Recuva freezing?

[Bigbaby]

I am running recova (deep scan) on an external harddrive of ~600GB. After running for an hour or so, it finds tens of thousands of files, but still says that the scan is 0% complete and that it won't be finished until 8 days from now. Then, half an hour later, the # of files found was the same, but the estimated completion time was 12 days.

 

I am thinking that the program is freezing, although I dont know why. A few weeks ago, I tested the software on my regular (C:/) drive and had no such issues.

 

Should I wait 10+ hours for recova in this situation, hoping that it will eventually finish, or is the "Current Progress: 0%" a sign of something going wrong?

[Nergal]

To begin, let me welcome you to the forum.

 

now to your question; most likely the program is not freezing. The evidence is twofold here.

First of all the time specified is, at best, a rough estimate; one which will become more reliable,but still an estimate, as the process nears 100%.

 

Second the deep scan and size of the drive I'd expect a scan to take at least 24 hours if not a few days.

 

To aid us in our aid of you, what occurred to data you are trying to resurrect?

How Likely is that data to have been overwritten (how long ago was the deletion, in how much use has (is) the drive been since the deletion)?

is the drive connected by USB 1, USB 2, USB 3, FireWire, eSATA?

[Bigbaby]

We had a computer crash, and we attempted a Dell Datasafe Recover of our personal data after having somebody (at best buy, unfortunately!) show us that option. Unfortunately, that technician began and cancellled (via powering the computer off) that process, since he was just showing us how to do it... when we did the same thing later, Dell Datasafe did not ask us to log into a profile (as it had before). So, the process reinstalls windows, and we had none of our files recovered as we were supposed to, which I blame on the process being cancelled after it had begun by the Best Buy guy.

 

In any case, we can say this is like a reinstall of windows. After observing that the files that were supposed to be there were not there, we discontinued use of the computer.

 

I tried a different software first (Wondershare), which found many pictures in good condition, but which had two problems: 1) Almost no Word or Excel documents were recovered in good condition 2) only 100MB is recoverable without paying for it.

 

I thought I'd use Recova to see if it had better luck with our excel files, since ive heard that some software has better results than others with particular files. As of this posting, I have had a scan running for 4 hours and it still says 0% Progress, and this time actually still says "Calculating time left"... the number of files found (70k-ish) is exactly the same amount that it had found in the first hour of scanning.

 

Our goal is to recover every JPEG file on the computer and one excel file in particular. Other excel and word docs are a bonus. The drive is a 2.5" SATA, and I am not sure what USB cable I am using; I got an enclosure+USB off of Ebay to connect the harddrive externally to the computer I'm using to type this -- let me know how I can tell which USB cable I have!

 

EDIT: from googling, I can see that I don't have USB 3.0... not sure on 2.0 vs. 1.0. Other info: task manager says that recova is using a fixed amt of memory and no CPU as of this time.

[Bigbaby]

Update: late last night, I noticed that connecting the external hard drive was causing two partitions to appear in My Computer (F and G). Unlike earlier in the week when I had started attempting file recovery, neither drive was accessible; windows explorer would freeze if I attempted to open (or even right click) the F or G drive. No info (e.g. free space, total space) was displayed for either drive.

 

After restarting my computer twice and after some bizzare behavior, the G drive now shows GB of free space as it should, like the C drive. Recuva has been working properly overnight (50% done, 1.9m files found), so I am guessing that my problems had to do with my computer's messed up interpretation of what the external drive was, rather than any issue with Recuva.

[Bigbaby]

Ok my scan finished running, and I've encountered another issue.

 

I ran a Deep Scan with "Find undeleted files" checked as well. Unfortunately, the results contain ~10 copies of every file that was recovered! The total size of the files I am trying to recover is 3.6T, even though the drive's entire size is 600GB. Has this happened to anybody else, and what can I do to address this?

 

EDIT: I tried unchecking every file that Recuva had found except for a few excel files, and was told that I still needed 3.5T to recover (less than before, but still absurd). What is going on here?

[Alan_B]

Perhaps a file was :-

defragged a few times ;

or edited a few times ;

or shuffled around by Windows because it loves to annoy users ;

and each time it occupied a different region of the disk.

