Jump to content

Recovering the Unrecoverable, and Unable to Delete


eniwetok

Recommended Posts

This differs from a post of a few days ago where I could not securely delete files because they were not actually deleted and the delete options were ghosted out. In this case the files HAVE BEEN deleted... and I DO have those options available. But first:

 

I'm finding a lot of photos that Recuva says are unrecoverable... yet I get a preview in Recuva... and I CAN recover the entire file! Any ideas why?

 

And when I try to secure delete these files... Recuva goes through the motions but when I get an Operation Complete report... it says they were NOT overwritten... and indeed the files are still there.

 

I don't know if this helps... but all the files that are dubbed uncrecoverable and Recuva refuses to delete are said to be overwritten not by another file but by THE SAME FILE!!!

Link to comment
Share on other sites

  • Moderators

For a start (and as you rightly comment in another post), Recuva is a piece of software trying to determine whether a file is intact (recoverable) or not. I don't know what criteria it uses, apart from the obvious such as being overwritten, but it doen't always get it right.

 

Secondly, unrecoverable doesn't mean that you cant recover any data. It means that the data is not recoverable in it's original virgo intacta form, but presumably that was too long to fit in the column header. Anything Recuva points to, with a length greater then zero, can be recovered. It may well be rubbish, but that's how it is. If the data has been overwritten what you're recovering is the overwriting data, which might indeed be data from another live file.

 

If Recuva can't overwrite a deleted file it may be that it resides entirely in the MFT, has been overwritten by another live file, or that space is locked for some other unfathomable Windows reason.

 

I'm not too sure what you mean by overwritten by the same file. I guess it is possible that you create xxx, delete it, then create it again and another MFT entry is used but the data put into the same clusters as before.

Link to comment
Share on other sites

I'm not too sure what you mean by overwritten by the same file. I guess it is possible that you create xxx, delete it, then create it again and another MFT entry is used but the data put into the same clusters as before.

 

Greetings Augeas... I can only assume that the unrecoverable in the status bar was determined because the files were allegedly overwritten. But in this case... Recuva said the file was overwritten by the same file. This happened in about 50 instances. All the JPGs seemed intact in that I could recover them and view them in full resolution. No part of these photos was missing as is the case when using JPG repair programs. When I tried to delete these files... Recuva gave me the warning that this was forever... and it gave me the operation complete report. But all the files were listed as NOT overwritten... and when I rescanned, they were still there.

 

Sadly I used File Shredder to wipe the empty spaces in this drive. Otherwise I would have tried an MD5 checksum comparison between the originals and the recovered versions. That might indicate whether anything was truly missing from the file.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.