Jump to content
CCleaner Community Forums
Sign in to follow this  
mmo542

Are overwritten clusters included in recovered file?

Recommended Posts

Hi,

Files that have been partially overwritten by other files are marked yellow in recuva. If I am recovering such files in normal recovery mode (that mode that uses mft an that keeps the filenames), are the clusters belonging to the other (newer) file included in the recovered file?

I know in deep scan carvin process this can be the case as the software probably cant distinguish between data belonging to the file and other files fragments within the amount of clusters to be rescued.

 

But using the normal recovery mode, is there any possibility that other files contents are within the rescued file? Or will recuva ignore these clusters which have been marked as overwritten and restore the requestet file just without them? (that would make more sens for me, eg also fore security/privacy reasons.

Share this post


Link to post
Share on other sites

Recuva will copy whatever is in the clusters whose addresses are in the file's MFT record. So if the deleted file previously occupied say 50 clusters, and 5 clusters in the middle have been overwritten, Recuva will copy all 50 clusters, including the overwritten data, whatever that is. It's not really insecure as the user is already on the machine so he or she just has to look at the live files.

A deep scan doesn't have overwritten clusters, as there's no way of knowing what was in a 'free' cluster previously.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×