14 replies to this topic

[Col_T]

No good deed goes unpunished as the saying goes ... I prepared three folders for back-up to disc by copying and placing them in the area for burning to to a 4.7 GB Recordable disc ... while going through the process to burn to disc, the disc itself was bad and I could not burn the three folders.  Those folders were MyPictures, MyMusic, and a professional folder.  The three folders contained approximately 3.3 GB of information.  I was going to copy the folders to a thumb/stick drive due to the disc problem, however the drive I had handy just did not have the required space available.  I decided to do the back-up at a later date and moved the three folders from the burn to disc area to the recycle bin and double checked to make sure the properties were the same for the files in the recycle bin and the primary folders in my documents.  It appeared to me there were two separate folders for each folder ... one in the recycle bin and one in the MyDocuments tree so as I thought, removing the folders in the recycle bin would not affect the contents of folders in the MyDocuments tree.  I ran a CCleaner analyzation and secure clean.  Now MyPictures folder in the MyDocuments tree says there are 1.6 GB present, but the individual photos do not open.  It appears to me that the CCleaner did the job on ten years of photographs and other important documents.  I have used CCleaner for a number of years and love the program.  I probably did something wrong on this occasion.  Right now my concern is trying to recover the MyPictures folder ... the other folders I would love back, however not as important to me ... actually the MyMusic folder seems to be fine ... all the music appears to be there and plays normally.  It is the MyPictures files and the word document files in the professional folder that do not open. This is my first time to the forum and wondered if there is a chance, the Recuva program might be able to recover my files.  Of course, being the thorough guy I am, I always use the Secure File Deletion setting ... not so smooth on this occasion.  Any help would be appreciated.

[Alan_B]

What is your Operating System ?
I cannot advise on your prospects of recovery, but your answer might guide those who can help you.

If it is not XP then I suspect you may have copied a reparse point to the recycle bin,
A Reparse Point appears to be a duplicate of an original and you can see the same files in each,
and when you secure erase the apparent duplicate you actually secure erase the original, leaving you with nothing.

[Augeas]

Strictly speaking no, there is no possibility of recovering file data clusters once they have been overwritten. However Windows itself, and other activities, might leave behind copies of the files which can be retrieved with Recuva. I should try a deep scan. You should, with a bit of luck, be able to rescue some of the files.

Of course if you run have wipe free space from time to time then the chances of recovering anything are close to zero.

[Col_T]

Thanks for the responses Augeas and Alan_B ... sorry to have not mentioned my OS ... yes it is XP Professional running on a Dell Inspiron 8600 notebook computer.  I have not looked at the Recuva tool yet, but will do so tomorrow.  I performed basic sector checks on the hard drive and also ran a command prompt looking for the files to show up in more than one location.  I performed kind of a wildcard search using the command prompt and the result was telling me the photo files with that particular name are located right in the C: ... mypictures ... etc. etc tree, where they are supposed to be and are still showing that they are there from the "properties" check.  I do believe I have some of these records backed up on another computer and/or mirrored external drive ... just not recent additions within the last four months or so.  Again, thanks for the responses and Alan, your Reparse Point sounds interesting, but I am running the Windows XP Pro OS ... and it appears that may not apply to my event.  I will keep watching for further responses.  Thanks very  much, Col T.

[Super Fast]

Just to be sure you really deleted, & not accidentally moved the pictures to another location via a drag & drop mistake, try using XP search to scan for pictures.

Additionally, if your using Windows burning to burn pics to a disk, you may be able to copy direct from there if you have not deleted already.
I believe you said you had a failed burn due to a bad disk.

Infra-recorder is a free program that does a better job of burning than XP burn. XP burning uses technology licensed from Roxio, but it is very buggy & errors out before burning a disk, if you have say, more than 40 to 100 + MB to burn.

This is NOT a CD/DVD problem. It IS a problem with the built in burning engine. For smaller amounts of Data, it may be pretty reliable. But larger sets will require Infra-Recorder, Nero, or some other more reliable burn engine.

If you had a failed burn, the folder(s) should still be there (Unless you deleted them).

[Alan_B]

I think Reparse Points were used from Windows Vista onwards to "fake" compatibility for applications that expected to use C:\Documents and Settings\ etc.
They were probably not used on XP unless you created them for yourself.

[Col_T]

Thanks Alan ... no, I did not create any Reparse Points knowingly ... just an added observation, some of the photos are appearing when I do an XP Search and they will open on a "Preview" basis.  I cannot tell the percentage, however on the one search parameter where I used my wife's name on the file search, it looks like 10-15% of the photos are still there in the normal Windows C: drive location.  I am not complaining, but wonder why some would be there and others gone.  I will try to use the Recuva later today when I have time to spend.  Thanks again, Col T

[Keatah]

Be aware that as you use windows on this disk, files are getting overwritten. Some could be the important data you're going after. It is best to clone the disk sector by sector and work from there, or boot into a linux/winPE environment and work from there also.

