Topic: Recovering Deleted Data from and Excel Spreadsheet

I am currently tasked with recapturing intentionally deleted data from an excel spread sheet.  After imaging the subject hard  drive using dd and mounting that image in Autopsy, I was unpleasantly surprised to see that the files my company had asked me to recover had not been deleted at all but rather the data inside the files (spreadsheets) had been deleted and resaved.

  I am unsure how to proceed at this point, where would such deleted data go? Slack or unallocated?  If slack, I don't think I can retrieve it using Autopsy.  If it's in unallocated somewhere, how would I go about pin-pointing the data that was once associated with the file/inode/clusters?

  The suspect OS was Windows XP, the version of Office  being run was 2003.

  Can anyone help shed some light on this problem???

Re: Recovering Deleted Data from and Excel Spreadsheet

The ways that i usualy recover things are more or less  trial and error aproaches but 90% of the time have gotten the job done in one way or another.

If you remember ANY of the content then you can use foremost to fish out where it is.
You can recover all spreadsheets on the drive and look through them individualy(deleted and not) with magicrescue(which unfortunately not included with S-T-D but you can compile it in your home directory and use it from there, Home Page)
I dont know how much luck you will have if the contents were deleted then resaved, but those are two of the methods that have worked for me when attempting to recover diffucult projects...

Knoppix Cheat Codes
Registered Linux user# 366379

Re: Recovering Deleted Data from and Excel Spreadsheet

When MS office products are working with a file, they generally create a temp file for recovery related issues (for when their own program crashes itself at random).  You may be able to find one of these files.  Sometimes they reside in the same folder the file was saved in, sometimes in temp folders (for the profile that was in use when using the document).  I seem to remember reading somewhere that Word and possibly Excel save the last * amount of revisions of a document, but my memory sometimes confuses itself.

Hope that helps, let us know how it goes.

Edit - wanted to mention the temp filenames is uses generally resemble the original filename w/ a " ~ " (tilde) in front of them and do not always have the proper file extension.

Re: Recovering Deleted Data from and Excel Spreadsheet

My bet is you or I should say the person that did it is out of luck.

For the future, Server 2003 has a volume shadow copy service and one of it's featurs is that it takes various snap shots of any given volume. When set up a new poperties tab will be added to the files called "previous versions" and you can reopen any of the previous x amount versions of that file or directory. It's pretty slick when the user can recover their own stuff. But they would have to be saving the file on a network drive.

Jason Huggett, CISSP

Re: Recovering Deleted Data from and Excel Spreadsheet

Thanks for all the replies.  I guess the person that did this is IN luck, since the action was taken just prior to termination.  No doubt this was an (apparently successfull) attempt to cover tracks before leaving the company.   I on the other hand appear to be SOL  roll .

  The data in question was invoice related.  Since the person was using a common template to generate the data.  I may be able to find the data based on common template characters used in the invoice template.  Beyond that I have no idea what other information these spreadsheets may have contained.

  I'll continue to hack on the problem if anyone else happens across a tool or methodolgy which may help recover data lost through modification as opposed to wholesale file deletion, please, please post it up!

  Thanks again!!!


Re: Recovering Deleted Data from and Excel Spreadsheet

Try checking with the guys here they are dedicated to forensics and might have a better idea of what to do.

For all KNOPPIX questions check out these:

Re: Recovering Deleted Data from and Excel Spreadsheet

In my experience, I've seen Office products store data in the file, even though it is "deleted".  If you have recovered the files, you may be able to use a command like strings to dig out previously removed text.  I know this was a problem for Office 2K.  Don't know about 2K3. 

As an aside, the only way to get rid of the old data was to do a Save-As, but if that were the case you would have the old files.

Re: Recovering Deleted Data from and Excel Spreadsheet

On the whole one good friend told about nice application-repair corrupt xlsx,which is free as far as I know,it has many features,also utility helped a lot of people and me too,software can repair .xlsx even without touching your keyboard, just left click your mouse several times and all of your data will be recovered,automatically and attempts to repair xlsx corrupt, that was considered lost,recover maximum percents of your document manually, than the entire Excel workbook.

Re: Recovering Deleted Data from and Excel Spreadsheet

If you deleted files from the Recycle Bin, you can recover them with an unerase program, such as Advanced File Recovery on I'm always satisfied with the quality and simplicity of this program.

Re: Recovering Deleted Data from and Excel Spreadsheet

Couple days ago I heard about a tool.But in 2 days some my important xls files were deleted from my PC.Fortunately I found that tool-Microsoft Excel repair.It made up my mind very easy and generally absolutely free.Moreover I saw how it repairing Excel files, except the possibility to export recovered data into a new Microsoft Excel file.

Re: Recovering Deleted Data from and Excel Spreadsheet

I think there is a program very similar to the dll search. I recently heard someone talking about it. He was saying that it is very efficient. The problem is that I think there are several types of this program and I don't know which one best suits your little problem. You should search the Internet, I am sure you will find some info there.

12 (edited by sweetemo22jd 30-05-2011 12:21:18)

Re: Recovering Deleted Data from and Excel Spreadsheet

how to recover files, run your Excel recovery program and choose the drive in which the deleted Excel was originally stored. Usually, this is the C drive. Click on Next and allow the program to scan your drive and locate any deleted yet recoverable Excel files. Once your recovery program has located all recoverable Excel files, choose the ones that you wish to recover. Click on it and click on Recover.

Re: Recovering Deleted Data from and Excel Spreadsheet

Hey man you should just used a invoice template to invoice customers etc. i found this one online it's pretty good smile … plate.html

All the best

14 (edited by alexmoose1986 22-08-2012 10:54:42)

Re: Recovering Deleted Data from and Excel Spreadsheet

Deleted, corrupted and inaccessible excel file can be easily recover using an advanced excel recovery software which is capable to recover excel file whatever reason behind the file corruption and data loss issues. This application is capable to recover your excel file and restore your excel file at the specific location at the specific location. This first scan the corrupt excel file to repair or restore it, when once this scan your corrupt your excel file it repairs the excel file and extract the lost data easily.
For more information how to easily repair excel file you can visit: