Deleted Files Not Gone Forever

• 06/28/2000

For several years, Executive Software International (www.diskeeper.com) has produced Undelete, a software program that makes it possible to recover accidentally deleted files on remote systems -- including client workstations and network file servers. In February, Executive Software shipped version 2.0 of the product, which features support for Microsoft Corp.’s new Windows 2000 Professional, Windows 2000 Server, and Windows 2000 Advanced Server operating systems.

Undelete 2.0 is available in both client and server versions. If files are to be recovered on remote systems, however, Undelete 2.0 must be installed on these machines, as well.

We installed Undelete 2.0 on a Windows 2000 Advanced Server test machine; a Windows NT 4.0, Enterprise Edition, test machine with Service Pack 6a (SP6a) and NT 4.0 Option Pack installed; two Windows 2000 Professional test machines; and two Windows NT 4.0 test machines with SP6a installed. Executive Software recommends that on Windows NT 4.0 systems, SP3 or later should be installed.

The Workstation version of Undelete 2.0 can only be installed on Windows 2000 Professional or on Windows NT 4.0 Workstation. Conversely, Undelete 2.0 Server can be installed on Windows 2000 Server or Advanced Server, Windows NT 4.0 Server, Windows 2000 Professional, and Windows NT 4.0 Workstation.

Undelete 2.0 doesn’t actually undelete most files. It intercepts files as you delete them, storing them in what Executive Software calls a Recovery Bin. Undelete 2.0 can intercept files as they are deleted in a variety of environments -- including the MS-DOS command prompt -- and can move them to any of a number of prespecified Recovery Bins. You can create as many Recovery Bins as you need -- a good idea for a busy file server.

We used Undelete 2.0 in a variety of configurations, each time essentially playing upon the theme of recovering unintentionally deleted files. As soon as Undelete 2.0 is installed on a client or server, it can be automatically configured to protect discrete physical disk drives and mapped network drives. A user can also create exclusions lists to prevent Undelete 2.0 from protecting individual files or folders.

Undelete 2.0 can restore files in just about any set of circumstances. In one case, we deleted several files on a network file server and then attempted to recover them using a different user account. Because the account we used in our recovery attempt didn’t have the appropriate access privileges for the deleted files, we were unable to do so. Using the account that created the files, we were able to restore them without difficulty.

We also deleted files on the physical disk drives of some of our client workstations. In all cases, Undelete 2.0 recovered them without difficulty.

Recovering files is a simple enough affair in Undelete 2.0. All that we had to do was double-click on the Recovery Bin from which we wanted to restore a file or files and then choose the Recover button that was displayed in the bin’s Explorer-type interface. At that point, a list of the "deleted" files contained in the Recovery Bin appears for choosing the specific files wanted for restoring.

The size of the Recovery Bin can be set by right-clicking on it, choosing the Properties tab, and then specifying the specific size. Size is important with this tool; when the Recovery Bin is full, it deletes older files and replaces them with new ones. You may want to choose a Recovery Bin size that gives you a large enough window to restore files that have been deleted for days.

Recovery Bin’s Properties tab is also used to choose which disk volumes on our clients and servers we wanted to protect. On a more granular level, we were able to create a single, common Recovery Bin for an amalgam of drives, or individual Recovery Bins for separate drives.

Executive Software recommends against using a single, common Recovery Bin on network file servers. The company says multiple deletions across the network can cause significant I/O overhead, negatively impacting server performance. Instead, Executive Software recommends creating a Recovery Bin for each drive attached to a network file server.

One possible problem with Undelete 2.0 is that a number of end users could have access to a common Recovery Bin, if set up that way. While these users wouldn’t be able to recover the deleted files of other users, they would be able to see these files and their names. Suggestive or otherwise revealing filenames could compromise sensitive information.

Undelete 2.0 is a management-friendly product. We were able to use its Connect feature to link to networked clients and manage their Recovery Bins. In this regard, we were able to manipulate the size of client Recovery Bins and recover deleted files.

Undelete 2.0 worked just as well under Windows 2000 Advanced Server as it did under Windows NT 4.0, Enterprise Edition. On the client side, Undelete 2.0 performed without problems.

Undelete 2.0 is an essential tool for Windows NT or Windows 2000 file serving environments. With Undelete 2.0 on watch, IT managers don’t have to worry about users accidentally deleting files on network. Undelete 2.0 provides features dubbed Undelete from Disk and Emergency Undelete that help you recover files that, for one reason or another, may have been truly deleted.

All in all, Undelete is an impressive tool -- made all the better by the addition of support for Windows 2000.

[[Infobox]]

Undelete 2.0 
Executive Software International, Glendale, Calif.
(818) 547-2050
www.diskeeper.com

Price: Estimated price is $49 for Workstation version, single licenses; $249 for Server version.
Please also note that there is volume licensing for a minimum of 20-licenses.

+ Provides a proven method of recovering deleted files, even over network shares

+ Runs out-of-the-box on Windows NT 4.0/2000

+ Facilitates recovery of files that have actually been deleted from disk

- Common recovery bins on network file servers accessible by all users could potentially compromise sensitive information