 

Recuva is prepared to attempt any instance you select.

 

I have read that Recuva will designate a deleted file as OVER-WRITTEN only WHILST the overwrite exists

but if the OVERWRITE file has in turn been deleted then Recuva may fail to recognise that an overwrite ever occurred.

 

I have seen alternative recovery programs that have the same failing,

and any given sector cluster may be counted as part of the contents of hundreds of different files that occupied it at ANY time in the past.

I have even seen them discover :-

7.295 TB in a 127.96 MB FAT32 partition; and

27.125 TB in a RAW DATE scan of a 600 GB HDD.

I vaguely remember once seeing what looked like an arithmetic overflow with a 64 bit utility under 64 bit Windows Ultimate that should have known better.

 

Although Recuva may wrongly count each instance of use of a sector in the grand total of what can be recovered (addition total 3.6 TB)

maybe it correctly counts only a single instance of a sector when you deselect multiple files that each used that sector (subtraction total 100 GB)

hence the result fell to only 3.5 TB.

 

Is it possible to DeepScan without selecting everything, and only select what is needed after the scan ?

(I did not need Deepscan and do not have the patience to try )

[Bigbaby]

The problem was that it refused to let me recover even a single selected file, because Recuva claimed that I had 3.5T selected which did not fit on my other hard drive. It was very frustrating to see that after a day of waiting for the scan to complete.

[Nergal]

The problem was that it refused to let me recover even a single selected file, because Recuva claimed that I had 3.5T selected which did not fit on my other hard drive. It was very frustrating to see that after a day of waiting for the scan to complete.

doesn't seem to me that this is the fault of Recuva...how vs you expect to recover X to Y when X>Y

[Bigbaby]

doesn't seem to me that this is the fault of Recuva...how vs you expect to recover X to Y when X>Y

 

The drive I was attempting to recover from is of size 580GB... recuva found data totalling 5-6 times more than the entire drive could possibly hold. The problem was twofold:

 

1) Of identified files, most of them showed up 5-10 times. This was the smaller of the two issues.

2) Even after unselecting every single file (except for one) out of the >1M files found, the size of my recovery attempt only went from 3.6T to 3.5T; the 1M files were totalled about 100GB in size. I have no idea what Recuva thought that 3.5T (again, several times the size of the hard drive I am attempting recovery on) was, but it certainly didn't actually exist on the external drive in any way shape or form.

[Alan_B]

I have no idea what Recuva thought that 3.5T (again, several times the size of the hard drive I am attempting recovery on) was, but it certainly didn't actually exist on the external drive in any way shape or form.

 

I have already told you how Recuva AND OTHER UTILITIES can count the same sector many times and over-estimate the PREVIOUS content of the drive.

 

Perhaps you failed to understand what I concluded with

Please refrain from SELECTING the 3.6 TB that Recuva suggests.

 

After the Deepscan start with a ZERO GB size of zero files selected,

and then add the files that you really want,

and if you select wisely the selected amount will gracefully increase from zero GB to 100 GB or whatever you reach before calling it a day.

 

As I previously said, I have never needed Deepscan nor had the patience to waste a day or two,

but if Recuva Deepscan is unlike other utilities and always starts with a grand-slam of 3.6 TB,

then I suggest you post a complaint in the BUG Report forum requiring that it ONLY select what the user chooses.

[Augeas]

Alan, it seems that either you or I are misreading what Bigbaby posted. He (let's assume) said that he selected one file and Recuva still required 3.5 tb of space.

 

In a normal scan Recuva will read the deleted entries in the MFT. Some may contain details of large files that no longer exist, so in theory there is a possibility that the returned total of space used might be larger than the actual disk capacity. It would be very, very unusual if on a 580 mb disk there were entries in the MFT totalling 3.6 tb. So unusual I would discount it. Of course the way to test this is to run a normal scan, which takes just a few mins, or secs.

 

In a deep scan Recuva will read sectors looking for a recognisable file signature. No matter how the disk is fragmented, or defragmented, or whatever the sectors are only read once, unless some other unknown factor is at play. So a deep scan would not return more data than the disk can hold. A deep scan also runs a normal scan first.

