Augeas

If you found the files with a deep scan they will have names of [1234].docx or similar. What makes you think they are your lost files? If they are 1kb then they are not Word files.

As I undestand it the shadow copy system uses some sort of versioning method so that only changes to a file are stored. It may not be possible to recover complete files with Recuva from the shadow copies.

Also Win 10 Sys Restore is off by default, and I seem to remember reading that a Win update reverts the setting to off if it has been altered to on.

If you open the files with Notepad, or look at the header in Recuva, the file should start with %PDF-1.4 or 1.5. If there is no %PDF at the start then it's most likely that the data isn't a pdf and won't contain your data. I assume the disk is NTFS?

It's abnormal. I can run a deep scan on a 256mb SD card in (I guess, haven't run one recently) around half an hour, and that's with the card still in the camera attached by usb. So a 500mb card should be done in an hour or two at the most. I guess the timing depends on many things, not least how the card became corrupted. Also Recuva seems to have a habit of nodding off, if not actually sleeping. I don't know what it's doing.

I wouldn't want to dissuade you, but you will need perseverance.

Give us a clue, is it FAT32?

I think that the first batch of files found is the normal scan which a deep scan runs first, zipping through the MFT. However a deep scan has to look at and anaylse every unallocated cluster. Three tb is huge, and at 4096-byte clusters it would take 8.5 days even if it could anaylse 1,000 clusters a second, and it's probably processing at a far lower rate than that. Being USB connected will slow it down as well. These disks are just too large to backup, too large to recover.

1) the other settings you mention do not apply to WFS, they are in the section for Secure Delete, so the answer is no. With native WFS you get one pass of zeroes. 2) Wiping Alternate data streams and cluster tips are irrelevant in WFS, whether using Drive Wiper or the native WFS. The action of wiping MFT records is done under the control of NTFS, but effectively the whole record is wiped, by which I mean overwritten. Wipe MFT uses a single overwrite. Normal or secure doesn't make sense, the data is being overwritten. Yes, the documentation could be better. No, I am not going to do it.

Yes, that's it.

I think you may be confusing the two processes, which are entirely separate. Unchecking the Wipe MFT box in Options/Settings only applies when you run Wipe Free Space from Cleaner/Windows/Advanced. Using Drive Wiper will wipe the MFT whatever is in the Options/Settings box. If you don't want the MFT to be wiped then use WFS from Cleaner/Windows/Advanced.

You said you were using Drive Wiper. Wipe Free Space in Cleaner/Widows/Advanced does not wipe the MFT unless that option is checked in Options/Settings.

They're all system files that would be expected when an NTFS volume is formatted. They are essential for Windows to access the drive.

Furthermore the folder you're recovering to, Camera Roll, contains sub-folders DCIM and 104_PANA. These seem to have disappearded asfter the recovery. Are you sure the folder you selected and the folder you are looking in is the same place?

No. The free and paid for versions have the same recovery capabilities. I can't help on the disappearing recovered file as I've never experienced it. Recuva seems to have done something, I should look around your pc to see if the file is elsewhere.

Sys restore should be off by default on Win 10 systems.

All you can do is try a larger drive. Are you trying to recover system files, some of which are sparse files with a nominal size of the disk? Usually with an SSD it is impossible to recover any file after a format, as that runs a universal TRIM. If Recuva is listing files than perhaps TRIM isn't working across the USB connection. Try a recovery and see what you get. Oh yes, you can restore the folder structure (as much as you can) by going into Advanced Mode, selecting Options/Actions, and checking Restore Folder Structure.

It's not something I've ever experienced, so I can't be much help.

Does the space used on the 8tb drive increase when the recovery is completed, or remain the same?

My money's on whatever is on the drive has been put there by the user, in one way or another. I don't buy this testing story even a tiniest bit.

Ahh, I missed the bit about it being an SSD. Your chances of recovering file data from and SSD are close to zero. Cancel stage 2 as soon as stage 1 ends. Forget the $I file, the $R holds the data. Whatever you've found look at the header data in the Info pane in Advanced mode.It's likley to be all zeroes. It is almost impossible to recover data from a modern SSD.

Cancel stage 2. You will still get the results displayed and you can recover anythng found.

Well I don't know everything. Consider that 6.6 gb is only 0.0066 of a terabyte, so it could just be rounding (e.g 1.814 less 0.006 = 1.808 rounded to 1.81). Using properties on the drive will give a more accurate figure.

Possibly because drives are specified in terabytes (1k = 1,000 bytes) and Explorer uses tebibytes where 1k = 1024 bytes. So your 2tb disk says 2 terabytes on the label and 1.8 tebibytes when examined by Explorer. It's actually 10 to the power of 12. You will have some relatively small system files on there after formatting, but who knows what your 'some files' means.

Recuva is a file recovery program so yes, it lists deleted files as a default. Presumably you are trying to recover files deleted from the ronald folder?