Jump to content

State = Unrecoverable but Comment says it was overwritten with the same file


bigharsh

Recommended Posts

I ran Recuva and looked to "Pictures" files that I had deleted. Most of the ones that have a State = Unrecoverable have a Comment = "This file is overwritten with "<the same file I was trying to access>". What does this mean?

 

I can see the image perfectly in the Preview tab. Is this what is supposed to happen?

Link to comment
Share on other sites

  • Moderators

It means you won't have a file as part of where it was on the disc has been used by another file.

You see a picture because (usually) the thumbnail image is what survived) however you can try to recover them and they may still work

 

ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION

DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF.

Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark)

ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T.

Support at https://support.ccleaner.com/s/?language=en_US

Pro users file a PRIORITY SUPPORT via email support@ccleaner.com

Link to comment
Share on other sites

  • Moderators

If you are saying that the message is 'file abc.jpg is overwritten with abc.jpg' (I paraphrase a little) then at a guess it appears that some action has resulted in a live and a deleted copy of the files being created. It seems a coincidence that the pics are occupying the same space allocations as before, but not the same records in the MFT. Perhaps once, but not many.

 

If the overwrite starts at cluster 0 then the preview image is of the live file that has overwritten the deleted file, and recovering the file will copy the live file.

 

Is the drive NTFS or FAT? FAT is prone to peculiarities such as this, way beyond my brain cells to get a grasp.

Link to comment
Share on other sites

He could also be saying that he was only interested in access and recovery of one specific file such as xyz.jpg

and he was seeing many other files such as abc.jpg, def.jpg, hji.jpg etc which were each described as being over-written by xyz.jpg

and that is exactly what I would expect if abc.jpg def.jpg, hji.jpg etc had all been deleted before xyz.jpg which naturally over-wrote them as xyz.jpg was created.

Link to comment
Share on other sites

Please see samples below.

 

Filename: IMG_1153.JPG
Path: C:\Users\harsha\Pictures\2009_06_27

Size: 3.64 MB (3,818,161)

State: Unrecoverable

Creation time: 26/12/2010 12:33

Last modification time: 26/12/2010 12:33

Last access time: 10/09/2009 12:34

Comment: This file is overwritten with "C:\Users\harsha\Pictures\2009_06_27\IMG_1153.JPG"

933 file cluster(s) overwritten (0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, ...)

933 cluster(s) allocated at offset 8996042

 

Filename: IMG_0774_2.JPG
Path: C:\Users\harsha\Pictures\2009_09_10_develop

Size: 7.53 MB (7,896,127)

State: Unrecoverable

Creation time: 26/12/2010 12:41

Last modification time: 26/12/2010 12:41

Last access time: 10/09/2009 12:05

Comment: This file is overwritten with "C:\Users\harsha\Pictures\2009_09_10_develop\IMG_0774_2.JPG"

1928 file cluster(s) overwritten (0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, ...)

1928 cluster(s) allocated at offset 9565460

Link to comment
Share on other sites

Thanks for the quick responses by everyone.

 

This occurred on my Compaq Vista machine which is having hard drive issues (NTFS). I actually don't want to restore any files. I wanted to verify the CCleaner was removing the files before I take it into Best Buy for analysis.

Link to comment
Share on other sites

  • Moderators

What did you do in ccleaner to "remove files"

Freespace wipe? Full wipe? MFT?

 

ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION

DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF.

Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark)

ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T.

Support at https://support.ccleaner.com/s/?language=en_US

Pro users file a PRIORITY SUPPORT via email support@ccleaner.com

Link to comment
Share on other sites

I still see the pictures in the directory. Why would this be happening? Having a state of "unrecoverable" and still being able to see the file is a bit disheartening regardless of how the file was deleted.

 

I'm using CCleaner 3.23.1823. I'm going to download the latest version and re-run my CCleaner.

 

I will use the following settings (this will take a few days to run):

 

Secure Deletion:

Secure file deletion

Very Complex (35 times)

Wipe Alternate Data Streams

Wipe Cluster Tips

Wipe Free Space drives - C:

Wipe MFT Free Space

 

- Any concerns or suggestions?

