Jump to content

Not a single file with "excellent" prospects is recovered


aleximor

Recommended Posts

I keep my documents and other data on a Samsung 500 GB portable disc, which I back up from time to time on a 5 TB desktop disc, along with the contents of two other large-capacity portable hard discs. At some point in the course of shutting down my computer one night and starting it up the next day, the identity and contents of the disc disappeared. Although it was still recognised as a drive in both Windows Explorer and Directory Opus (which I use normally), when I attempted to show a file list I merely got an error messagestating that the disc was unreadable. The results were identical when I connected the disc to a different computer.

 

When I examined the properties of the disc, it came up as having 0 bytes of free space and 0 bytes of used space.

 

In order to regain any kind of access to the disc, I did a quick format, after which an empty file list could be displayed in

 

After running Recuva in 'deep scan' mode (which took many hours), I got a list of about 14,000+ files, a number of them shown as having 'excellent' prospects for recovery with no overwritten clusters detected. Fortunately, I only needed to recover the few files I had stored since the latest back-up, but when I marked them (Screengrab1) and clicked on the 'Recover' button, all failed, in each case because 'The system cannot find the file specified' (Screengrab2), even though the number of clusters and their location is shown in the 'info' sidebar. However, for all of these failed files the 'header' sidebar shows strings of 00s.

 

Is there anything more that I can do to get these files back? And, whether or not that is possible, could the disc be wiped and re-used or should it just be thrown out as being too risky? (As far as I can tell it is not physically damaged in any way.) The present properties of the disc are given in Screengrab3.

 

Alex.

post-71535-0-91888400-1419077114_thumb.jpg

post-71535-0-79832400-1419077125_thumb.jpg

post-71535-0-11949700-1419077597_thumb.jpg

Link to comment
Share on other sites

  • Moderators

Did you also check 'Scan for Non-Deleted Files'? I ask this as I would not expect file names to be shown after a quick format. File names are held in the MFT which is recreated during the format, and will contain only the system file names. A scan for non-deleted files reads beyond the end of the new truncated MFT in an attempt to retrieve the old file information. I'm assuming that the disk has had no use after the format.

 

A deep scan will not retrieve file names as it reads data clusters, and data clusters do not usually contain file name info.

 

A state of excellent means that the file is not overwritten by any other live file. After a format I would not expect many deleted files to be overwritten, as the MFT only holds a relatively small amount of live system files. The files appear to be overwritten by another user file, which makes me think that the 'old' part of the MFT is being read.

 

I would think that the reason why Recuva can't find the file is because the cluster offset is 145469408, which translates as a byte offset of some 595 gb, which is off the end of your drive.

 

Why do you have so many duplicate file names? Why are the cluster offsets larger than the drive? I really don't know.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.