 

If the deep scan is returning a total of 3.6 tb to do a recovery from a 580 mb disk (I don't know how you can count the amount of data without attempting to run a recovery) than I think that the other factor, whatever that is, is present.

 

I haven't the time to do too much thinking at the moment, but it looks as if the disk is being read several times. I wonder if the disk somehow is being allocated to several disk id's, f, g, etc, even if they're not showing? This is only initial thoughts.

 

I would suggest scrapping the deep scan. Reboot the pc and check the disk allocation (you have reported problems with this). Do this until you get a clean boot and disk alloc.

 

Run a normal scan, see how long it takes and how much space it needs for a recovery (you don't have to run the recovery).

 

Then run the deep scan again. It should take no longer than an hour or so. If you notice that stage 1 has completed then cancel stage 2 (or 3) of the scan, You will still get the results and it will save time. Then report back.

 

Oh yes, run Recuva in Advanced mode, it's so much easier to manage. And check that in Recuva the disk you're scanning isn't set to All Local Disks.

 

PS I'm assuming the disk is NTFS, and your O/S is?

[Alan_B]

I understood that there were 10 copies of many files and initially all of them were selected to restore with an INAPPROPRIATE total of 3600 GB,

and that after deselecting almost everything a CORRECT total of only 100 GB was deducted from the initial total of 3600 GB to give an INCORRECT new total of 3500 GB.

Hence my approach of avoiding the inappropriate total from the start and avoiding any chance of arithmetic overflow or any of the other nasty surprises that Windows is full of

 

I do however defer to your much greater experience of Recuva and how to get the best out of it.

[Bigbaby]

Augeas, you are correct in your interpretation of what I was saying.

 

As for drives, I wanted to ask a bit more info to be sure of what you meant. The external drive has windows 7 installed on it from a Dell computer. My computer is windows 7 installed on an HP; I usually see my C:\ drive, a recovery D:\ drive, and an inaccessible Q:\ drive.

 

I had repeated problems this week with the external drive. Sometimes nothing would show up in My Computer when I connected the USB cable. If something did show up, both F:/ and G:/ would show. However, G:/ would sometimes not display any info, and would freeze windows explorer if I so much as clicked on it. Other times, G:/ would correctly tell me "XXGB free out of XX GB", would be openable, etc. F:/ has never been readable; windows either freezes or tells me that the drive is corrupted and unreadable. The drive is listed as having 640GB in total (from manufacturer); drive G has 556 of 581GB free. Elsewhere, I can see that F:/ has 14.65GB allocated (none used), and that there are two physical drives that are about 15GB larger than my C:\ and G:\ drive respectively. So other than the odd F:/ allocation (is this the equivalent of my D:/, recovery, drive??), there doesn't appear to be anything too crazy going on.

 

In any case, to add more info, from googling, I read that many windows programs can cause problems with USB connections. As someone who doesnt regularly use my USB ports, I thought that this was maybe the cause of the G:/ drive sometimes freezing. I am currently in Safe Mode, going off of this theory, and have been able to correctly view my G:/ drive over the past 24 hours straight. I don't see my Q:/ drive in safe mode -- not sure if that matters.

 

 

Let me know if there is an exact way to check my disc allocation! I am running recuva non-deep scan for non-deleted files at this time, will report back later today.

 

EDIT: Using Computer Management, I see that the external drive has XXX allocated to drive G:/ which is Healthy, NFTS, Primary Partition. Drive F:/ is Healthy, RAW, Active, Primary partition. there is a 100MB OEM partition as well (healthy).

[Alan_B]

If you click the bottom left corner "Start" button and right click on "Computer" and select "Manage" you can choose Storage / Disk Management.

A screen shot could be useful.

It might be useful to power down and then use a different USP port and power up again and take another look at Disk Management,

and post a second screen shot if there is a significant difference.

[Bigbaby]

Ok, Recuva (using quick scan + looking for non-deleted files) didnt find anything useful (none of the files I want). BUT, when I tried to recover what it did find, it told me that the total size was 650 GB (still larger than the physical disc and not something that should have been find-able in 20 mins of a quick scan, right?). More strangely, this time when I select only one file to recover, Recuva *does* allow me to do so. What in the world is going on?

