The majority of users does not really know about this. Most think for instance that deleting files will delete them completely, which is not the case. Here is a collection of five different locations and ways to find out more about a previous computer user. You can use the information on your own computer, to see if a third party could grab those information from yours as well.

1. Display Deleted Files

Deleted files are not directly deleted by the operating system. Even if you delete them directly or make sure to delete the trashcan as well. Why? Because it is faster to simply delete information about the file, than the file itself. While you won’t see the file anymore in your OS, it may still be fully accessible on the hard drive of the computer. Someone with the right set of tools could recover the files to get access to what you have been deleting.

Tools for the job:

• Disk Digger
• Glary Undelete
• Panda Recovery
• Recuva
• Undelete Plus

How to protect yourself:

Wipe the free disk space regularly. This overwrites the free space on the hard drive which makes standard file recovery impossible.

• Blank and Secure
• CCleaner
• Eraser

2. The Web Browser History

Web browsers are configured to record the web browsing history. This is done in databases in the program directory most of the time as well a cache that contains pages, images, cookies and other elements of visited websites. It is quite easy to use the cached information to see what sites a user has been visiting in the past and what has been downloaded to the computer.

Tools for the job

• Built-in web browser tools to access the history and cache
• The standard system file browser, e.g. Windows Explorer
• Firefox Cache Viewer
• Google Chrome Cache View
• Video Cache View

How to protect yourself:

You can configure web browsers to delete the cache regularly, for instance at every exit or every five days. Here is how you would do that in Firefox. Open the Firefox web browser and click on Firefox > Options, or select Tools > Options from the menu. Switch to the Privacy tab

You can either configure Firefox to never remember the browsing history, or use custom settings for the history. This way you could disable the browsing and download history, but keep cookies for your logins.

3. Recent Items

Another area where you might get a lot of information about computer usage is the recent items list. The operating system and multiple third party tools keep tabs on programs or files that have been opened recently. If you have not done anything with the OS or application yet, you may find previously opened files and programs by the system’s last user.

Tools for the job

You can access the information right in the application or the operating system. For Windows 7, you could for instance click on the start button and select Recent Items from the Start menu, or right-click an item in the taskbar to see its jumplist entries.

How to protect yourself:

You need to disable recent items either in a control panel of the operating system or in the third party application. For Windows 7, you would simply right-click the start orb and select Properties from the context menu.

Locate Store and display recently opened items in the Start menu and the taskbar to disable that feature.

Closing Words

The three method above are common options to analyze a computer system. Have other suggestions? Let us know in the comments.

The chance of recovery depends highly on the time between the deletion and recovery attempt. Windows for instance does not delete files permanently on the hard drive when the user deletes them from the system. The operating system merely deletes the file information (file xyz is stored here) and enables the space on the hard drive for writing. If no other file has been written partially or fully to the location then it is likely that the file can be recovered.

Undelete 360 is a free file recovery software for Windows that is comfortable to use

A recovery process begins with the selection of Search in the main toolbar. The file recovery program retrieves all connected storage devices and asks the user to select one or multiple devices. These devices are scanned by the application once the Start button is activated by the user.

Undelete 360 displays file groups in a sidebar on the left and the deleted files that it found on the hard drive on the right.

The sidebar items allow the user to filter by application type. That’s handy to limit the file listing to find specific files faster or to recover all files of a specific type. It is possible to switch to a folder display in the sidebar instead which is handy if files that have been stored in a specific folder need to be recovered.

All deleted files are listed with their name, path, recovery status and size. The recovery status gives an indication if a file is recoverable.

A search on top can be used to find files with a specific name or path. File previews are available once a file has been selected.

Files can be recovered by the application by selecting them first in the file listing before the Recover button is pressed.

This spawns the recovery options window where the destination directory and other related parameters can be configured.

File filters can be enabled in the top menu as well. Here it is possible to filter by filename, date range and file size.

Undelete 360 offers another interesting feature: The ability to wipe files and folders. Wiping makes the files and folders unrecoverable on the system.

The application is compatible with 32-bit and 64-bit editions of the Microsoft Windows operating system. Downloads are provided directly at the developer website.

