5 replies to this topic

[tomsccr]

Hello: I just did a test run using recuva, so I could learn how to use it, anyway what I did was make a .txt document on my desktop and after naming it "Receipe Book" , I deleted it
Then I ran recuva immediately, but I could no find the ,txt document I had just deleted, what am I doing wrong can some one tell me, Thanks

[Augeas]

Oddly enough files that have just been created and deleted are often the first to be overwritten. I should say that the entry in the MFT that points to the deleted file has been reused.

If you kick off Recuva, or any application, there may well be entries created in the prefetch folder, log or error files, and other Windows stuff I can't think of at the moment. These will tend to use the most recently used available slot in the MFT, which held your poor defenceless deleted file. If you open Recuva and then do your file create/delete and a Recuva scan you should find your file.

[tomsccr]

Augeas, on Oct 31 2009, 03:43 PM, said:

Oddly enough files that have just been created and deleted are often the first to be overwritten. I should say that the entry in the MFT that points to the deleted file has been reused.

If you kick off Recuva, or any application, there may well be entries created in the prefetch folder, log or error files, and other Windows stuff I can't think of at the moment. These will tend to use the most recently used available slot in the MFT, which held your poor defenceless deleted file. If you open Recuva and then do your file create/delete and a Recuva scan you should find your file.

You said>> If you open Recuva and then do your file create/delete and a Recuva scan you should find your file<<

Please be patient with me, this is my first time using this,

Are you saying you cannot recover a file if you dont have Recuva opened and ready to go when you delete a file?

Also I heard you should not do anything on the computer to cause the file to be overwritten, and I thought, if I tried recuva right away the file would not be overwritten?

[Augeas]

tomsccr, on Oct 31 2009, 07:05 PM, said:

Are you saying you cannot recover a file if you dont have Recuva opened and ready to go when you delete a file?

Not at all. In the circumstances you describe, creating and then immediately deleting a file, it might be better not to open any applications before looking for the deleted file. So if you want to create a file, immediately delete it, and then look for it with Recuva it might help if you already have Recuva opened ready to run. In normal use you wouldn't have the luxury of opening Recuva before (presumably inadvertently) deleting a file, so this doesn't apply.

tomsccr, on Oct 31 2009, 07:05 PM, said:

Also I heard you should not do anything on the computer to cause the file to be overwritten, and I thought, if I tried recuva right away the file would not be overwritten?

Yes, it is best to do as little as possible on your pc if you are trying to locate and recover a deleted file. Almost everything you do causes Windows to write some sort of file, so the less use the better.

Just play with Recuva, you will soon find out what it can and can't do.

[pglenn]

tomsccr, on Oct 31 2009, 01:13 PM, said:

Hello: I just did a test run using recuva, so I could learn how to use it, anyway what I did was make a .txt document on my desktop and after naming it "Receipe Book" , I deleted it
Then I ran recuva immediately, but I could no find the ,txt document I had just deleted, what am I doing wrong can some one tell me, Thanks

Did You actually write anything to the file ??
- If not it won't show up in Recuva, because by default Recuva doesn't show zero-byte files.

[Augeas]

And also did you delete it to the recycler, and then empty the recycler? If so, Windows renames files sent to the recycler, so the file may not be found under its original name.