Jump to content
CCleaner Community Forums

Augeas

Moderators
  • Content Count

    4,432
  • Joined

Community Reputation

1 Neutral

About Augeas

  • Rank
    Moderator

Profile Information

  • Gender
    Not Telling
  • Location
    Where Stuff is made, UK

Recent Profile Visitors

4,893 profile views
  1. As (I assume) all file deletions under the control of Windows, no matter how executed, use NFTS (or FAT) to process the deletions then yes, Recuva will operate in the same way for rd, shift/del, recycler etc deleted files. Whether you will find or be able to restore those files is another matter, but the deletion method is irrelevant.
  2. I'm sure Recuva could be improved - as could the other recovery software mentioned - but the reasons for your disquiet probably lie with the file system rather than Recuva. No file system has any obligation or compunction to assist in recovering deleted files, especially after a format, which is essentially a clear out and start again process, and is often prefaced with a 'This operation will destroy your data' warning. The reason why you are able to see any user file names is, if anything, that the format isn't particularly thorough. There's no indication of what file system was use
  3. Allocate 15 (or more) files on your D drive with random file names. This will overwrite those file entries held in the MFT. You can then delete the files you created. Of course you will still have the random file names shown, and they may possibly have red icons, but the old file names would have gone. A larger number of files can be wiped by running CCleaners Drive Wiper Wipe Free Space, which does the same thing but replaces the file names with ugly ZZZ.ZZ concoctions. These methods will overwrite all the deleted file names, not just those with red icons. Use of the D drive will te
  4. The point of Recuva is to recover previously deleted files, and the point of NTFS, which I assume we're dealing with here, is to ensure the integrity of live metadata and live user files. The two don't always go together. Recuva reads the MFT and lists all records for files that have the deleted flag set. It doesn't select or exclude any files apart from those options chosen by the user. What you see is what there is in the MFT. If any deleted record has been reused by NTFS then the deleted file's information has gone and can't be shown. With an SSD the process is the same but the ou
  5. Because - probably - a deep scan runs a normal scan first, and a normal scan reads the MFT where the file names are held. The file names are listed, but the clusters which held the file's data should contain zeroes, or more correctly a read request will return zeroes (who knows what he clusters contain, they are unaccessible). It is quite usual for files recently deleted being not found. A file deletion leaves the MFT record marked as available for reuse by any activity, and even opening Recuva writes a few files. I have a sneaky suspicion that NTFS reuses available MFT records held in me
  6. I wonder how CC knows - if it does - that these ZZZ files are CC's files and not user files? I could create a file called ZZZ.ZZ and put whatever in there. Is there a file signature?
  7. You must have a different Recuva from me then. However willing the moderators are here they don't write any of Piriform's code, nor do they deny much either.
  8. I don't know what you mean by step 5, Recuva (free) only has three stages . Recuva does not change any attributes on any file on the source drive, so I've no idea what is happening with your drive.
  9. Nobody can say whether you can, or will, recover any deleted files. All you can do is try. A deep scan runs a normal scan first, so when you chopped the deep scan you would have seen the results from the normal scan. This scans the MFT which is very fast. Running a deep scan on the recycler is not feasible, as the directory information is held in the MFT not at file level, and a deep scan looks for clusters containing files, not directories. Files sent to the recycler are renamed, to $Ixxx.ext and $Rxxx.ext. The data part is held in the $R file. You could run a normal scan with $R in
  10. FAT32 is a beefed-up version of FAT16. However it needs four bytes to hold the first cluster number (in the FAT tables) instead of two, so it uses two additional bytes from elsewhere (the actual address of the start of the file is held in two separate halves). When a file is deleted the additional two bytes of the address, the high end, are wiped by the file system for some reason, and as a result the address of the file is corrupted. This is why you get the overwritten file message, Recuva is looking in the wrong place. It isn't possible to find the right place, except by guessing. A dee
  11. Because your drive is an SSD, and WFS is pointless on an SSD. And WFS three passes on an SSD is three times more so.
  12. That's nothing to worry about, it's only 500,000 live and deleted files. On my 120 gb C drive SSD my MFT is 472 mb, and I am only using 36 gb. Win 10 install allocates and deletes a lot, a very large lot, of files. Remember that large files, and large directories, will use multiple MFT records so the total file count is probably under 500k. WFS will not touch the MFT, unless it's an entire disk erase. Windows does not reduce the size of the MFT, nothing does, apart from a reformat. When a disk is nearly full then NTFS will allocate files within the MFT Zone, which is not the same as reduc
  13. You could read through http://kcall.co.uk/ntfs/index.html although it is heavy going. The part headed MFT Records, or MFT Extension Records, describes the index clusters (called Folder Entry in Defraggler) for a file, the principle is the same for a folder. Microsoft sometimes calls directories indexes, and we call them folders. It is confusing. The MFT is a file, which holds one or more 1k records for every file on the drive, including itself. A folder, or directory, consists of one or more records in the MFT. Large files, or large folders, may have separate index clusters allocate
×
×
  • Create New...