Jump to content

Save, Resume & Load of Deep scan results


Gareth D

Recommended Posts

It would be really useful to add save, resume, and load functions for deep scan results.

 

Reasoning:

 

Deep scanning a multi gigabyte harddisk takes a long time, and it would be useful if deep scanning could essentially be paused so you could reboot the computer (usecase: recovering from a 2nd hdd and installing windows updates / some other software on the main hdd).

 

Save / Load:

 

Because the deep scan takes so long, it is a real pain in the bum if, like me you inadvertently missed two files (email address book) and then need to wait for a complete new scan to take place before you can get the files you missed.

 

Obviously, it would only be sensible to use this function VERY soon after you took the copy, but, what you (developers) could do, is show the user the saved copy of the deep scan, then, when they choose to recover some of the files listed in it, rescan the sections of the hdd containing those files to confirm that file can still be recovered.

 

I understand that choosing where to save the report would be critical, but, why not leave that up to the user? Give them a button on the report screen like "save", and on before the save dialog comes up, give then an information dialog explaining what they must be aware of (i.e. writing the report file over the files they want to recover - should be obvious, but to a beginner...).

 

Otherwise, a top class applicaiton.

Link to comment
Share on other sites

  • Moderators

[opinion]I would be pointless[/opinion] as the deepscan results are very likly to change between runs. . . just because something is recoverable on Monday Morning doesn't mean the same file will be recoverable on Monday night.

Edited by Nergal
added opinion tags

 

ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION

DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF.

Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark)

ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T.

Support at https://support.ccleaner.com/s/?language=en_US

Pro users file a PRIORITY SUPPORT via email support@ccleaner.com

Link to comment
Share on other sites

  • Moderators

Actually I think that this could be useful. I have, in earlier versions of Recuva, run a deep scan and then pressed some key or other and the whole list disappears, to great frustration. The ability to cancel the scan and see the part list of results was a great step forward.

 

Most of the processes required to implement this are already available. You could have the standard right-click and save to text file, with perhaps a warning message if you're saving to the same drive. Then users could play with the list to their hearts' content. That's an easy half-way stage.

 

To import a saved list implies some changes, apart from the code to do the import. There are three types of files, Undeleted Files, Deleted (MFT) Files, and Deleted (Deep Scan) Files. The deep scan files would need to have their Logical Cluster Number or L. Block Address and perhaps some other parameters retained in the list, otherwise you wouldn't know where the file was without doing another deep scan. The Undeleted and Deleted (MFT) files wouldn't need this as MFT access is fast.

 

So now we have the list imported back into Recuva: what do we do with it? Recovery is exactly as it is now. Any data in the list, whether the list is new or imported, can be recovered. Or should I say any LBA pointed to by the list can be recovered, whether the data is relevant or not. It's just data held on sectors.

 

Secure deletion is more complex, but the process for dealing with an entry on a list that is, or might be, out of date is already in use in Recuva. It has to be or Recuva would be destructive.

 

The list changes in time, it decays. But there's no difference between a day-old list being imported and Recuva being left open for a day. No pc is entirely static, and a Recuva run may be out of date to some extent the moment the list is produced on the screen. Whilst recovery is unaffected secure overwriting is. Recuva already does a second check before overwriting data, and presumably puts some sort of lock on the data to be overwritten. You can check this yourself by clearing browser history, running Recuva, then browsing the BBC or some other heavily inflicted sites. The Recuva list remains unchanged and files at the top of the list can be recovered. But some can't be overwritten as they are no longer 'deleted', but contain live data.

 

There'd be more posts saying that 'I've imported a list and I can't recover a file,' so perhaps a warning notice would be helpful when importing a list. And maybe a 'This list is x days old' message.

 

PS Oh yes, some bright spark would want to import a list from another partition. Perhaps a volume ID check, or just stop at the easy half-way stage.

Link to comment
Share on other sites

I think some kind of save / dump to a file or to a sqlite database that could be imported would be AWESOME.

 

I agree with the sentiments of losing the work / time of a multi-hour scan.

 

Obviously all the standard disclaimers would apply about files might have changed, yada yada yada.

 

Having a scan run for a few hours and not having a checkpoint if you lose that work is a serious bummer.

 

Recuva is a great product and has helped me out quite a bit. :D

Link to comment
Share on other sites

  • 1 year later...

Here is why I think a save, resume, and load of deep scan results would be useful. I have a dead hard drive which I have pulled from its host PC, and from which I am trying to recover files. I have attached the dead drive to another good PC using a SATA to USB adapter cable. I perform a deep scan of the dead hard drive, and the deep scan takes several hours. I copy all of the files I need to a good hard drive on the good PC. I don't think I've forgotten anything. I exit Recuva.

 

Later, I remember a file that I needed to copy from the dead drive. Unfortunately, I need to run a deep scan again to access that file. There is no way to have saved the results of the first deep scan with the file locations so that later starting Recuva could have picked up from there. Since I am not writing at all to the dead hard drive, and keeping it safe in an ESD-safe bag offline, there is no way that the results of the first deep scan would be invalid.

 

This is why I think a save, resume, and load of deep scan results would be useful.

Link to comment
Share on other sites

[opinion]I would be pointless[/opinion] as the deepscan results are very likly to change between runs. . . just because something is recoverable on Monday Morning doesn't mean the same file will be recoverable on Monday night.

 

Exactly. My pro-level software supports this, but only on unchanging forensic images. For disks themselves the option is disabled.

Link to comment
Share on other sites

  • 1 year later...

[opinion]I would be pointless[/opinion] as the deepscan results are very likly to change between runs. . . just because something is recoverable on Monday Morning doesn't mean the same file will be recoverable on Monday night.

