Jump to content

What types of deletions count as 'deletions'?


aylesworth

Recommended Posts

Hello,

 

I've used Recuva a few times and love it, however the question has been brought to my attention: What types of deletions count as actual deletions?

 

If a system process removes a file, will Recuva be able to see that and mark it as restorable or not?  In a nutshell, I'm trying to use Recuva to figure out if a user deleted a file, or if the deletion was system generated.  Would Recuva see files deleted in both ways with the same result?  Would there be any indication that a file was deleted by system rather than a user?

 

Thanks!

Link to comment
Share on other sites

  • Moderators

An actual deletion is when the entry for the file in the MFT has the delete flag set, and the file's data clusters are made available for reuse (that's NTFS, FAT is different).

 

There is no indication of how, or by whom, any file has been deleted - in general.

 

If CC has run normal file deletion then it is the same as a shift/del.

 

If CC has securely deleted a file it will be renamed and overwritten with zeroes.

 

If a file has been sent to the recycler and then deleted the path of the file will be the recycler path, and the file may be renamed.

 

I don't know what CC does when it is run against the recycler as I've never used this facility.

 

Recuva will see all these files in the same way (if they have not subsequently been overwritten) but recovering a file full of zeroes is obviously not as gratifying as recovering user data.

Link to comment
Share on other sites

Cool thanks for the info.  Basically, we've got a user that claims that nothing was deleted, but files 'vanished'.  I'm trying to figure out if they were deleted by the user or by the system, and I'm having a hard time figuring out if system deleted files appear with an MFT entry just as normally deleted files do.

 

Basically, will Recuva see files deleted by the system as they would by a user?

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.