Your Operating System considers deleted files as just free space on the drive. With any write operations to that partition or disk, there is always the possibility of losing files forever by overwriting them. Therefore, do not write anything to the data drive, do not run any disk utilities such as chkdsk and defragmenters and do not reboot the computer. Windows can spawn chkdsk during start-up procedure. To avoid write operations during restoring, do not restore files or write images onto the drive that contains the deleted files.

You can also create an image of the drive with deleted files (from "Drive" menu select "Create Image File") and save one on another drive. This image can be later used instead of the original drive. That is the way to save the current state of the drive.

You may use FILE RECOVERY for Windows software to recover accidentally deleted files. If you have only one logical partition on your system hard drive we'd recommend you to remove the HD from the computer (PC1) and attach the HD to another computer (PC2) where FILE RECOVERY for Windows is already installed. You may attach the HD as a slave drive or use an HDD-to-USB adapter (a USB2.0 compatible is highly recommended for data transferring acceleration). A notebook HD can be connected to the PC2 through a special adapter as well. Then run the software on the PC2 and search lost files on the attached HD.

Under Windows NT, Windows 2000, or Windows XP operating systems FILE RECOVERY for Windows will recover files from all physical and logical drives, which are visible by OS. Under Windows 95, Windows 98 or Windows ME FILE RECOVERY for Windows will recover files from all logical drives visible by OS and from all physical drives, which are correctly accessible by Windows protected mode I/O subsystem.

On to any device that is accessible by your operating system. Files may also be recovered to network share specified by UNC path (such as \\myserver\myshare). You may select the recovery path from a standard Windows directory dialog or enter it manually. Please note, the file system of the drive, which is used for saving recovered files may limit recovery of NTFS files extended information

On Windows NT, Windows 2000, or Windows XP operating systems FILE RECOVERY for Windows will recover files with file names to 32000 characters and restore original file names in any national encoding.
Under Windows 95, Windows 98, or Windows ME there is a 255 characters limit for size of full path for recovered files. Encoding of a file name is limited by the language currently set in Windows. Files with other characters encoding will also be restored, however the file name will be altered to fit the limitations of Windows.

FILE RECOVERY for Windows supports recovering of compressed files, alternative data streams, encrypted files, file security and extended file attributes. If the OS that is running FILE RECOVERY for Windows and the drive to which you are saving files support particular extended information, then they are recovered to their original state, which includes extended information inside the file. Otherwise, extended information will be saved as standalone files, which have the same name as the restored file and an additional extension, which qualify the type of extended information. Here is a quick reference for the host OS and target drive needed to recover particular extended information while embedding it into the recovered file:

FILE RECOVERY for Windows may write to disk only from hex editor (with enabled write) or when it is explicitly directed to save files on this disk. Therefore, you should be very carefully using hex editor. In all other modes and actions, FILE RECOVERY for Windows performs a read-only and never modifies data on partitions and drives directly.

Select physical drive, on which your files were stored.
Scan it ('Drive'->'Scan') in order to find file system information.
Recognized partitions will appear under scanned drive in 'Drives Windows' tree view.
Open partition, which contains your files or explore all of them if you are not sure about choice of correct partition.
Select files you want to restore and recover them ('Tools'->'Recover') to another drive.

If the file has the wrong contents there are two possible reasons for this situation; either the place, which the deleted file occupied, was overwritten permanently or the wrong Recognized partition was chosen for recovery.
In order to find the correct partition please perform the following:
Scan physical drive, which contains the deleted file (from 'Drive' menu select 'Scan').
Explore all partitions found after scanning, then try to restore a file which size is greater than 2KB.
If you find contents of the recovered file to match the original one, then use that partition for recovering.
Absence of the partition means that file information was overwritten permanently.

To get the best result, choose Create Image File command from Drive menu (or context menu) to copy the damaged data to another hard drive. You can create the Image of segments of the partition, Image of the whole partition, or even Image of the full hard drive.
To adjust the number of attempts to read bad sectors, use I/O Tries in Drive Control properties. After the Image is created, you can open the Image using Open Image File command, and work with it as with original drive.

In this case FILE RECOVERY for Windows will just copy these files. Their NTFS permissions may be disregarded by command. Even files locked by the system (such as registry hives or page-file) can be copied. In a sense, FILE RECOVERY for Windows interface does not make a difference between existing, deleted, and lost files. It gives you an option to restore given file using all available information with simply 100% of success for existing files.

