Product Reviews

Recover Those Files

FileRestore works across the board

• By Douglas Mechaber
• 05/01/2002

According to Mark Russinovich, the co-author of FileRestore, the motivation to start Winternals began with the recognition that there was a “Big problem—a big hole in the ability to recover failed NT systems, without access to NTFS from outside of Windows.” With co-owner and co-author Bryce Cogswell, Russinovich wrote NT Recover and NTFS DOS to provide this access. Most of Winternals’ software is aimed at that sort of problem: enabling administrators to do things that make their lives easier that Microsoft had specifically stated weren’t possible.

FileRestore, a recent addition to the Winternals line, tackles the problem of restoring accidentally deleted files. Sure, the Recycle Bin helps—sometimes. But FileRestore goes much further.

As long as deleted files aren’t overwritten, FileRestore can recover files from FAT, FAT32 and NTFS volumes, including deleted directory contents, emptied Recycle Bin files, or even files that bypassed the Recycle Bin. File-Restore supports Windows 95/98/Me and NT 4.0/2000/XP, Workstation and Server.

Installation proceeded seamlessly, but you must enter a long license string to activate the program. As with all file recovery products, you don’t want to install to a drive that has deleted files you wish to recover. Detailed instructions for an emergency installation are on the Web site or under Help. Basically, in an emergency you would install or copy key files to a shared folder or removable media and run from there.

FileRestore offers a completely intuitive interface, as it looks like the Windows 2000 search window, with the addition of showing deleted files. FileRestore includes only two menu choices—File and Help—but the left pane has choices for setting name, directory, date ranges when last modified and size range of deleted files. The right pane shows the file, date, size and prospects for full recovery. Unlike Norton Utilities, FileRestore uses a collected view of the disk to determine what’s in use vs. what’s coincident with recoverable files. Then the display of recoverable files shows how many clusters are recoverable, out of the total clusters in the file, of those files marked “Unlikely to be fully recovered.”

FileRestore locates deleted files and estimates their recoverability. (Click image to view larger version.)

FileRestore worked extremely well. I tested it on NT Server (SP6), Win2K Server (SP2), and a DOS boot sector. In all cases, FileRestore showed a large number of recoverable and unrecoverable files, including temporary and other system files that I unknowingly deleted. Only in the DOS volume was the first character missing of the potentially recoverable files.

What’s next? Sometime this summer, Winternals plans to release a new version of FileRestore that will be network-enabled. The administrator will be able to recover deleted user system files from the server or the administrator’s home system. That will just make an already-good product even better.