Recovering missing or erased files

Recovering missing or erased files copyright 2004 Symantec

When you erase a file using Windows Explorer, Windows keeps a temporary copy of the file in the Recycle Bin. However, Windows does not detect files that were erased or overwritten by applications that are running in Windows, erased from a command prompt, or deleted using a permanent method, such as using Shift+Delete.

If you are unsuccessful in recovering a file using the Norton Protected Recycle Bin or the UnErase Wizard and you have Norton GoBack installed, consider using Norton GoBack to revert your disk to an earlier state when you knew the file existed.

More Information


About Norton Protection

About Norton Protection copyright 2004 Symantec

The Norton Protected Recycle Bin protects the following types of files:

  • Files that are deleted while you are using the command line
  • Files that are created and deleted by Windows applications
  • Older versions of files that you modify and overwrite
  • If the standard Windows Recycle Bin is not enabled, Norton Protection also protects files that would otherwise be under Recycle Bin protection

Files that are shared on a network or stored on a network server and files that were deleted while you were using your computer in DOS mode rather than Windows are not protected.

The Windows 2000/XP operating systems only track ownership and rights on NTFS volumes. With NTFS volumes, you are told how many files are yours before you purge them. If you delete a file on a FAT/FAT32 drive, the system does not differentiate between your files and those belonging to another user. When you purge your files, the system also purges all the files to which the other user has access, which includes all files on FAT/FAT32 volumes.

To configure Norton Protection

  1. On the Windows desktop, right-click the Norton Protected Recycle Bin, then click Properties.
  2. On the Norton Protection tab, do the following:
    • Make sure that Enable Protection is checked for each drive you want to protect.
    • If you want to remove files from protection after a specified number of days, check Purge protected files after and set the number of days in the box.
  3. On the Recycle Bin tab, do the following:
    • Select the item to open when the Recycle Bin icon is double-clicked.
    • If you want to change the name of the Recycle Bin, in the text field, enter a name.
  4. On the Global tab, do the following:
    • If you want to receive confirmation when files are deleted, check Display delete confirmation dialog.
    • If you want to delete items without placing them in the Windows recycle bin, check Do not move files to the Recycle Bin.
    • Use the slider to set the maximum size of the Recycle Bin.
      • Files larger than the maximum storage size will be deleted immediately.
  5. When you have finished, click OK.

If you start your computer in DOS mode, you may find that DOS reports less free disk space than expected. This discrepancy is because DOS does not deduct the space used by deleted files protected by Norton Protection.


Specify file and folder protection

Specify file and folder protection copyright 2004 Symantec

Norton Protection automatically protects most files that are left unprotected by the Recycle Bin. Certain types of files, however, are excluded by default. For example, it generally makes sense not to protect temporary (TMP) files that Windows applications regularly create and delete.

To save space, you can configure Norton Protection to exclude certain file types or folders from protection. You can also specify file types or folders to include in protection as you find it necessary. For example, you may want to specifically include the ~$*.tmp backup files created by your word processor, even though they are technically temporary files.

Norton Protection helps you recover files that the Windows Recycle Bin misses, so these exclusions don't work on files that go into the Recycle Bin, such as files you delete in Windows Explorer.

Your entries on the Norton Protection Exclusion List are evaluated in sequence. Inclusions supersede exclusions, and any file type or folder that is not specifically excluded in the list is included by default. The following table describes how to form an exclusion.

Syntax | Description
-temp\ | Removes protection from the contents of all folders named "temp" anywhere on all drives. This protects the contents of all folders below "temp" also.
-\temp\ | Removes protection from the contents of all folders named "temp" that appear in the root of all drives. This applies to the contents of all folders below "temp" also.
-temp | Removes protection from any file named "temp" in any folder on any drive.
-\temp | Removes protection from only files that are named "temp" and that appear in the root of any drive.
-\temp\**\*.tmp | Removes protection from all files named "*.tmp" in any folder under "\temp\" on any drive.
-*.tmp | Removes protection from all files with the ".tmp" extension in all folders on all drives.
c:\work\junk | Specifies a folder: The drive name, a colon, a backslash, the folder name, and the name of each subfolder separated by a backslash. Any subfolders contained by folders you specify are also excluded.
c:\ | Specifies a drive: The drive letter followed by a colon and backslash. Folder names must have a \ (backslash) at the end to differentiate them from file names.

