vomkolke Posted October 16, 2013 Share Posted October 16, 2013 I used revuca today to recover deleted files from my SSD * I did it immediately (files weren't overwritten) * recuva finds my files: green button, state: excellent, no overwritten clusters detected (but no preview available (e.g. for PNG-files)) (see attached screenshot) Files are listed correctly in the newly chosen folder. (name, file size, program icon e.g. for WORD etc.), but no file (docx, pptx, mp3, mp4) can be opened . Any advice for me how to make the files readable again? Coco vom Kolke Link to comment Share on other sites More sharing options...
Moderators Augeas Posted October 16, 2013 Moderators Share Posted October 16, 2013 What does Recuva show in the header of the file? Do you have TRIM enabled? Link to comment Share on other sites More sharing options...
vomkolke Posted October 16, 2013 Author Share Posted October 16, 2013 I have attached the answers to your questions: What does Recuva show in the header of the file? Do you have TRIM enabled? Greetings and thank you for the fast reply vom Kolke Link to comment Share on other sites More sharing options...
Moderators Augeas Posted October 16, 2013 Moderators Share Posted October 16, 2013 Thanks for that Kolke, it is quite rare to get the exact response to our questions. The fsutil command says that TRIM is enabled in the operating system, and TRIM commands are being sent to the device. I shall assume that the SSD is fairly new and accepts TRIM commands. There is another aspect however: if the SSD is external then the drive enclosure controller may not be capable of passing the TRIM command to the SSD. Now to your files. The png file in your image contains zeroes. There is no file signature or anything else. The file clusters can be recovered, but will contain zeroes and will be useless. Possibly this applies to the other files too. Although I am no expert on SSD internals, this is what I think is happening. (Assuming the TRIM command is sent to and executed by the SSD controller) The TRIM command assigns the data pages (clusters) of the deleted file to the invalid page queue. These pages will, at some time in the future, be collected and erased by the SSD garbage collector routines. The pages are unmapped from the logical to physical block address table in the SSD. When a request to read an unmapped page is sent to the SSD by the OS, a default page of zeroes is returned. Although the logical block addresses are still in the MFT, they all point to unmapped blocks in the SSD, and will be presented to the user as zeroes. So unfortunately your deleted files have been lost, for all purposes forever. This is unfortunately the nature of SSD's. Link to comment Share on other sites More sharing options...
vomkolke Posted October 16, 2013 Author Share Posted October 16, 2013 OK! "Sad" result, but thanks anyway for your profound explanation of the unfortunately undeniable facts. (seeing the "zeroes" in the header, I've already myself feared the worst!) Modern tech (SSD) has sometimes its detriments..... Thanks for the quick response! vom Kolke Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now