Retrieve accidentally deleted files

Launch a web browser and go to the Osforensics website. Click the large Download Beta button on the right of the page and click the same button on the subsequent page. If the File Download Security Warning dialogue box appears, click Save and choose a location for the downloaded file. Firefox users should select Save File to save the download to Firefox’s default download folder. When the download has finished, locate and double-click the file (called ‘osf.exe’) to start installing the program.

If Windows displays a security warning dialogue box, click the Run button to continue and click Next. Select the option labelled ‘I accept the agreement’ and click Next. Click Browse to choose where the program should be installed before clicking OK followed by Next. Type the name for a new folder in the Start menu where the program shortcut will be placed and click Next. If you would like a Desktop shortcut to be created as well, leave the next box ticked and click Next followed by Install.

Once the installation is complete, read the latest information about Osforensics and click the Next button. Tick the box labelled ‘Launch Osforensics’ and click Finish to start the program and click Yes or No in the pop-up box that appears to indicate whether you are willing to provide feedback about the program’s performance to the developer. In the list of options to left of the screen, click the Deleted Files Search entry, or scroll through the list of icons in the right-hand pane and click the Deleted Files icon under the System Artifacts heading.

Towards the top of the screen, in the centre beneath the Deleted File Search heading, click to open the Disk dropdown menu and choose the hard disk to be searched for missing files. If a disk has been split up into two or more partitions, you will see entries for each. If you know the partition a missing file was stored on, select it. Otherwise, just choose the PhysicalDrive option at the top to search the entire drive (and all the partitions it contains).

Now click the Config button to the right to display the Configuration dialogue box. Ordinarily it makes sense to search only for files that are undamaged but the search can be widened by opting to look for all recoverable files. Depending on the type of file, this could mean some portions may be missing – passages of text or parts of an image, say. Use the Quality dropdown menu to choose between looking for files that the program categorises as being in Excellent, Excellent or Good, or Good condition. If you’re not fussed, choose All Files.

The Configuration dialogue box includes various other options. To eliminate partial word matches, for example, tick the Match Whole Word Only box. If you are looking for folders as well as files, tick the Include Folders box. It is a good idea to leave the ‘Multiple streams only’, ‘File Carving (slow)’ and ‘Image Verification (very slow)’ options unticked, as they will result in slow searches. Use the Min and Max fields below to specify likely file size (in kilobytes), if this is likely to be relevant or useful to your search. Click OK to close the Configuration dialogue box.

There are a couple of ways in which file searches can be performed. Depending on the options set in the previous two steps, type in either the full name of a file you are trying to recover, or type a few letters complete with asterisks as wildcards. For example, typing *letter* into the Filter String field will perform a search for all files that include the word ‘letter’ anywhere in their name, while typing letter* instead means the file name must begin with that word.

To the right of the Filter String box is the Presets menu. By default, Osforensics is configured to search for all types of file, but this can be narrowed down by using this menu. Click the Search button to perform the search and, if too many files are found, use the Presets dropdown menu to reduce the quantity – just click the Apply Filter button after making your choice. Here, for instance, we’re asking Osforensics to limit its search to image files only.

The search results are displayed in the centre of the right-hand side of the program window, under the Deleted Files Found heading. The total number of found files is indicated beneath the results list, while a red, yellow and green colour-coding system is used to indicate the quality of the detected files. Green files are in good order, while those flagged with a red traffic light are likely to be badly damaged. The Sorting dropdown menu to the lower right of the window can be used to manage a lengthy results list.

To restore a file, first right-click its entry in the results list and choose the Save Deleted File option. Now use the Windows Explorer window to choose a new location to save the recovered file. It is sensible to save files to a different storage device – such as an external drive – to avoid the risk of overwriting data that could otherwise be recovered. Repeat this process for as many files as you need to recover.