Are overwritten clusters included in recovered file?

[mmo542]

Hi,

Files that have been partially overwritten by other files are marked yellow in recuva. If I am recovering such files in normal recovery mode (that mode that uses mft an that keeps the filenames), are the clusters belonging to the other (newer) file included in the recovered file?

I know in deep scan carvin process this can be the case as the software probably cant distinguish between data belonging to the file and other files fragments within the amount of clusters to be rescued.

 

But using the normal recovery mode, is there any possibility that other files contents are within the rescued file? Or will recuva ignore these clusters which have been marked as overwritten and restore the requestet file just without them? (that would make more sens for me, eg also fore security/privacy reasons.

[Augeas]

Recuva will copy whatever is in the clusters whose addresses are in the file's MFT record. So if the deleted file previously occupied say 50 clusters, and 5 clusters in the middle have been overwritten, Recuva will copy all 50 clusters, including the overwritten data, whatever that is. It's not really insecure as the user is already on the machine so he or she just has to look at the live files.

A deep scan doesn't have overwritten clusters, as there's no way of knowing what was in a 'free' cluster previously.