To specify file and folder protection

  1. On the desktop, right-click the Norton Protected Recycle Bin.
  2. Click Properties.
  3. On the Norton Protection tab, click Exclusions.
  4. In the text box, type the exclusion or inclusion character. Your options are:

    Exclusions

    Type - (the dash character)

    Inclusions

    Type + (the plus character)

  5. Type the items that you want to include or exclude. Your options are:

    File type

    Type the complete path followed by an asterisk (*) and the file extension.

    Folder

    Type the drive letter followed by a colon, a backslash, the folder name, and the name of each subfolder separated by a backslash. Any subfolders contained by folders you specify are also excluded.

    Drive

    Type the drive letter followed by a colon and backslash. Folder names must have a \ (backslash) at the end to differentiate them from file names.

    File

    Type the file name.

    Wildcard

    Type asterisks (*). One asterisk replaces a single letter. Two asterisks replace a complete file or folder name.

  6. Select the action that you want to take.

    7. Your options are:

    Insert | Lets you add a file or folder to the list of those not under Norton Protection. This command button is not available until you have entered text in the text box to the left.
Remove | Deletes the selected line from the exclusion list for Norton Protection. This command button is not available until you have selected an item from the list box.
Defaults | Resets the list to show those file types excluded from Norton Protection by default. This removes any custom inclusions or exclusions that you have added.

  7. Click OK.


About UnErase Wizard

About UnErase Wizard copyright 2004 Symantec

UnErase Wizard helps you recover deleted files from the Norton Protected Recycle Bin. In Windows 98/Me, UnErase Wizard can also help you restore files that were unprotected by Norton Protection. Windows 2000/XP can only recover files that were deleted while Norton Protection was turned on.

UnErase Wizard also helps you recover files that are deleted from the standard Windows Recycle Bin, or Novell's Salvage (for recovery of files on a network). In Windows 98/Me, UnErase Wizard frequently recovers unprotected files as well, even those that were deleted from the Recycle Bin.

If you have a dual boot system and the volume that contains deleted files is not NTFS, you can use UnErase Wizard in Windows 98/Me to recover deleted files.

Using UnErase Wizard, you can search for a deleted file by its file name and by words that you think the file may contain. This is especially useful if you can't remember the file name, but you do remember its contents.

Don't use UnErase Wizard to recover and overwrite files that have existing copies in use by either the system or running applications. Examples include SYSTEM.DAT, USER.DAT, applications' registry (.DAT) files, and any applications or DLLs in the Windows System folder.

In many cases, Norton Protection saves files that are overwritten with newer versions. This lets you retrieve earlier versions of the overwritten files.

Recover a file with UnErase Wizard


Recover a file with UnErase Wizard

Recover a file with UnErase Wizard copyright 2004 Symantec
In Windows 98/Me, installing Norton SystemWorks can overwrite erased files on your hard disk. If you want to try to recover erased files before you install, you should run UnErase Wizard from the program CD.

UnErase Wizard displays a list of deleted files or the files that conform to file name criteria that you provide. Each file is described by its name, original location, the date it was deleted, file type, file size, and the program that was used to delete it. You can view the contents of a file before or after you recover it.

On Windows 2000/XP, deleted files are not recoverable if they were excluded from Norton Protection and deleted, or if they were protected but deleted from the Recycle Bin before you used UnErase Wizard.

