Welcome to the quick-start guide for iUndelete


iUndelete helps you recover deleted documents, photos, archives or any other file type from hard disks, removable drives, cameras etc.. 

Unlike many other deleted file recovery utilities, iUndelete tries to make deleted file recovery as simple as possible. Although file systems are complex, the procedure for locating deleted files is fairly straight forward because the file system itself is intact. iUndelete's interface reflects this 'straight-forwardness' to avoid the need for 'wizards' as seen in so many other, overly complicated undelete software.

iUndelete features:

  • Works in Microsoft® Windows® NT, 2000, XP, 2003 Server, Vista, Windows 7.
  • Supported file systems: FAT12, FAT16, FAT32, NTFS (NT 4), NTFS5 (2000, XP, Vista/Windows 7).
  • Recovers compressed files (NTFS, NTFS5), files are decompressed on-the-fly.
  • Recovers encrypted files (recommended procedure: recover TO NTFS5 drive).
  • Ignores file access rights (NTFS)
  • Recognizes localized names.
  • Long filename support (FAT12,FAT16,FAT32)
  • Undelete folders with subfolders
  • File Preview
  • Status of deleted files

iUndelete can restore:

  • Files and Folders deleted from the Recycle bin.
  • Files that bypassed the Recycle bin (files deleted by programs or other actions that ignore the Recycle bin).
  • Common folders such as My Documents, My Pictures and other.
  • Photos deleted from digital cameras.
  • Files and folders deleted when using the command line.
  • Files deleted after virus or worm attack.
  • Files lost after quick formatting (NTFS)

From various storage media including:

  • Hard Drives
  • Digital cameras
  • Floppy disks
  • Zip Disks
  • Jaz Disks
  • Sony Memory Sticks
  • Compact Flash cards
  • Smart Media Cards
  • Secure Digital Cards
  • Any USB disks

Follow these easy steps to get your deleted files back:

  • First of all, download and install iUndelete. If you need to recover files from a system drive use the "portable" EXE (no setup required) and run that from a removable device.

  • STEP 1: Select the drive containing the deleted files and click 'Scan'. Wait for the scan to finish; usually this will take from a few seconds up to a few minutes depending on the size of the volume and the amount of files found.



  • STEP 2: After the scan has finished, use the Folder Tree to browse to the files you need to recover. Select items in the File List to select them for recovery. You can select multiple items by holding the SHIFT or CTRL key while selecting items.
    Pay special attention to the 'Status' column:

    The percentage displayed for each file represents the total amount of space previously (before deletion) allocated to the file that has not been overwritten yet. In general, if the status is 100% then the file is fully recoverable, but this is not a guarantee. Anything between 100%  and 0% means the file has been partially overwritten.

    Note that after a file has been deleted, the space previously allocated to the file is marked as 'available' (to store new data). The Windows file system driver can decide to use this available space entirely or partially at any time. For this reason:
    • Recover files as quickly as you can after deletion was discovered
    • Do NOT save/install undelete software to the drive containing the deleted files
    • Do NOT save the files you want to recover to the drive you are recovering the deleted files from

    Using the directory browser, select the location where the recovered files should be saved. Do NOT save the files to the same drive you are recovering files from!

    iUndelete can generate a preview for the selected file. A preview is generated on-the-fly from the actual file data. iUndelete can generate a RAW dump for any file type in Binary, Text, Hex or Unicode format. This may help you determine if a file is intact. Plain text files should be readable in Text Preview if the file is intact.
    Many file types contain recognizable headers which you can verify with the RAW file preview. For example, a PDF file starts with the characters %PDF     in Binary View. Gif files start with GIF and MP3 files with ID3. On the internet you will find many lists of 'file signatures' for known file types. If iUndelete detects a valid header for a BMP, JPEG or a GIF type file in the file stream it will attempt to generate an image preview from that stream. If a successful preview is displayed that file is 100% recoverable.

           

    Using filters:

    If the drive contains a lot of deleted files you may want to use filters to display only those files or file-types you are interested in. All folders in the left pane that do NOT contain files that meet your filter criteria will be hidden. This makes finding your files a lot easier.

Menus and Buttons

The Scan and Recover buttons can be expanded, for the default action you can just click the buttons.



The Scan button will scan the selected drive. Default action is the quick scan, it will only show deleted files. Use a long scan when it is desired to see both deleted and current files. If NTFS DeepScan is enabled iUndelete will scan the (NTFS) drive cluster by cluster to discover files. It can be used to recover files after an accidental (quick) format.

The Recover button will initiate the recovery for currently selected items in the file list. A dialog window opens to allow you to select a destination drive. Alternatively you can recover the highlighted folder from the directory tree. This will affectively select all items that are currently in the file list.

The File Menu



Scan: Run a default scan (quick).

Recover: Open dialog to recover currently selected items from the file list.

Preview: Preview currently select item in the file list. 

The Edit Menu


Advanced Filters: Allows you to set filters. You can use simple filters by name mask (*.jpg; *.bmp - will show only files with the JPG and BMP file extension), You can include files by date, size and file attributes.

Select All: Select all items in the file list.

The Options Menu


Enable NTFS DeepScan: Runs a cluster by cluster scan on the selected (NTFS) drive after the Long scan.

The View Menu



Expand Folder Tree: Expand all nodes (directory tree)

Collapse Folder Tree: Collapse all nodes

Show good files only: If True, iUndelete will hide all items with a status score < 100%.

I can not find my files, or my recovered files are corrupt!

If you are unable to locate your deleted files in iUndelete, or if you find you are unable to open files after recovery then the files are probably beyond recovery! This is not a limitation of iUndelete, but the result of how file systems and operating systems work.

  • If iUndelete does not display your deleted files at all, then the file system structures that previously 'described' the file have been overwritten (re-used).
  • If the files recovered using iUndelete appear to be corrupt even though 'status' displays 100% then:
    - the space previously allocated to the deleted file has been overwritten after iUndelete examined the file system
    - the space previously allocated to the deleted file has been re-used (read: overwritten) by another file that was then again deleted
  • If you can not locate a deleted folder that contained the data that you want to recover, it is possible that the directory information for the deleted folder was lost. The files within that folder however may still be recoverable! iUndelete generates directory names for lost folders that look like '$folder_nnnn'. These can be found directly under the root or within subdirectories. Use filters to locate your files.

www.diydatarecovery.nl