File size limitation

[Geev]

I am using Recuva free version and facing a problem.

Is there any known file size limitation when recovering large (>20GB) files?

Smaller files are recovered without any problem, but for large there is an error "There is not enough space on disk".

However there is huge free space on device recovering from and recovering to.

Any suggestions?

[Augeas]

There is no size limitation as far as I know. However when a file larger than 4gb is deleted in an NTFS system then there are changes to the file's record in the MFT. The file size and end cluster number are set to zeroes/FF's. If the file is in many extents then any extension records in the MFT will have the data cluster addresses set to zero/FF's. This causes the not-quite-accurate error message.

These 4k+ files are to all intents and purposes unrecoverable. They may still exist on the storage device but unless they are in one single extent then patching multiple extents together is impossible without professional help.

A deep scan will show whether there are files of 20gb+ found. If so then recover those and see what you have. Otherwise it's back to the previous paragraph.

[Geev]

Hi Augeas, Thank you for your technical explanations. Deep scan finds the big files, but the error pops up during recovery process. So according to your suggestions it is impossible to recover them at all due to different extents of the file location on disk. Correct?

 

[Augeas]

Deep scan runa a normal scan first, so tis might be the big files you are finding and having the same space problem with. Deep Scan files have a numerical file name, such as [01234].ext. They will only be one extent and should not give any problem with space (i.e. they will require just as much as there are clusters i the extent). Look for these file names with large sizes (sort the size column).

[Geev]

The problem with the space is about files with numerical name (after deep scan). The quality of the file is Excellent, but is gives the error during recovery.

Any other thoughts/insights?

[Augeas]

It's difficult to see how that occurs. A deep scan will look at deleted clusters until a known file signature is found, then recover the following clusters until another file signature, or a live file, or some end of file indicator, is found. In theory there's no way a sequence of clusters greater than the free space on the disk can be requested. So if that's the message you're getting then I'm out of ideas.