Files deleted from the Recycle Bin don't show in Recuva

[foto]

I'm using Recuva v1.53.1087 as admin in Windows 7 Enterprise 64-bit. I have some packet captures that I have been deleting (moving to recycle bin) and then emptying the recycle bin. Those files do not show in the file list. I have reproduced this multiple times and I have enabled deep scan and rescanned but there is no difference. The files I have deleted from the recycle bin (via emptying) do not show in Recuva. The find file entry field does not have any data that would mistakenly filter out the files. Recuva did find a lot of files just not those files. I also considered maybe the filenames were lost or mangled so I sorted by date modified. I did not see any of the current date (the files were created and deleted today). Also I checked the 'Unknown' dates at the bottom. Those files were all no-name .cab files and .png files. Anyway I do not see the files and I've been pretty thorough.

[Augeas]

Files sent to the recycler are renamed to $Irandom.ext and $Rrandom.ext. The $R files are the data, the $I files hold the file name etc.

As you have created and deleted the files on the same day it is very likely that the MFT records have been overwritten by later activity, as they are reused on a first available record basis.

Deep scan looks for a specific set of file headers. You describe the files as packet captures: I don't know what they are but unless they fit into the list scanned by Recuva (look at the drop-dpwn list in the File/Path box) themn a deep scan will not find them.

[foto]

Only several deleted files have a path of C:\$Recycle.Bin and they're all many years old. Other than them there's no $I or $R prefixed files. Recuva simply isn't showing any later activity. There are no recently recycled files. If you delete a file to your recycle bin, and then empty the recycle bin, are you able to find the file using Recuva?

Edited December 23, 2019 by foto

[Augeas]

Recuva will list all the deleted file records in the Master File Table. If they're not listed then they're most likely not there. Deleted file records are reused generally in the lowest-numbered record found order, which is why files created and deleted on the same day are likely to be the first to have their MFT records overwritten.

Nobody knows what user and system activity is going on on your pc.

If the file names aren't in the MFT then they won't be found elsewhere.

Unless your packet capture files are in some common format (doc etc) then a deep scan won't find them, and is pointless.

I don't use the recycler, so I can't answer your question.