It sounds extreme, but many companies do that to avoid the possibility that data could be recovered.

Bottom line. If you want to undelete a file, chances are that it can be done. So, if you have anything to hide like sensitive financial records or embarrassing videos, you should take heed and take steps to mitigate that risk.

This entry was posted on November 5, 2013 at 9:35 am and is filed under Tips with tags File recovery. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.