To recover a file with UnErase Wizard

  1. On the left side of the main window, click Norton Utilities > Find and Fix Problems.
  2. Click UnErase Wizard.

    3. In the UnErase Wizard dialog box, depending on your operating system, the default selections are:

    Find recently deleted files (Windows 98/Me default) | Searches for the names of the most recently deleted files and displays up to a maximum of 25 deleted files. It's best to try this option first.
Find all protected files on local drives (Windows 2000/XP default) | Searches for and displays the names of all of the deleted files that are protected by Norton Protection or the Windows Recycle Bin on your computer.
Find any recoverable files matching your criteria | Prompts you for search criteria. Use this option if you are looking for words that are contained in a deleted file. Create a customized list of deleted files
Find all Norton Protected Users files (Windows 2000/XP only) | Searches for other users' protected files as well as your own.

  3. Do one of the following:
    • Accept the default selection.
    • Select another option.
  4. Click Next.
    UnErase Wizard displays a list of the most recently deleted files.
  5. If you are using Windows 98/Me and your deleted file is not listed, click Next.
    UnErase Wizard guides you through the process of creating a more complete list of deleted files from which to select.
  6. Select the file that you want to recover.
  7. Click Recover.
    If you want to examine the recovered file, make a note of the recovery destination.
  8. To close UnErase Wizard, click Finish.
A recovered file's name might have a question mark (?) in place of the first letter. If so, you are prompted to type the first letter of the original file name. If you do not know what it is, type any letter from A to Z as a substitute. Make a note of the file name so that you can find it later.

If you delete a file on a floppy disk from a DOS prompt by specifying file name letters after a wildcard (such as DEL *ILENAME.TXT as opposed to DEL FILENAME.TXT or DEL *.TXT), the file is listed as unrecoverable on the Recently Deleted Files page.

To see if a file is recoverable

  1. In the center of the file list, right-click, then click Show Unrecoverable Files.
  2. Click Next.
    Use the UnErase Wizard to search for and recover the files.

Create a customized list of deleted files


Create a customized list of deleted files

Create a customized list of deleted files copyright 2004 Symantec

In Windows 98/Me, if the file that you wanted to recover does not appear in the protected files list, you can create a customized list using the criteria you specify.

To save space, you can configure Norton Protection to exclude certain file types or folders from protection. You can also specify file types or folders to include in protection as you find it necessary. The following options are available in Windows 98/Me:

Item | Description
Name | Shows the name of the file. If multiple files are selected, describes the selected files.
Type | Shows the type of the file. The type is determined by the file extension (the characters following the last period in the filename).
Size | Shows the number of bytes in the file. If multiple files are selected, shows the total bytes in the selected files.
Origin | Shows the location of the file before it was deleted.
MS-DOS name | Shows the MS-DOS name of the file, which may be different from the Windows filename. MS-DOS imposes more restrictions on filenames than Windows. For example, MS-DOS filenames are limited to a maximum size of eight characters followed by a period and three final characters.
Attributes | Shows what attributes are set for this file. Up to four attributes can be set:
Archive File has not been backed up since it was last modified. | Read-only File can be read but not modified.
Hidden File is normally hidden from view. | System File is a Windows, DOS, or other system-related file. System files are normally hidden from view.
Created | Shows when this file was created.
Modified | Shows when this file was last modified.
Accessed | Shows when this file was last opened.
Deleted | Shows when this file was deleted.
Deleted By | Shows the name of the application used to delete this file, if known. If the file is under Recycle Bin protection, the name of the application is always Explorer.
Protected By | Indicates whether this file is under Norton Protection, Recycle Bin protection, Novell Salvage protection, or no protection.
Status | Indicates that this file is either recoverable (still intact on the disk) or unrecoverable (partially or completely overwritten on the disk).
Show splash screen | Determines whether the Introduction screen is displayed the next time you start UnErase Wizard.
Last 25 files | Tells UnErase Wizard to look for the names of the last 25 files that were deleted.
Find all protected files on local drives | Tells UnErase Wizard to look for the names of all protected files on your local drive those protected by Norton Protection, Recycle Bin, or Novell Salvage.
Find any recoverable files matching your criteria | Tells UnErase Wizard to look for the names of any files it can recover, matching criteria you specify.
Folder | Displays the name of the folder the file was in when that file was deleted.
Quick View | Displays all files that met the selection criteria: all recently deleted files, all files protected on this computer, all deleted files matching your custom Displays the content of the selected file, using the Windows Quick View program. This is faster than opening the file with the application that originally created it. You can also right-click a filename and choose Quick View from the context menu.


