Nowadays, it is very common that user may accidentally delete his data. Therefore, it is very important to recover that crucial information. First of all, to recover that lost data the system is needed to start the investigation process. The employee must know the exact names of the files missing so that there are no misunderstandings. The retrieval of data that has been accidentally deleted or a hard drive, storage device or cd/DVD that has been damaged is a three-step process. The client should be questioned, the data recovered and the information should be delivered to the client. The first step in data recovery is to question the client. It is vital to find out what operating system the employee is using and if it was a laptop or a desktop. By asking what programs the client uses, the type of files to look for can be determined. For example, if the client was using Microsoft Word, the .doc would be included. Also, the client should have a general idea of the name of the directory that was deleted and the number of files that were deleted. Another question to ask the client would be if they are working on a network. In some cases, the client might be saving files on a network drive. If so, identify if it is Novell or Active Directory. The directory may be recovered using a salvage function within the network utility. Finally, we would need to know how soon the employee needs the restored files. Once a general idea of what the client deleted is obtained, the data can be recovered using a recovery software. There are many different free recovery software applications from which to choose. Some examples are Foremost, Scalpel, Magic Rescue and Sleuth Kit. After the data is recovered, it is turned over to the client. Questions need to be asked about the system:What is the operating system? What type of machine – laptop, desktop? Who is the manufacture? What applications are used by the employee? What was the name of the directory that was deleted? When did you last access it before today? How many documents were in the directory? Do you have a home drive?