 

I do not think you are right.  I have to recover 3 TB of external USB disk. That is about 30-40 hiurs or work.  What if the current stops? Or I accidentally press Cancel after which there is no confirmation aboyt the action? I would even suggeest work in progrees should be automatically saved every hour!

 

Regards,

George

Link to comment
Share on other sites

  • Moderators

I would even suggeest work in progrees should be automatically saved every hour!

 

That makes perfect sense. I'd go one step further and allow it to be user selectable with say a minimum of a 5 minute interval up to your every hour suggestion. Even losing one hours worth of scanning would be very frustrating.

Link to comment
Share on other sites

  • Moderators

Except it might never be accurate depending on what has occurred with the drive (ie usage of the drive in the time between save and resume.

 

ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION

DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF.

Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark)

ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T.

Support at https://support.ccleaner.com/s/?language=en_US

Pro users file a PRIORITY SUPPORT via email support@ccleaner.com

Link to comment
Share on other sites

  • 7 months later...

[opinion]I would be pointless[/opinion] as the deepscan results are very likly to change between runs. . . just because something is recoverable on Monday Morning doesn't mean the same file will be recoverable on Monday night.

 

I'd like to point my reason to why I think it would be useful.

 

Imagine that you have a list that points exactly to witch block of the hard drive every "recoverable" file starts and ends. So instead of having to do a deep scan all over again over all the blocks and sectors on the disk/pertition you could load that list and perform a check on the recoverable files index to verify if they're still recoverable. This would in theory reduce the waiting time from hours (scan) to minutes (load+check). Of course the list can change and files can be overwritten bus the chance of having a still recoverable file that you'd like to get would be absurdingly high and if you're not looking for newly deleted files it's obviously pointless to rescan the whole disk.

 

So, yeah. I think this is an interesting feature to be added, maybe, to the Pro release?

Link to comment
Share on other sites

  • 4 years later...

Has there been any changes to Recuva wrt to the ability to use scan results more than once.

I used the Free version to complete a scan, then filtered a subset of files and pressed recover.  To my horror the entire results window was gone.

I just purchased the professional version and am at the same point again.  My question is simple.  If I want to recover multiple files right now today, must I selected them all at once or can I click recover and then continue working to identify other subsets to recover?

 

Link to comment
Share on other sites

I just tried it.  The results window remains.  I don't know if there is now any controlled ability to save results to use later after shutting down recuva. That would be good to know. For now. I will not shut down the program.

 

Link to comment
Share on other sites

  • 4 months later...
On 23/02/2011 at 04:46, Nergal said:

[opinion]I would be pointless[/opinion] as the deepscan results are very likly to change between runs. . . just because something is recoverable on Monday Morning doesn't mean the same file will be recoverable on Monday night.

This reasoning is flawed because you are assuming that everyone is in the specific case of working on a disk that is in use. The disk I am working on is mounted read-only, so it will not be written to, and the data that is there today is exactly the same that will be there in two weeks. Or two years. Unless I explicitly want it not to be.

Having a textual list of the results would allow the following:

  • load the results at a later time to continue working - this alone would justify the feature, but there's more:
  • use other tools to ease searching file names - a simple example: get a list of all the file extensions found;

and I'm sure there are other use cases, but these are the ones I'm missing the most right now.

Link to comment
Share on other sites

  • 11 months later...
On 22/02/2011 at 23:46, Nergal said:

[opinion]I would be pointless[/opinion] as the deepscan results are very likly to change between runs. . . just because something is recoverable on Monday Morning doesn't mean the same file will be recoverable on Monday night.

I strongly disagree in the case of an external hard drive that is read-only.  The scan results would be the same today as yesterday and 5 years from now.

My first scan of a 4TB drive took 11 hours using the free version.  I attempted to recover 1 file (to another drive) and got a message "Device not ready".  My only option was to start the 11 hour scan again.  Same thing.  I decided to buy the Pro version and then I had to do the 11 hour scan again.  I started a recovery to another 4TB drive and minimized Recuva.  There was a message about a duplicate file name and I could not maximize Recuva in order to respond.  I had to use Task Manager to kill it.  So now I have to start the 11 hour scan again.

If I could have saved the results of the first scan and then reloaded them look how much time it would have saved.  All of the scan information is stored somewhere in Recuva and there is absolutely no good reason why it could not be saved somewhere and then reloaded later.  It seems like a pretty simple task to me.

As to your comment "just because something is recoverable on Monday Morning doesn't mean the same file will be recoverable on Monday night" that is ridiculous on a read-only drive.

Link to comment
Share on other sites

  • Moderators
20 hours ago, RockFox said:

I strongly disagree in the case of an external hard drive that is read-only.  The scan results would be the same today as yesterday and 5 years from now.

 

Most people will have no ideal how to mount a drive in Windows 10 as read-only, furthermore Windows just automatically mounts drives anyways such as USB disks.

One exceptionally annoying thing in modern Windows such as Windows 10 for example is it always writes System Volume Information onto a drive or device like an external HDD/SSD, USB Flash Drive, phone, etc., plugged into the computer which it will always create even if System Protection/System Restore is "completely disabled" on the drive and if the service is disabled - maybe that's a quirk or bug in Windows, I don't really know. That small amount of a 4kb folder (NTFS default size) and a few bytes in files it writes could potentially overwrite a very small portion of something critical that needs to be recovered.

Link to comment
Share on other sites

I was not aware of Windows writing System Volume Information whenever a USB drive is plugged in.  What if the USB is never unplugged and the computer never shutdown?

22 hours ago, RockFox said:

The scan results would be the same today as yesterday and 5 years from now.

 

BTW, my statement comes from 52 years experience with IBM VSE and VM operating systems where nothing is ever written to a data disk unless it is intentional.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.