Jump to content
CCleaner Community Forums
jan

recovered text files but they are not readable

Recommended Posts

Hi,

I tried to recover some files (.VHD) from my ssd, I could find them, the state is claimed to be excellent, no cluster overwritting, the folder structure is regenerated, but when opening the files with an editor they are not readable. I wonder if this is because I use the free version, maybe this does show the files but does not recover them without buying a license?

The drive is encrypted (bit locker), could this be the reason for the problem? Please see the attached file

Do I need to buy a license?

count_down.vhd

Share this post


Link to post
Share on other sites

No, you don't need to buy a licence. The recovery process is the same in the free and paid versions. My theory for your problem is:

When Recuva scans for deleted files it gets the filename, cluster addresses, and overwritten state from the MFT, not the storage device. If the file has been inadvertently deleted then a TRIM command may have been issued which will unmap the data clusters. The cluster address willl still remain in the MFT. Recuva can retrieve these clusters, but they will contain zeroes. Is this what you see?

As far as I know, which isn't very far, an encrypted device needs to be opened before it can be read, so Recuva should not have a problem accessing the deleted files. Do you get a message saying that access is forbidden? Someone with knowledge of this needs to chip in.

The chances of file recovery on an SSD are not good, due to the use of TRIM to unmap data clusters, which means they are gone forever.

Share this post


Link to post
Share on other sites

Hi Augeas,

In the meantime I tried a second recovery tool and the result is identical, which means that most probably the data is gone, as all files recovered seem to be overwritten with a similar pattern. It is not '00' or 'FF', what I would expect, but a repeating string.

My guess with the encrypted disc is probably wrong as I can read from the disc, so I assume that the data (even the deleted one) is decrypted correctly.

The files were deleted by 'WinMerge'. Maybe this tool is not just marking deleted but actually overwrites the data, or then, you are right, it's because it is a SSD. After deleting I did not do anything on the disc, as it is a pure data disc. The chance of being overwritten is approx. zero. But of course, I don't know what a SSD does on its own.

I'm trying to recover some data on an external HD, deleted by windows explorer, lets see if this works...

Thanks!

Share this post


Link to post
Share on other sites

Try to Scan Contents... if you just need some part of text.
The text could be inside a large buffer file and still be a  readable string available, use win10 cmd find on the file.

 

 

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...