These tabs represent different representations of the same file. There are following currently implemented representations:
Std: Standard. Represents file according to all known information. When the file is restored, its' data will be equal to data seen in this representation.
Unlimited: Represents all file information, stored in clusters associated with given file. If there is some information which resides beyond claimed size of file it will be shown (unlike 'Std' representation).
Direct: Represents all file information as well as 'Unlimited' representation. However if file is compressed by Windows NT data will not be uncompressed but shown as is (unlike 'Unlimited' representation).
Allocation: Represents resident part of NTFS file. If file is resident (one which fits inside MFT record) this representations equal to 'Std', otherwise it shows 'MFT Runs' - data which describes cluster allocation of given non-resident file.

Each NTFS file is actually a set of sub-files or 'attributes' in NTFS terminology. Each of them has one defined type and unique name. Windows NT uses some of the attributes to store file information. For example, the unnamed attribute with type 'Data' is equal to the file's contents unnamed attributes with type 'Standard information' stores file times and user mode permission (read-only, archive:). Other attributes may be created and used by some 3rd-party software. In hex viewer/editor you can review all of file's attributes.

FILE RECOVERY for Windows works with a hard drive at low level, not through the driver for the file system.
If you want to view deleted files only, clear checkmark Deleted Files in File Types dialog (File Mask command from Tools menu).

Folder's name like '$$$Folder58448' means that folder itself was not found on drive but some references to one were. For example, folders 'My documents', 'Work', 'Photos' were found and all they have one parent folder, whose description wasn't actually found on drive, so its name is unknown and therefore presented as '$$$Folder58448'. Perhaps the description of such folders was just outside of the scan area - so try to expand region or scan the entire hard disk. If it does not help the description of the folder has been most likely overwritten.

Unlike NTFS, the FAT file system barely contains redundant information, and sometimes it is impossible to check disk information. That is why FILE RECOVERY for Windows shows all possible directory entries whatever they are, to ensure recovering of a maximum number of files.

MFT record (the one which holds information about particular file) contains some self-validation values. One of them is known as 'fixup'. So if MFT record is broken, then following warnings can appear:
 
'[FileId: XX] Fixup out of bounds'
'[FileId: XX] Fixup XX is XX, but should be XX'
 
They are not fatal errors. They mean that information describing file system information for a file is most probably overwritten. If so, there is a risk that file can't be recovered.

You need to attach your Linux drive to another computer which can boot from Windows, and then restore the files on that computer using FILE RECOVERY for Windows. No matter how that system recognizes your drive, FILE RECOVERY for Windows should access it.

You have likely created the image on the FAT32 file system which has a 4Gb file size limitation. Therefore larger files can not be created there. If this is the case, we would suggest that you either use NTFS (through network or attaching the drive to a Windows NT/2000/XP/2003 box if you are running Windows 9x/ME) or split your drive into regions each less than 4Gb, create their images and make virtual volume set afterwards if you need to recover files from there.

When the file is deleted into Recycle Bin it is not actually deleted. It is just moved to \Recycler (or \Recycled) folder and renamed in such a way that many files from different folders but with the same name can be placed there. Information on original names with original location of files is kept in registry.

After deleting file from Recycled Bin there is no way to recover original name and location. But you should be able to restore it from \Recycler (or \Recycled) folder using FILE RECOVERY for Windows if you can identify it by size (it will be marked by red cross as deleted) unless it is overwritten permanently.

FILE RECOVERY for Windows works on Windows 95/98/ME/NT/2000/XP/2003 only. It will not work under DOS or another operative system which fits into one bootable floppy. Therefore, you should attach your hard drives to another computer which can boot to Windows, and then restore files on that computer using FILE RECOVERY for Windows. No matter how that system recognizes your drives, FILE RECOVERY for Windows should access it.

FILE RECOVERY for Windows recovers lost files from deleted or damaged partitions to another location. For safety reasons it does not even try to recover partitions in the wrong locations.

To facilitate file recovering, recognized partitions are marked by color. Partitions marked by green are most probable source for recovering, by orange - the second best, by red - still worth looking for.

It means that the file under consideration extends beyond the partition it resides on. That means either severe data lost or that you use wrong Recognized partition to recover the file. Please explore all such partitions.

A red cross on the icon means that file has been deleted and will have to be recovered to be accessed by the system. That is it. Files without the red cross are not marked as deleted. They may be lost from the system due to file structure corruption (especially when found on Recognized partitions.)