So I am looking for a file on hard drive I took out of a broken computer. I have scoured the drive with no success. I found a link to the file "Cri_me_Fi_le.txt.lnk." Using "$ strings" I found that the original text file was in My Documents but is no longer. I then used ntfsundelete to see if it had been deleted, more than 4000 files came up and after searching through the files none were my file. The file was actively hidden from me and the name may have changed slightly (I was told to look for "Crime file"). At this point, I have no idea what to do. Does anyone have any idea how I could locate this file?

Basically when a file is deleted it's simply marked as available to be overwritten, the unused space on the disk is called slack space and there are several tools that can "carve" files from the slack space. It's safer to work on an image of the disk so try booting on a live cd and 'dd if=/dev/sda of=... bs=512' to an external drive.

I don't understand. I am using a IDE/SATA to USB cable. Should I still run from a cd?

The point is not to perform any more writes to the target drive as this could reduce your chances of file recovery.

Ok, that makes sense. What about the command? I typed it in and basically froze my computer. Was is copying the entire drive?

Thanks for your help bro, I need to get off the computer tho. Thanks away.