Eliminating data permanently

Eliminating data permanently copyright 2004 Symantec

Wipe Info lets you remove selected files or folders from your hard disk. You can also wipe free space from your hard disk, ensuring that previously deleted sensitive information is not left behind.

If you are running a recovery application such as System Restore or Norton GoBack, you must erase your history before running Wipe Info to ensure that the data is completely wiped.


About Wipe Info

About Wipe Info copyright 2004 Symantec

Wipe Info erases files or folders from your hard disk so that they cannot be recovered. Wipe Info can also wipe the free space on your hard disk.

When you wipe a file, Wipe Info wipes the file and attempts to wipe any free space that is associated with the file and the file's directory entry.

When you wipe a folder, Wipe Info wipes all of the files in the folder, and then, if the folder is empty, it attempts to wipe the directory entry for the folder.

When you wipe free space, Wipe Info wipes the free drive space, free file space, and erased file entries.

In general, you cannot recover files that have been wiped. Windows Me/XP System Restore can restore files that have been wiped if they are one of the protected file types. By default, many document types, such as .doc and .xls files in My Documents, are protected. Windows Me/XP System Restore maintains copies of protected files. Wiping the original file does not wipe the copy that Windows Me/XP System Restore maintains.

Wipe Info eliminates a file's contents from the disk, but does not remove the file name. While the file name remains on disk, it is no longer visible in Windows Explorer, and there is no data stored with it. On NTFS volumes, streams (alternate data that belongs to a file but is not stored with the file) are also wiped.

Never store sensitive information in a file name or attribute. This data can be replicated throughout your system without your knowledge, for example, in a list of most recently used files, or a file name search. This type of embedded information can be very difficult to remove from your computer.


About hexadecimal values

About hexadecimal values copyright 2004 Symantec

Wipe Info uses hexadecimal values to wipe files. Hexadecimal refers to the base 16 number system. This system is used by computer programmers to represent numbers in the binary number system, which uses the zero and one symbols in combinations to represent any number.

The hexadecimal system consists of the numbers 0 to 9 and the letters A to F, used in combinations. For example, the decimal number 14 is represented as the letter E, as in 0Eh in the hexadecimal system.

In Wipe Info options, you can specify values from 00 to FF, representing numbers from 0 to 255 respectively. You can type the value using a number or a character from A to F.


About the Government Wipe process

About the Government Wipe process copyright 2004 Symantec

When you select Government Wipe, Wipe Info does the following:

  • Overwrites the data with 00s
  • Verifies the 00 overwrite
  • Overwrites with FFs
  • Verifies the FF overwrite
  • Writes a random value, or a value that you choose from 00 to FF
  • Verifies the random overwrite
  • Reverifies the random overwrite to ensure that it was written correctly
  • Repeats as many times as you specify, up to 100


Customize Wipe Info

Customize Wipe Info copyright 2004 Symantec

You can specify how Wipe Info handles hidden, read-only, and system files. You can also specify the type of wipe to use. The following wiping methods are available:

Fast Wipe | Overwrites the data that is being wiped with the hexadecimal value of your choice
Government Wipe | Combines several wiping and overwriting processes to conform to specifications in DoD (United States Department of Defense) document 5220-22-M, National Industrial Security Program Operating Manual, for the ultimate security level when eliminating data from digital media About the Government Wipe process

To customize Wipe Info in Windows 2000/XP

  1. On the left side of the main window, click Norton Utilities > System Maintenance > Wipe Info.
  2. In the Wipe Info window, on the View menu, click Options.
  3. On the General tab, select the options for Read-only, System, and Hidden file types.
  4. On the Wipe Type tab, select one of the following:
    • Fast Wipe
    • Government Wipe
  5. In the Hex Value text box, type the hexadecimal values that Wipe Info should use when it overwrites the wiped files space.
  6. In the Times to Perform This Wipe text box, type the number of times that Wipe Info should repeat this process.
  7. Click OK.

