Recovering files from emptied recycle bin

[Kelevra]

I am trying to help a friend in another state recover files from a work computer where a disgruntled employer deleted the "My Documents" folder and then emptied the recycle been. It is running XP Home SP1, (I know but they were in New Orleans during Katrina and are trying to get going again). They say they haven't written anything to the drive but maybe Windows did.
I had them purchase RMF and d/l and burn the files to a CD on her laptop. I also had her get an external USB HD and change from FAT32 to NTFS as it is a 400GB drive. I don't know yet what the file format is or how big the work machines drive is. I am planning to run RMF from the CD.
I understand that XP renames the Word files to DC_word_x.doc in the recycle bin and writes a hidden system files named INFO2 with a table inside listing the new file name with the original file name and Directory path. When the file is restored it renames the file in the MFT.
My question is: When RMF shows the files, will it be in the DC_word_x.doc format in the recycle bin folder or as the original file name, ABC.doc. Do we look in the folder view under recycle to find, select and save them? Would they be recovered under the recycle folder or the My Documents folder that was deleted? And if we do, can we recover the original file names? How would we restore them back to the original drive if they are saved in the recycle folder?
If we have to recover them as the renamed files, can we recover the INFO2 file and does RMF show hidden system files? Will RMF preview it and is there a program the will allow us to view and print the contents of the file to help us manually rename the files or is there an automated program that will do it?

Thanks for any help or suggestions.

PS - If you can put up any links to white pages or whatever I would appreciate it as I couldn't find any info on your site, nor was googling any help.

[GDH]

Hi,

You are right about how the Recycle Bin works. When you run Recover My Files, in the drive selection window, include the Recycle Bin Folder in the search (technically these files may not be recognised by the PC as being deleted so you need to make sure by searching the active files in this folder).

You will find that files in the Recycle Bin will be recovered with their DC... file name. It is possible to recover the INFO2 file and decode its contents. It is rather technical and you may need assistance from a Computer Forensics technician. Even once decoded you will end up renaming the files by hand.

Because of the situation you describe you may wish to think about taking a forensic image of the drive. The most common software used by computer forensic technicians for this purpose is called EnCase (contact me directly for more details). Once you take the image you will preserve a read only sector copy of the drive which cannot be changed - so you wont make things worse and can protect your integrity if the matter gets ugly at a later stage.

Once you have taken an forensic image it can be mounted using Mount Image Pro from www.mountimage.com and then you can run Recover My Files and other tools on the mounted image.