[Augeas]

Where do you get the total size from? It seems that you get this figure without running a recovery. I don't get any total size when I run a test recovery.

 

PS What's going on? That's what we're trying to find out.

[Bigbaby]

Where do you get the total size from? It seems that you get this figure without running a recovery. I don't get any total size when I run a test recovery.

 

PS What's going on? That's what we're trying to find out.

 

I ran the normal scan earlier today (with Search for Non-Deleted Files checked). It took about 15 mins, and found a bunch of files that, in tree view, were under my G:\ drive. With my entire G:\ drive checked, I attempted to recover these files that were found to my C:\ drive. Recuva informed me that I was unable to do this via the "xxxxx bytes available, yyyyyy bytes needed for recovery". "xxxxx" in this case was ~500GB on my C:\ drive, and "yyyyy" was 650GB. The problem is, 650GB is larger than the entire G:/ drive.

 

When I unchecked G:/ and selected a single file of size 5MB or so, it recovered successfully without that error message (although it took 3-4 minutes to do so). This was UNLIKE my previous experience with the Deep Scan results, when with G:/ entirely checked, I was told that I needed 3.6TB of space, and with G:/ entirely unchecked (except for one file), that I needed 3.5TB of space.

 

I do have some questions that might reveal something:

1) You mentioned that I could cancel the quick scan after step 1/3 to save time... while this is true, on my end, step 1 takes 99+% of the time of all three steps. Step 2 and 3 are finished in under 30 seconds, at least with the non-deep scan.

2) You mentioned that the deep scan should take no longer than an hour or so... this actually took about 24 hours the first time around.

3) I have no idea where I can see the size of all of the files I've selected; I was only able to tell this after Recuva did not allow me to recover things, or can only tell it by clicking on individual files within Recuva.

4) I am running things in advanced mode.

 

5) I am unclear on what a "test recovery" is, as far as it differs from a "recovery attempt". In all cases, I got my size-of-files figures from attempting a recovery after a scan had been completed, if that helps.

[Augeas]

OK, I have run a few tests, recovering - or attempting to recover - my 160 gb c drive to a 100 mb partition on a usb-attached disk. This is what I get.

 

1) A recovery of all files from a normal scan without Scan for non-deleted Files selected fails as it needs 4 gb of space - as expected.

 

2) A recovery of all files as in 1 with Restore Folder Structure fails with max path exceeded. That's annoying.

 

3) A recovery of all files from a normal scan with Scan for non-deleted Files selected fails as needs 200 gb of space - this is not as expected as I have about 26 gb of live data, and 200 gb is more than the total disk size. 200 gb is about 7 to 7.5 times the expected space requirement. My live files plus the 4 gb of deleted files found in the scan at 1 should require around 30 gb.

 

4) Again if I select Restore Folder Structure the recovery fails with max path exceeded.

 

5) If I select tree view and select drive c, or just check all entries in list view, the result is the same.

 

If I try to sort and then select all non-deleted files in list view to see what would happen, Recuva locks up with 50% cpu and has to be chopped.

 

If I try to highlight a reasonable portion of the files in list view, more than one page, Recuva locks up again with 50%+ cpu, even in a normal scan of deleted files only. Yet a check all will go ahead and try to run the recovery.

 

The difference is that I'm attempting to recover my c drive to a USB drive, and you are attempting to recover a USB drive to well, I'm not sure.

 

Recuva's file counts look fine, at 62k deleted files and 82k live files, 144k in total. I'm not going to run a deep scan.

 

So from these tests I can agree that there is a problem with selecting a full disk to recover, deleted and undeleted files. Perhaps Recuva really only wants 30 gb (in my case) and it's the space calculation that's wrong, I don't know.

 

I'm on W8P32, by the way.

[Bigbaby]

To be clear, the harddrive im trying to recover from had an issue, blue screen of death, and would not work. We tried a Dell Datasafe Recover, which we were assured would work, but did not -- windows reinstalled with none of our files existing. So, I am trying to recover any files from the empty space on that harddrive and restore them to my harddrive. There's no USB stick involved.

 

So is the theory at this point that Recuva had all of the files that I wanted, but that I was unable to recover them because of a faulty calculation of the space-needed requirement?