The data recovery software is completely portable and will display all hard drives and removable drives that are connected to the computer system after startup. The next page provides a checklist of various file types that can be recovered by DiskDigger. It is divided into the three categories photos and images, documents and Audio & Video. All files are selected by default but it is possible to uncheck file types so that the program is only scanning the hard drive for those file types.

Several popular file formats are missing in the list. The documents category for instance contains only Microsoft Office documents and the pdf format. That’s a limiting factor as it is not possible to add file types to the list.

DiskDigger will display three tabs after that selection that contain the various file formats that have been found on the selected hard drive separated into their three categories. Previews are available for some file types, mainly those located in the image category. What sets DiskDigger apart from other tools that can recover deleted files is that it acts independently of the file system. It should theoretically work with damaged partitions. Other file recovery tools might fail because of that.

Here is a list of alternative programs that can be used to recover deleted files: (all link to Ghacks)

Forensic Data Recovery Software
Smart Data Recovery Enterprise
File Recovery Undelete My Files
Data Recovery Tools Encopy
DVD Data Recovery Software
Recover Deleted Files

Got any software to recover deleted files to add? Let us know in the comments.

Its portability make it an excellent companion for a tool collection on an USB device. The usability of Encopy has a severe limitation. The file browser can be pointed to select exactly one file from the medium or folder. Users who rely solely on the file browser will be dissatisfied by this. It is possible to use wildcards to include multiple files in the data recovery process. To copy all executable files from hard drive d one would use the wildcard d:\*.exe to do so.

Encopy comes with a set of options that define and alter the data recovery process. It is for example possible to verify the data after, force faster copying or skip system files.

Encopy lacks the visual eye candy that many data recovery tools come with but makes this more than up by the impressive size of only 69 Kilobytes and the quality of the data recovery. It did throw a few runtime errors on a test system which could not be reproduced the next time though.

The software can scan remote drives for deleted files, preview those deleted files and eventually recover them. There is obviously the need for a direct connection between the client’s computer and the admin which is utilized by a TCP/IP network connection. A software is running on the client computer that initiates the connection to the admin computer. That connection can be initiated manually or automatically.

Once the connection is established the administrator can use a graphical user interface to scan the local hard drives. A filter can be configured to find only files that match the pattern.

The remote hard drive is then scanned for deleted files. Everything that gets found will be listed in an Explorer like window. The directory structure is shown in the left pane while the right pane contains the files that have been found.

Information about the files are shown as well, most notable the size of the file and an estimation about the chance of recovering the file. Another handy feature is the Wipe button that seems to remove the deleted files permanently from the hard drive. I was not able to find out which algorithm, if any, is used to do that though.

Free Undelete scans one partition of the hard drive and provides access to all recoverable files and folders that it found during the scan. The scan itself is surprisingly fast, faster than the one by Recuva but this could be due to the way both applications present the data after the scan. Recuva is displaying all files it found in the main window while Free Undelete displays the folder structure of the files.

That’s a great approach if you can remember the folder names of the files that you want to recover. If you cannot remember them you are in for some folder clicking until you find the files that you want to recover because Free Undelete does not offer a search, only a filter that filters the current results by filename and folder name.

This difference matters only if specific files have to be recovered. It is easier to recover all files and folders with Free Undelete because it displays less of them in the main interface. A tip is to always recover files on a different partition than the one the files are being recovered from. It could happen otherwise that recovered files are stored in locations of files that are still to be recovered which will obviously fail then.

If you only have one partition I suggest to use an external device, USB drive, external hard drive or similar to store the files temporary on that device.

PC Inspector is avilable for every Windows operating system starting with Windows 95. The tool has a great chance of success if you are using it right after you found out about the data loss. You should also remember that PC Inspector is not able to recover files from hard drives that are no longer recognised by either the bios or windows.

Some of its features are:

• Finds partitions automatically, even if the boot sector or FAT has been erased or damaged

• Recovers files with the original time and date stamp

• Supports the saving of recovered fimmediatelytwork drives

• Recovers files, even when a header entry is no longer available. Competition products cannot recover such files.