File unrecoverable because overwritten by itself

[Hartmut]

Please look at the screenshot: Recuva reports, that a file is 'unrecoverable', because it is overwritten by another file. But this is not true.

 

What I did:

 - I saved a file as e:\Inst\rcsetup150.exe

 - then I moved this file to e:\Inst\_SystemTools\Recuva\rcsetup150.exe

 - then I deleted this file to the recycle bin

 - then I deleted this file within the recycle bin

 - immediately after this I started Recuva

 

So Recuva reports a wrong state ('unrecoverable'), although the file should be recoverable.

The reason is, that Recuva does not check, that a file has been moved, before it was deleted. But this can happen often.

 

This seems to me a bad error, because a file is reported to be lost, although it is recoverable.

 

Only if the user:

 - remembers, that he had moved the deleted file (this could be long ago) and

 - realizes, that the mentioned file in column 'Comment' was the source of the move and

 - searches this file (e:\Inst\rcsetup150.exe) in the list

then he will see, that this file is reported to be recoverable. But this disadvantages should not be necessary.

[Augeas]

Rcsetup150.exe has not been moved at all. When the file was initially saved an entry was created in the directory for e:\Inst holding the file name and the address of the first data cluster in the FAT. When the file was 'moved' the directory entry for the file in e:\Inst was deleted and a new entry for the file created in e:\Inst\SystemTools\Recuva. The new file entry also holds the address of the first data cluster in the FAT: as the file data has not been moved this address is the same in both directory entries.

 

When the file was sent to the recycler the same thing happened, except that the recycler directory is a hidden system directory. Eventually that directory entry was deleted.

 

So there are three directory entries all pointing to the same first data cluster address in the FAT.

 

When Recuva says a file has been overwritten it is comparing cluster addresses in the directories (and presumably timestamps etc.) for conflicts. There is no other way to tell, the data doesn't know.

 

I would check whether e:\Inst\SystemTools\Recuva\rcsetup150.exe still exists. If not, look for it in the deleted file lists and recover from there.

 

Unrecoverable doesn't really mean unrecoverable. As long as the file size is greater than zero Recuva will recover what is in the clusters, whether it is rubbish or not.

[Hartmut]

I understood that there is no other way to handle such cases. And I learned, that although a file is reported as 'unrecoverable', that nevertheless it is possible to try to recover it (and then check the content for rubbish). Thanks for that information.