[Keatah]

The first rule of data recovery operations is Do No Harm. This is a logical recovery. And this means no write operations should be issued to the disk you're working on.. Like I just got through saying, windows (any version) writes billions upon billions of small files for regular housekeeping. So work from clone or a CD-based o/s, thus preserving what little file structure is left.

[Super Fast]

Col_T, on 21 July 2012 - 10:33 AM, said:

Some of the photos are appearing when I do an XP Search and they will open on a "Preview" basis.
I cannot tell the percentage, however on the one search parameter where I used my wife's name on the file search, it looks like 10-15% of the photos are still there in the normal Windows C: drive location.

What happens if you right click a photo that appears, then choose "Open with" & select paint?

[Col_T]

I tried to use the "Open With" option for a number of photo programs I have on board ... when I select Paint I just get a window that says,  the file address then ... "Paint cannot read this file.  This is not a valid bitmap, or its format is not currently supported "

Tried the Recuva deep scan from the Recycle Bin deletion by CCleaner and did not get anything returned on normal view ... then selected "Advanced" and there were 100's of thumbnails ... some of which I did not even recognize ... my computer was a refurbished Dell Inspiron, so maybe some of those deleted images were from previous owner ... who knows.  More importantly, my main "My Pictures" folder and files for the most part are still unrecovered.  I did open up an Adobe PhotoShop Starter program I have, and they have little thumbnails of many of the older images, however they will not open up for a slide show or copy to another location ... nor open in a normal size.  Is the pro version of the Recuva worth a shot or is the basic version going to do the same time of thing.  Again, I used the secure (sorry for the misspelling in the title) file deletion option with the CCleaner.  Thanks for any responses.

[Keatah]

Oftentimes the preview modes of various "photoshop" and paint programs will use a tiny version of the image stored within the bigger image. Basically two pictures in one. The preview version and then the full-size image. It is possible that we're just seeing the tiny version here. The rest is probably overwritten. Who knows?

I also believe (but never bothered to look into it) that windows can associate a file-name with a tiny thumbnail in a thumbs.db file. This means that windows sees a filename it checks the thumbs.db file and shows a tiny preview via that file. This is like a cache file.

If this was my system and I wanted this data back I'd be trying something more advanced than Recuva. Something like Ontrack EasyRecovery Pro or Adroit PhotoRecovery. I would also be working from a clone image. This means a sector-by-sector copy of the disk or a .IMG file of the whole disk. Work with the image. Because the longer the "suspect" disk is in use the more areas are overwritten.

I won't BS you here or offer false hopes. No. If a file is overwritten, only the very best forensic labs can retrieve the latent patterns "underneath" the wipe data issued by CCleaner. It is costly and runs hundreds of dollars per file or more. This is generally used for legal investigations and that's if you could find a lab to take the job anyways.

Second, I believe your only hope is to look in areas of the disk that have not been overwritten & secure erased. This is where a file carving program comes in. Recuva does only basic carving, it follows file information and chains. But it can't rebuild a file that's been scattered and fragmented. I've asked about Recuva's capabilities but no one seems to know for certain. Other more advanced programs can use different clues and piece together more data.  And a pro data recovery lab can do some of this by hand for a few special files.

[Keatah]

Super Fast, on 20 July 2012 - 04:45 PM, said:

Just to be sure you really deleted, & not accidentally moved the pictures to another location via a drag & drop mistake, try using XP search to scan for pictures.

Additionally, if your using Windows burning to burn pics to a disk, you may be able to copy direct from there if you have not deleted already. I believe you said you had a failed burn due to a bad disk.

If you had a failed burn, the folder(s) should still be there (Unless you deleted them).

Additionally, If the space used by the temporary burning files from the aborted cd creation operations has not yet been overwritten - All those files could be there! It would take a bit of digging and some software beyond what Recuva can do, but definitely possible. As long as any freespace wipe hasn't yet been done. And that's why I keep stressing not to be using this disk until it has been imaged!

[Alan_B]

Col_T, on 25 July 2012 - 11:50 AM, said:

Is the pro version of the Recuva worth a shot or is the basic version going to do the same time of thing.

Yes and No.

NO because the "pro version" is identical in function and capability to the free version.
YES because Piriform developers with in depth knowledge will give advice direct to those who buy PRO support for CCleaner,
and I would guess that if they offer PRO support for Recuva then you should similarly get their support.

[Col_T]

Thanks for the replies ... I will look to image the HD to an external drive asap ... and still looking to get my other computer from my son to see how much of the My Pictures folder was backed up to that drive.  Thanks again ... will keep you posted.