recovered text files but they are not readable

[jan]

Hi,

I tried to recover some files (.VHD) from my ssd, I could find them, the state is claimed to be excellent, no cluster overwritting, the folder structure is regenerated, but when opening the files with an editor they are not readable. I wonder if this is because I use the free version, maybe this does show the files but does not recover them without buying a license?

The drive is encrypted (bit locker), could this be the reason for the problem? Please see the attached file

Do I need to buy a license?

count_down.vhd

[Augeas]

No, you don't need to buy a licence. The recovery process is the same in the free and paid versions. My theory for your problem is:

When Recuva scans for deleted files it gets the filename, cluster addresses, and overwritten state from the MFT, not the storage device. If the file has been inadvertently deleted then a TRIM command may have been issued which will unmap the data clusters. The cluster address willl still remain in the MFT. Recuva can retrieve these clusters, but they will contain zeroes. Is this what you see?

As far as I know, which isn't very far, an encrypted device needs to be opened before it can be read, so Recuva should not have a problem accessing the deleted files. Do you get a message saying that access is forbidden? Someone with knowledge of this needs to chip in.

The chances of file recovery on an SSD are not good, due to the use of TRIM to unmap data clusters, which means they are gone forever.

[jan]

Hi Augeas,

In the meantime I tried a second recovery tool and the result is identical, which means that most probably the data is gone, as all files recovered seem to be overwritten with a similar pattern. It is not '00' or 'FF', what I would expect, but a repeating string.

My guess with the encrypted disc is probably wrong as I can read from the disc, so I assume that the data (even the deleted one) is decrypted correctly.

The files were deleted by 'WinMerge'. Maybe this tool is not just marking deleted but actually overwrites the data, or then, you are right, it's because it is a SSD. After deleting I did not do anything on the disc, as it is a pure data disc. The chance of being overwritten is approx. zero. But of course, I don't know what a SSD does on its own.

I'm trying to recover some data on an external HD, deleted by windows explorer, lets see if this works...

Thanks!

[tonyp12]

Try to Scan Contents... if you just need some part of text.
The text could be inside a large buffer file and still be a  readable string available, use win10 cmd find on the file.