The Undelete plugin allows you to recover deleted files from NTFS, FAT12, FAT16, FAT32, and exFAT partitions. On NTFS partitions, it also restores ADS (alternate data streams), compressed, and encrypted files. You can recover files and directories from all local volumes (mounted to drive letters or to directories, or even not mounted) and also from disk image files.
See the File System and Menu Extension sections in Using Plugins for a description of basic operations with file system plugins and menu extensions.
Each file on a disk is stored in short blocks called clusters. After a file is deleted, its clusters are only marked as free; the actual data remain on the disk until the clusters are reused for a different file. If used early enough, the Undelete plugin can find the clusters of the deleted file and copy them to a new file on another volume.
It is important to avoid writing any data to the volume containing the deleted file so that the deleted clusters are not overwritten. This also means that deleted files should only be recovered to a different volume to avoid overwriting the deleted files themselves. If there are no other volumes on your computer usable for recovery, removable media (e.g., diskettes, USB disks) and network drives are also good candidates.
On FAT partitions, it is unfortunately not possible to reliably identify all clusters of a deleted file, especially if the file was very large. A heuristic algorithm must be used, and its results may be incorrect. This applies to all undelete programs.
In general, successful recovery of deleted files is not guaranteed, and the recovered data may be damaged. Always verify that the recovered data is valid.
The probability of recovering a deleted file is displayed in the Condition column (switch the panel to Detailed view):
| Good | File is not deleted, or is MFT-resident, or is deleted but no collision with other deleted or existing files was detected. | Good chance of recovering the entire file. |
| Fair | Some clusters of the deleted file conflict with clusters of other deleted files. | Smaller chance of recovering the entire file. |
| Poor | Some clusters of the deleted file conflict with existing files. | Some parts of the file are certainly damaged. |
| Lost | All clusters of the deleted file are used again by existing files. | Zero chance of even partially recovering the file. |
| Unknown | Damage estimation failed or was not performed at all. |