IMPORTANT: Never try to install undelete software on the drive that contains the lost data!

File undelete / unerase golden rules:
	Do not install undelete or recovery software on the 'victim drive' after you deleted a file. You may want to consider installing undelete software right now, so you do not have to worry about this when undelete software is needed.
	End all tasks and processes that write to the victim disk, including download managers, peer-to-peer download software, automatic updaters etc.
	Do not recover deleted files to the drive you are trying to recover the files from.

File deletion is an operating system / file system feature to remove files from the file system. You may want to delete files to free up disk space, to remove duplicate files or to make files unavailable to others. To prevent accidental removal of files, some operating systems do not remove files immediately, instead files are moved to a special directory (example: the Windows Recycle bin). When files are removed from this special folder they're actually removed from the file system.

Some warnings are in order regarding the limitations of the Recycle bin feature in Windows. Normally when you delete a file or folder, it will be moved to the Recycle bin so you can undo the delete if needed. But there are situations where the Recycle bin is bypassed and the file is deleted immediately:
- if files are too large for the Recycle bin
- if you hold the 'shift' key while deleting files
- if files are deleted by applications
- if files are deleted from a windows command prompt
Commercial and free third party tools replace and extend the standard Windows Recycle bin functionality by capturing these files as well. Examples of such tools are Norton Recycle bin and Fundelete from former www.sysinternals.com.

For the purpose of this explanation, when we use the term 'deleted files', we refer to files that are actually deleted. So, not the files that can be retrieved from the recycle bin, but the files that are removed from the Recycle bin or otherwise (as explained above) not retrievable by conventional means.

If deleted files need to be retrieved one can try to recover these files using undelete software. Undelete software is almost as old as the IBM compatible PC itself. Even in the early days of personal computing inventive programmers, such as Peter Norton, created utilities to retrieve deleted files. Those early undelete tools tried to retrieve the files by re-registering them in the file system (in-place recovery). This in contrast to most of today's tools, which recreate the file on a different drive (salvage by copying). The latter is considered safer; editing the file system directly always includes the risk that you make matters worse. So, although today's 'undelete' software technically does not really undelete a file (the original file remains deleted) it's still referred to as undelete software.

Whether removed files can be recovered at all depends on several factors:
- the file system type (NTFS is more reliable in this regard)
- in case of FAT type partitions, the degree of fragmentation
- whether the disk has been written to after the file(s) have been deleted
Please note that when a file is deleted, what actually happens is that the reference to the file is deleted: the contents if the file itself remain on the disk. The space that the file occupies is released to the file system for re-use. As such it's always best to perform a file undelete as quickly as possible; anything that gets saved to the disk could overwrite the deleted file.
Make sure you don't install the undelete software to the disk that holds the deleted file(s), as this could overwrite the areas that hold the deleted file's data!

For FAT type file systems, deleting a file results in a directory entry being modified so the file will no longer be shown. Also, clusters allocated to the file are marked as available for re-use in the File Allocation Table - this explains why recoverability of fragmented files on the FAT file system is poor.
For the NTFS file system the most important fact is that the MFT entry for the deleted file remains, but the file is flagged as 'not in use'. The MFT entry holds a runlist (a detailed list that describes the location of the file on the disk) for all data fragments so file fragmentation is not an issue.

NTFS undelete and file recovery software:

iUndelete [NTFS] NTFS undelete and file recovery software. Trial version recovers files of any size, as many as you need! information | download | purchase