bigharsh Posted September 1, 2014 Share Posted September 1, 2014 I ran Recuva and looked to "Pictures" files that I had deleted. Most of the ones that have a State = Unrecoverable have a Comment = "This file is overwritten with "<the same file I was trying to access>". What does this mean? I can see the image perfectly in the Preview tab. Is this what is supposed to happen? Link to comment Share on other sites More sharing options...
Moderators Nergal Posted September 1, 2014 Moderators Share Posted September 1, 2014 It means you won't have a file as part of where it was on the disc has been used by another file. You see a picture because (usually) the thumbnail image is what survived) however you can try to recover them and they may still work ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF. Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark) ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T. Support at https://support.ccleaner.com/s/?language=en_US Pro users file a PRIORITY SUPPORT via email support@ccleaner.com Link to comment Share on other sites More sharing options...
Moderators Augeas Posted September 1, 2014 Moderators Share Posted September 1, 2014 If you are saying that the message is 'file abc.jpg is overwritten with abc.jpg' (I paraphrase a little) then at a guess it appears that some action has resulted in a live and a deleted copy of the files being created. It seems a coincidence that the pics are occupying the same space allocations as before, but not the same records in the MFT. Perhaps once, but not many. If the overwrite starts at cluster 0 then the preview image is of the live file that has overwritten the deleted file, and recovering the file will copy the live file. Is the drive NTFS or FAT? FAT is prone to peculiarities such as this, way beyond my brain cells to get a grasp. Link to comment Share on other sites More sharing options...
Alan_B Posted September 1, 2014 Share Posted September 1, 2014 He could also be saying that he was only interested in access and recovery of one specific file such as xyz.jpg and he was seeing many other files such as abc.jpg, def.jpg, hji.jpg etc which were each described as being over-written by xyz.jpg and that is exactly what I would expect if abc.jpg def.jpg, hji.jpg etc had all been deleted before xyz.jpg which naturally over-wrote them as xyz.jpg was created. Link to comment Share on other sites More sharing options...
bigharsh Posted September 1, 2014 Author Share Posted September 1, 2014 Please see samples below. Filename: IMG_1153.JPGPath: C:\Users\harsha\Pictures\2009_06_27 Size: 3.64 MB (3,818,161) State: Unrecoverable Creation time: 26/12/2010 12:33 Last modification time: 26/12/2010 12:33 Last access time: 10/09/2009 12:34 Comment: This file is overwritten with "C:\Users\harsha\Pictures\2009_06_27\IMG_1153.JPG" 933 file cluster(s) overwritten (0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, ...) 933 cluster(s) allocated at offset 8996042 Filename: IMG_0774_2.JPGPath: C:\Users\harsha\Pictures\2009_09_10_develop Size: 7.53 MB (7,896,127) State: Unrecoverable Creation time: 26/12/2010 12:41 Last modification time: 26/12/2010 12:41 Last access time: 10/09/2009 12:05 Comment: This file is overwritten with "C:\Users\harsha\Pictures\2009_09_10_develop\IMG_0774_2.JPG" 1928 file cluster(s) overwritten (0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, ...) 1928 cluster(s) allocated at offset 9565460 Link to comment Share on other sites More sharing options...
bigharsh Posted September 1, 2014 Author Share Posted September 1, 2014 Thanks for the quick responses by everyone. This occurred on my Compaq Vista machine which is having hard drive issues (NTFS). I actually don't want to restore any files. I wanted to verify the CCleaner was removing the files before I take it into Best Buy for analysis. Link to comment Share on other sites More sharing options...
Moderators Nergal Posted September 1, 2014 Moderators Share Posted September 1, 2014 What did you do in ccleaner to "remove files" Freespace wipe? Full wipe? MFT? ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF. Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark) ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T. Support at https://support.ccleaner.com/s/?language=en_US Pro users file a PRIORITY SUPPORT via email support@ccleaner.com Link to comment Share on other sites More sharing options...
