Can Recuva just "undelete" rather than restore?

[d4v3]

Hello,

 

I've used Recuva a few times now and am so glad I found out about it! Normally when I need to recover something, it's because I accidentally deleted a parent folder rather than its sub folder (I'm still not quite sure how I do it).

 

In these situations, files don't always make it to the recycle bin so I scan the hard disk and Recuver always finds my files in good condition. What I'm wondering is, why can't Recuva just restore the files in situ? As in, why can't it just remove (what I assume to be) the "delete flag" that was assigned to it? Sometimes, it seems like a lot of work to restore the files to another hard drive and then copy it all back, when it's clearly all still sat there in perfect condition in the first place. Especially when the files are large and I have to use an external USB drive.

 

If Recuva can already do this could someone kindly let me know, or else if it is not possible I'd be interested in learning why.

 

Many thanks

Dave

[Nergal]

I think this answer (though a little sharply worded) explains the answer the best

I don't think that there's a cat in you-know-where's chance of undeleting files. NTFS updates certain fields in deleted MFT records to prevent them being accidentally accessed, and in files with many extents can overwrite the cluster addresses. Then there's the MFT bitmap, the cluster bitmap, the indexes, folders, other metafiles.. And that's just for one file.

 

The process would be impossibly complicated and you would be trying to 'undelete' something that may or may not physically exist, not a very good premise.

 

The recycler of course doesn't delete anything until you empty it, when the contents become un-undeletable.

 

Unfortunately {SNIP}, recovery is your only option.