Jump to content

Return to Piriform.com

Photo

Recovering the Unrecoverable, and Unable to Delete


  • Please log in to reply
3 replies to this topic

#1 OFFLINE eniwetok

eniwetok

    Advanced Member

  • Members
  • PipPipPip
  • 69 posts

Posted 04 July 2010 - 02:50 PM

This differs from a post of a few days ago where I could not securely delete files because they were not actually deleted and the delete options were ghosted out. In this case the files HAVE BEEN deleted... and I DO have those options available. But first:

I'm finding a lot of photos that Recuva says are unrecoverable... yet I get a preview in Recuva... and I CAN recover the entire file! Any ideas why?

And when I try to secure delete these files... Recuva goes through the motions but when I get an Operation Complete report... it says they were NOT overwritten... and indeed the files are still there.

I don't know if this helps... but all the files that are dubbed uncrecoverable and Recuva refuses to delete are said to be overwritten not by another file but by THE SAME FILE!!!

#2 OFFLINE Augeas

Augeas

    Moderator

  • Moderators
  • 3,085 posts
  • Gender:Not Telling
  • Location:Where Stuff is made, UK

Posted 04 July 2010 - 04:03 PM

For a start (and as you rightly comment in another post), Recuva is a piece of software trying to determine whether a file is intact (recoverable) or not. I don't know what criteria it uses, apart from the obvious such as being overwritten, but it doen't always get it right.

Secondly, unrecoverable doesn't mean that you cant recover any data. It means that the data is not recoverable in it's original virgo intacta form, but presumably that was too long to fit in the column header. Anything Recuva points to, with a length greater then zero, can be recovered. It may well be rubbish, but that's how it is. If the data has been overwritten what you're recovering is the overwriting data, which might indeed be data from another live file.

If Recuva can't overwrite a deleted file it may be that it resides entirely in the MFT, has been overwritten by another live file, or that space is locked for some other unfathomable Windows reason.

I'm not too sure what you mean by overwritten by the same file. I guess it is possible that you create xxx, delete it, then create it again and another MFT entry is used but the data put into the same clusters as before.

#3 OFFLINE eniwetok

eniwetok

    Advanced Member

  • Members
  • PipPipPip
  • 69 posts

Posted 04 July 2010 - 04:36 PM

I'm not too sure what you mean by overwritten by the same file. I guess it is possible that you create xxx, delete it, then create it again and another MFT entry is used but the data put into the same clusters as before.


Greetings Augeas... I can only assume that the unrecoverable in the status bar was determined because the files were allegedly overwritten. But in this case... Recuva said the file was overwritten by the same file. This happened in about 50 instances. All the JPGs seemed intact in that I could recover them and view them in full resolution. No part of these photos was missing as is the case when using JPG repair programs. When I tried to delete these files... Recuva gave me the warning that this was forever... and it gave me the operation complete report. But all the files were listed as NOT overwritten... and when I rescanned, they were still there.

Sadly I used File Shredder to wipe the empty spaces in this drive. Otherwise I would have tried an MD5 checksum comparison between the originals and the recovered versions. That might indicate whether anything was truly missing from the file.

#4 OFFLINE eniwetok

eniwetok

    Advanced Member

  • Members
  • PipPipPip
  • 69 posts

Posted 04 July 2010 - 06:50 PM

OK, I did post last year that the status indicator seemed to giver erroneous info:

http://forum.pirifor...=1