Jump to content

files overwritten at end of Recuva scan, but not if scan stopped early


Howard L

Recommended Posts

I am trying to recover files from a quick reformatted USB drive.  When Recuva scan is allowed to finish, all files are red (overwritten).  When the scan is canceled before completion, the partial list of files found have many green (not overwritten) files.  This is confusing and I have not seen another person describe this same problem.  Please to clarify.  Thank you for any assistance.

 

Howard L 

Link to comment
Share on other sites

  • Moderators

Because the only way to tell if a file is 'overwritten;' is to read through the MFT or FAT (I don't know what your file system is) and check whether the cluster addresses held in there for one file are the same as the addresses for another file: i.e. one file has its data clusters allocated in the same addresses as another. Unless Recuva runs to finish this information may not be complete.

 

The drive itself of course has no concept of a file, let alone overwrites, it just manages data in sectors for you. It's all in the file tables.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.