![]() ![]() |
Oct 31 2009, 01:13 PM
Post
#1
|
|
|
Newbie ![]() Group: Members Posts: 4 Joined: 15-December 08 Member No.: 25,363 |
Hello: I just did a test run using recuva, so I could learn how to use it, anyway what I did was make a .txt document on my desktop and after naming it "Receipe Book" , I deleted it
Then I ran recuva immediately, but I could no find the ,txt document I had just deleted, what am I doing wrong can some one tell me, Thanks |
|
|
|
Oct 31 2009, 03:43 PM
Post
#2
|
|
|
Power Member ![]() ![]() ![]() ![]() Group: Members Posts: 1,148 Joined: 20-June 07 From: Worcestershire, UK Member No.: 14,134 |
Oddly enough files that have just been created and deleted are often the first to be overwritten. I should say that the entry in the MFT that points to the deleted file has been reused.
If you kick off Recuva, or any application, there may well be entries created in the prefetch folder, log or error files, and other Windows stuff I can't think of at the moment. These will tend to use the most recently used available slot in the MFT, which held your poor defenceless deleted file. If you open Recuva and then do your file create/delete and a Recuva scan you should find your file. |
|
|
|
Oct 31 2009, 07:05 PM
Post
#3
|
|
|
Newbie ![]() Group: Members Posts: 4 Joined: 15-December 08 Member No.: 25,363 |
Oddly enough files that have just been created and deleted are often the first to be overwritten. I should say that the entry in the MFT that points to the deleted file has been reused. If you kick off Recuva, or any application, there may well be entries created in the prefetch folder, log or error files, and other Windows stuff I can't think of at the moment. These will tend to use the most recently used available slot in the MFT, which held your poor defenceless deleted file. If you open Recuva and then do your file create/delete and a Recuva scan you should find your file. You said>> If you open Recuva and then do your file create/delete and a Recuva scan you should find your file<< Please be patient with me, this is my first time using this, Are you saying you cannot recover a file if you dont have Recuva opened and ready to go when you delete a file? Also I heard you should not do anything on the computer to cause the file to be overwritten, and I thought, if I tried recuva right away the file would not be overwritten? |
|
|
|
Oct 31 2009, 07:21 PM
Post
#4
|
|
|
Power Member ![]() ![]() ![]() ![]() Group: Members Posts: 1,148 Joined: 20-June 07 From: Worcestershire, UK Member No.: 14,134 |
Are you saying you cannot recover a file if you dont have Recuva opened and ready to go when you delete a file? Not at all. In the circumstances you describe, creating and then immediately deleting a file, it might be better not to open any applications before looking for the deleted file. So if you want to create a file, immediately delete it, and then look for it with Recuva it might help if you already have Recuva opened ready to run. In normal use you wouldn't have the luxury of opening Recuva before (presumably inadvertently) deleting a file, so this doesn't apply. Also I heard you should not do anything on the computer to cause the file to be overwritten, and I thought, if I tried recuva right away the file would not be overwritten? Yes, it is best to do as little as possible on your pc if you are trying to locate and recover a deleted file. Almost everything you do causes Windows to write some sort of file, so the less use the better. Just play with Recuva, you will soon find out what it can and can't do. |
|
|
|
Oct 31 2009, 11:30 PM
Post
#5
|
|
|
Newbie ![]() Group: Members Posts: 4 Joined: 31-August 09 From: Indiana Member No.: 31,451 |
Hello: I just did a test run using recuva, so I could learn how to use it, anyway what I did was make a .txt document on my desktop and after naming it "Receipe Book" , I deleted it Then I ran recuva immediately, but I could no find the ,txt document I had just deleted, what am I doing wrong can some one tell me, Thanks Did You actually write anything to the file ?? - If not it won't show up in Recuva, because by default Recuva doesn't show zero-byte files. |
|
|
|
Nov 1 2009, 02:05 AM
Post
#6
|
|
|
Power Member ![]() ![]() ![]() ![]() Group: Members Posts: 1,148 Joined: 20-June 07 From: Worcestershire, UK Member No.: 14,134 |
And also did you delete it to the recycler, and then empty the recycler? If so, Windows renames files sent to the recycler, so the file may not be found under its original name.
|
|
|
|
![]() ![]() |
|
Lo-Fi Version | Time is now: 21st November 2009 - 05:53 AM |