To customize Wipe Info in Windows 98/Me

  1. On the Options menu, click Norton Utilities > Wipe Info Settings.
  2. On the Wipe Info Settings tab, specify the settings that you want. Your options are:

    Display Wipe Info icon on the desktop

    Create a Wipe Info shortcut on the Windows desktop. You can drag items to this icon to wipe them.

    Number of times to repeat the delete

    Type the number of times that you want Wipe Info to repeat the wiping process.

  3. Select a wipe type. Your options are:

    Fast Wipe

    Under Write once the value, specify the value that Wipe Info should use when it writes over the wiped file space. The value can be up to 9 digits, and the default is 0 (zero).

    Government Wipe

    Under Number of times to repeat this, specify the number of times that Wipe Info should repeat the process of writing all 1s and 0s, then type the value that Wipe Info should use for a final write. The final write is verified to ensure that no disk errors caused sensitive data to survive the wiping process.

  4. Click OK.

About hexadecimal values


Wipe files or folders

Wipe files or folders copyright 2004 Symantec

The procedure for wiping a file varies based on the operating system on your computer. To wipe a file or folder in Windows 2000/XP, add it to the Wipe Info window. In Windows 98/Me, Wipe Info uses a wizard to automate the wiping process.

You have the following options when wiping files, folders, or free space:

Files | Wipe Info deletes the selected file, its directory entry if possible, and any associated free space.
Folders | You can specify whether subfolders should be included. Wipe Info deletes all files in the selected folder, its directory entry if possible, and any associated free space.
Free Space | Wipe Info wipes the free space on the selected disk. This includes free disk space, file slack space, and erased file entries that are not in the Recycle Bin. (You must empty the Recycle Bin to have deleted files wiped.) Wipe Info verifies the disk's integrity before wiping free space. If the disk has problems, you are prompted to run Norton Disk Doctor.

In general, you cannot recover files that have been wiped. See About Wipe Info for information about files that are protected from deletion or that can be restored.

To wipe files or folders in Windows 2000/XP

  1. On the left side of the main window, click Norton Utilities > System Maintenance > Wipe Info.
  2. In the Wipe Info window, click Browse.
  3. Select one of the following:
    • Folders
    • Files
  4. Select the folder or file to delete.
  5. Click Open.
  6. If you add an item to the list by mistake, select the item, then right-click and select Remove Item(s) from list.
  7. Click Wipe All.
  8. If a warning message appears, click Yes to confirm the deletion.
    Files in the list are wiped, if you have permission to delete the files.

As a short cut, you can drag the selected item from your desktop to the open Wipe Info file list. Continue to drag all of the files and folders that you want to wipe into the Wipe Info list.

To wipe free space in Windows 2000/XP

  1. On the left side of the main window, click Norton Utilities > System Maintenance > Wipe Info.
  2. On the Actions menu, click Wipe Free Space.
  3. In the Wipe Free Space dialog box, select a disk.
  4. Click Go.

To wipe files or folders in Windows 98/Me

  1. On the left side of the main window, click Norton Utilities > System Maintenance > Wipe Info.
  2. In the Wipe Info Wizard, select Files, Folders, or Free Space, then click Next.
  3. Select the file, folder, or disk, then click Next.
  4. If you see a warning message, click Yes to proceed.
  5. For Wipe Options, select one of the following:
    • Fast Wipe
    • Government Wipe
  6. In the Wipe Summary window, review what Wipe Info will do, then click Next.
  7. If you want to change any selections, click Back.
    Wipe Info displays its progress and summarizes the results, including any problems that were encountered during the wiping process.
  8. View the results, then click Close.

Customize Wipe Info