- does anyone suggest deleting Window temp files that are less than 24hrs old?

- is there a difference between CCleaner Professional and free? I'm using a trial Pro version right now?

 

Thanks for all the help.

Link to comment
Share on other sites

  • Moderators

I still see the pictures in the directory. Why would this be happening? Having a state of "unrecoverable" and still being able to see the file is a bit disheartening regardless of how the file was deleted.

 

The state of unrecoverable means that the clusters the deleted file occupied have been overwritten by another live file. You can recover the clusters but you won't recover the deleted file, you will recover the data from the live file. This is quite common, almost inevitable,

 

I'm using CCleaner 3.23.1823. I'm going to download the latest version and re-run my CCleaner. 

 

It's always better to be on the latest version, but it won't affect the results you're getting too much. 

 

I will use the following settings (this will take a few days to run):

 

Secure Deletion:

Secure file deletion

Very Complex (35 times)

Wipe Alternate Data Streams

Wipe Cluster Tips

Wipe Free Space drives - C:

Wipe MFT Free Space

 

- Any concerns or suggestions?

- does anyone suggest deleting Window temp files that are less than 24hrs old?

- is there a difference between CCleaner Professional and free? I'm using a trial Pro version right now?

 

Don't waste your life, use one pass overwrite. Any more is pointless.

 

The other settings are fine. Windows temp files 24 hrs etc? Doesn't matter. There's no difference in what you are doing between the free and pro version.

 

Don't forget to check Cleaner/Advanced/Wipe Free Space.

 

I still see the pictures in the directory.

 

What directory? Do you have a live pictures folder, with pics in?

Link to comment
Share on other sites

Thanks for the quick responses by everyone.

 

This occurred on my Compaq Vista machine which is having hard drive issues (NTFS). I actually don't want to restore any files. I wanted to verify the CCleaner was removing the files before I take it into Best Buy for analysis.

You were probably doing EVERYTHING WRONG.

 

CCleaner does NOT delete files unless you specifically and correctly designate that action via an Include - and that you could have either done wrongly or even have been unaware of.

 

If you can still actually see pictures in the directory that is because :-

YOU NEVER GOT THEM DELETED - AND WIPE FREE SPACE WILL NOT TOUCH THEM.

And Recuva will NEVER show them unless you have used the mode of

Normal Scan with Advanced / options / actions / - and tick the box "scan for non-deleted files ..."

Without that option Recuva will only find the residue of older deleted files.

Link to comment
Share on other sites

Hi Alan_b, I think I will upload a screenshot of my CCleaner settings and what Recuva is displaying so we are all on the same page. I don't want to waste anyone's time further. I just thought it was odd that Recuva would indicate a file was "Unrecoverable" when it was overwritten by the same file (occurs for a lot of files), please see the text I provided earlier:

 

Filename: IMG_0774_2.JPG
Path: C:\Users\harsha\Pictures\2009_09_10_develop

Size: 7.53 MB (7,896,127)

State: Unrecoverable

Creation time: 26/12/2010 12:41

Last modification time: 26/12/2010 12:41

Last access time: 10/09/2009 12:05

Comment: This file is overwritten with "C:\Users\harsha\Pictures\2009_09_10_develop\IMG_0774_2.JPG"

1928 file cluster(s) overwritten (0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, ...)

1928 cluster(s) allocated at offset 9565460

 

I will try to get the screenshots tonight.

Thanks.

Link to comment
Share on other sites

  • Moderators

The problem you have is that there is a record in the Master File Table for a deleted file that has its data clusters located at cluster 9565460. There is also a record for a live file, in your pictures folder and with the same name, with its data clusters located at cluster 9565460. Thus the deleted file is overwritten by the live file.

 

When you look at the clusters of the deleted file you are seeing the clusters of the live file, as they are one and the same.

 

It could be that the MFT is corrupted as you say you have unspecified hard drive issues. Try running a Chkdsk, it may be able to sort things out. On the other hand the above may well be a valid state of affairs.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.