Jump to content
CCleaner Community Forums

Augeas

Moderators
  • Content count

    4,122
  • Joined

  • Last visited

Posts posted by Augeas


  1. Svchost.exe deleted? Hmm.

    I assume you want the file names removing, as the file content is probably not sensitive and is not available on an SSD with TRIM anyway. I also assume that the file system is NTFS.

    As what you are listing with Recuva is just a file name, and the contents have long gone, I would ignore them unless you have a specific reason to remove them. Remving (or overwriting) the file name is rather awkward, but you can do it yourself fairly efficiently.

    Run Recuva and estimate how far down the list the file names are. Create a folder with a random name anywhere. Create a small file in that folder with a random name with notepad or similar containing say, a few zeroes. Create another nine files so you have ten in total. Create another random named folder and copy your ten files into it. Repeat until you have ten folders and 100 files. Group the ten folders under another folder, and copy that ten times, giving you a thousand files. Carry on until you have created as many files as svchost.exe is down Recuva's list of files.

    Run Recuva again. If svchost.exe is still there it should be near to the top. If it's 100 from the top create/copy another 100 files. Run Recuva. Svchost should be gone. Delete all your folders. That's it.

     


  2. Possibly because the preview and the image are separate parts of the file. As has been said a zillion times before, Recuva will copy what's in the clusters on the disk without changing a single bit, so if the recovered copy is rubbish, so is the original.

    In Recuva Advanced mode have a look at the Header pane. There should be the correct file signature, and header format, for the file type (don't ask me, use Google). If it isn't then the recovered file won't open.


  3. I don't think that your problem is similar to the O/P's. He or she has obviously done something at the global level, perhaps formatting the drive. I doubt very much whather all 798gb of files were shift/del'd individually.

    Do you mean on a scan with no filters applied no files were returned? I have never known this in over ten years of using Recuva on internal and occasional external drives. Or do you mean that your video wasn't found? That's quite possible. It's difficult to advise without more info.

    This should be continued on your other thread.


  4. Do you have a Windows.old? M/S says it is auto-deleted 10 days after the upgrade, but there are plenty of how to delete articles so perhaps it's more persistent than that. Anyway, do you? If not then the chances of recovery are very slim, in my opinion.


  5. I guess that this is NTFS, the drive is visible to Windows with a drive letter, and you ran a Recuva deep scan.

    A deep scan runs a normal scan first, so usually you will get a list of file names and associated folders before all those [001234].ext files. These file and folder names all come from a scan of the Master File Table, they are not held within the files. If youi are getting zero file names, then either the disk has been formatted or perhaps the MFT is corrupted. NTFS needs an MFT to do anything at all, so if the MFT is corrupt then the MFT mirror can be used, This only holds about 16 records so it will only identify system files, but it enables access by Windows.

    A deep scan will scan all unallocated clusters for a file header, which identifies the start of a file and the file type. Only a subset of all possible file types are scanned. No file or folder names can be deduced from a deep scan. As the clusers are unallocated they will all have a state of excellent, but don't let that fool you. Only the first extent of a file will be found and be a candidate for recovery. Subsequent extents cannot be identified and will be ignored, so a recovered file may not open anyway.

    I should rerun Recuva with deep scan unchecked, and (in Advanced mode, Options, Actions) check Search for Non-Deleted Files, and check Restore folder streucture. It should be fairly fast and is worth a try.


  6. I think I'm getting there. You ran a backup tio an already existing folder on the G drive (Y-Folder), and purge, which:

    'Deletes destination files and directories that no longer exist in the source',

    wiped out everything already in that folder. You then ran a recover of the contents of Y-Folder back to the D drive, but none of the files recovered open.

    But that doesn't get provide a solution. The headers aren't Recuva's, but the files', and no file with zeroes in the header will open (except text files) as the file structure is unidentifiable. It's highly likley that the rest of the file is zeroes also.

    I wouldn't have thought that Robocopy would overwrite deleted destination files with zeroes, but something has.


  7. Btw what does "zeros" in Header mean? = BUT Header: all "00"

    File names, directory names, cluster addresses etc are all held in the MFT. What's actually on the disk could be anything. I'm still not sure what you did or were trying to do. Perhaps someone with experience with Robocopy can chime in.

     


  8. With TRIM enabled on the O/S and SSD the chance of recovering any deleted file from an SSD is just about zero. Recuva will scan the MFT to reetrieve the file names and cluster addresses, which still exist. The clusters will however be filled with zeroes. In Advanced Mode if you look at the file headers this should confirm the zeroes. Recuva will recover these zero clusters quite happily, but they are of no use. A professional data recovery service might be able to recover some of the files, at a cost, by reading the nand chips natively.

×