aylesworth Posted January 29, 2015 Share Posted January 29, 2015 Hello, I've used Recuva a few times and love it, however the question has been brought to my attention: What types of deletions count as actual deletions? If a system process removes a file, will Recuva be able to see that and mark it as restorable or not? In a nutshell, I'm trying to use Recuva to figure out if a user deleted a file, or if the deletion was system generated. Would Recuva see files deleted in both ways with the same result? Would there be any indication that a file was deleted by system rather than a user? Thanks! Link to comment Share on other sites More sharing options...
Moderators Augeas Posted January 29, 2015 Moderators Share Posted January 29, 2015 An actual deletion is when the entry for the file in the MFT has the delete flag set, and the file's data clusters are made available for reuse (that's NTFS, FAT is different). There is no indication of how, or by whom, any file has been deleted - in general. If CC has run normal file deletion then it is the same as a shift/del. If CC has securely deleted a file it will be renamed and overwritten with zeroes. If a file has been sent to the recycler and then deleted the path of the file will be the recycler path, and the file may be renamed. I don't know what CC does when it is run against the recycler as I've never used this facility. Recuva will see all these files in the same way (if they have not subsequently been overwritten) but recovering a file full of zeroes is obviously not as gratifying as recovering user data. Link to comment Share on other sites More sharing options...
aylesworth Posted January 29, 2015 Author Share Posted January 29, 2015 Cool thanks for the info. Basically, we've got a user that claims that nothing was deleted, but files 'vanished'. I'm trying to figure out if they were deleted by the user or by the system, and I'm having a hard time figuring out if system deleted files appear with an MFT entry just as normally deleted files do. Basically, will Recuva see files deleted by the system as they would by a user? Link to comment Share on other sites More sharing options...
Moderators Augeas Posted January 29, 2015 Moderators Share Posted January 29, 2015 That was indeed what I was trying to say. Link to comment Share on other sites More sharing options...
aylesworth Posted January 29, 2015 Author Share Posted January 29, 2015 Okay thanks! Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now