Moderators Augeas Posted September 1, 2014 Moderators Share Posted September 1, 2014 If you can see the thumbnails then the pics haven't been removed. Do you still have a live folder called C:\Users\harsha\Pictures? If so, what's in it? Link to comment Share on other sites More sharing options...
bigharsh Posted September 1, 2014 Author Share Posted September 1, 2014 I still see the pictures in the directory. Why would this be happening? Having a state of "unrecoverable" and still being able to see the file is a bit disheartening regardless of how the file was deleted. I'm using CCleaner 3.23.1823. I'm going to download the latest version and re-run my CCleaner. I will use the following settings (this will take a few days to run): Secure Deletion: Secure file deletion Very Complex (35 times) Wipe Alternate Data Streams Wipe Cluster Tips Wipe Free Space drives - C: Wipe MFT Free Space - Any concerns or suggestions? - does anyone suggest deleting Window temp files that are less than 24hrs old? - is there a difference between CCleaner Professional and free? I'm using a trial Pro version right now? Thanks for all the help. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted September 2, 2014 Moderators Share Posted September 2, 2014 I still see the pictures in the directory. Why would this be happening? Having a state of "unrecoverable" and still being able to see the file is a bit disheartening regardless of how the file was deleted. The state of unrecoverable means that the clusters the deleted file occupied have been overwritten by another live file. You can recover the clusters but you won't recover the deleted file, you will recover the data from the live file. This is quite common, almost inevitable, I'm using CCleaner 3.23.1823. I'm going to download the latest version and re-run my CCleaner. It's always better to be on the latest version, but it won't affect the results you're getting too much. I will use the following settings (this will take a few days to run): Secure Deletion: Secure file deletion Very Complex (35 times) Wipe Alternate Data Streams Wipe Cluster Tips Wipe Free Space drives - C: Wipe MFT Free Space - Any concerns or suggestions? - does anyone suggest deleting Window temp files that are less than 24hrs old? - is there a difference between CCleaner Professional and free? I'm using a trial Pro version right now? Don't waste your life, use one pass overwrite. Any more is pointless. The other settings are fine. Windows temp files 24 hrs etc? Doesn't matter. There's no difference in what you are doing between the free and pro version. Don't forget to check Cleaner/Advanced/Wipe Free Space. I still see the pictures in the directory. What directory? Do you have a live pictures folder, with pics in? Link to comment Share on other sites More sharing options...
Alan_B Posted September 2, 2014 Share Posted September 2, 2014 Thanks for the quick responses by everyone. This occurred on my Compaq Vista machine which is having hard drive issues (NTFS). I actually don't want to restore any files. I wanted to verify the CCleaner was removing the files before I take it into Best Buy for analysis. You were probably doing EVERYTHING WRONG. CCleaner does NOT delete files unless you specifically and correctly designate that action via an Include - and that you could have either done wrongly or even have been unaware of. If you can still actually see pictures in the directory that is because :- YOU NEVER GOT THEM DELETED - AND WIPE FREE SPACE WILL NOT TOUCH THEM. And Recuva will NEVER show them unless you have used the mode of Normal Scan with Advanced / options / actions / - and tick the box "scan for non-deleted files ..." Without that option Recuva will only find the residue of older deleted files. Link to comment Share on other sites More sharing options...
bigharsh Posted September 2, 2014 Author Share Posted September 2, 2014 Hi Alan_b, I think I will upload a screenshot of my CCleaner settings and what Recuva is displaying so we are all on the same page. I don't want to waste anyone's time further. I just thought it was odd that Recuva would indicate a file was "Unrecoverable" when it was overwritten by the same file (occurs for a lot of files), please see the text I provided earlier: Filename: IMG_0774_2.JPGPath: C:\Users\harsha\Pictures\2009_09_10_develop Size: 7.53 MB (7,896,127) State: Unrecoverable Creation time: 26/12/2010 12:41 Last modification time: 26/12/2010 12:41 Last access time: 10/09/2009 12:05 Comment: This file is overwritten with "C:\Users\harsha\Pictures\2009_09_10_develop\IMG_0774_2.JPG" 1928 file cluster(s) overwritten (0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, ...) 1928 cluster(s) allocated at offset 9565460 I will try to get the screenshots tonight. Thanks. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted September 3, 2014 Moderators Share Posted September 3, 2014 The problem you have is that there is a record in the Master File Table for a deleted file that has its data clusters located at cluster 9565460. There is also a record for a live file, in your pictures folder and with the same name, with its data clusters located at cluster 9565460. Thus the deleted file is overwritten by the live file. When you look at the clusters of the deleted file you are seeing the clusters of the live file, as they are one and the same. It could be that the MFT is corrupted as you say you have unspecified hard drive issues. Try running a Chkdsk, it may be able to sort things out. On the other hand the above may well be a valid state of affairs. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now