Augeas
-
Posts
4,542 -
Joined
Posts posted by Augeas
-
-
Unfortunately you'll have to re-run the recovery with the correct option selected.
-
File's data not on disk means that the cluster addresses are not valid, they are probably set to 0xffff. There's no point trying to follow these addresses.
You may find your files with a deep scan, if, at the end of the scan, you filter for file type and date, size etc. But this is a long job, and if you find a file only the first extent will be recoverable without professional help.
-
Recovery is not actually recovery, Recuva (and other recovery software) will copy the contents of the deleted clusters exactly as they are to a folder on another device. If a header is seen as corrupted it means that the cluster contents don't match the heade specification for that thype of file. In this case it is unlikely that the rest of the clusters will be viable either. In the O/P's case a header of null (zeroes) almost certinly means that the file has gone forever.
In other words I don't think it's just the header that's been lost.
-
Run Windows Optimise?
-
Were all those files listed created (4 Aug) after the format? Did you delete them straight away? Where are the files overwritten by files created before the format? Are they the seven at the top of the list?
I've never known a deleted file to be overwritten by anything other than a live file. I am guessing that:
During the format the new root directory was written on top of the old root and has pre-allocated space to keep it in one extent. The previous file names in the root directory are thus available to be read by Recuva.
ExFat is significantly different from FAT32 as it no longer uses the FAT to identify used space, this is done by a cluster bitmap. FAT entries are no longer zeroed on file deletion or (I assume) a format.
If a file uses contiguous clusters then the FAT is not referenced at all.
I think that Recuva might be getting confused over non-zero FAT entries and deleted clusters shown by the bitmap. None of us actually knows Recuva internals and I bet a pound to a penny nobody knows how ExFat works either, as it is proprietary software. I should write it off as a curiosity.
-
Probably because both devices are classed as SSD's. Actually I'm surprised that you were offered one pass, unless that one-pass segues into an Optimise when it's run.
It is not physically possible to overwrite an SSD page. If you have TRIM enabled on your pc and storage devices then you do not need to do any wiping on an SSD. The deleted pages will be 'wiped' by the SSD controller, and an occasional Optimise is all that's required. A multi-pass wipe on an SSD is madness, which is most likely why it isn't offered.
Oh yes, the same goes for secure file deletion. It is invalid on an SSD.
-
If you cancel now (assuming that it hasn't finished) then all the files found so far will be displayed. There's almost 3.25 million for you to play with, although not all will be shown unless you have the show live files option checked.
It won't make any difference to recovery if Recuva is cancelled or not. Files won't be recovered any 'better' if the run has completed. If recovered files won't open or play then the chances that they ever will are slim.
-
This 'file is overwritten by an earlier file' is common for a deleted file in FAT32. However you're almost certainly using exfat so that might not apply. I am not familiar with exfat structure, nor the deletion or your camera's formatting process. It seems strange that after a format these user files can be seen, as a format should (and will) empty the root directory except for any system files.
As for replaying them, if they're overwritten then not a chance. You'll be recovering, and trying to play, part of an entirely different file.
Is that large file 32gb?
-
2 hours ago, Rtic-Jan H te A said:
Apparently Piriform is so embarrassed by this, that this discussion doesn't show up in the list of this forum section.
Doesn't it? I can see it quite well, and there's no indication that it is hidden.
-
If you're using the Wizard, switch to advanced mode (top r/h button). In advanced mode select Options/Actions. Check boxes 1, 2, 3 and 5. Leave box 4 (Deep Scan) and box 6 (Restore folder structure) unchecked. Press OK. You should not need to do another scan. With nothing in the Filename or Path box you should now have zero files ignored.
Thiws advice is for a non-formatted device, reading back I have to repeat the caveat in my last post.
-
Does Recuva show any cluster numbers? I am surprised that a live file is listed by Explorer as 2.9 mb and yet appears to have no cluster addresses associated with it. That is a seriously screwed up folder entry. If there are no clusters shown by Recuva than none can be recovered.
-
A normal scan on a 2b device should take no more than a few minutes. if that. I can only guess that there is some problem with the device that is either sending Recuva in an endless loop, or Recuva has stopped completely. I would cancel the scan and see what results you get.
-
Now we learn that the drive was formatted and it's some Android device, I am not familiar with Android O/S at all.
-
Yeah, yeah, we get it, we don't need six posts to tell us.
-
Obscenities are still obsenities, even in Russian. Обманки все еще остаются, даже на русском.
-
You're correct Nergal, the ignored count includes live files and those that don't fit the search criteria (and possibly zero length files and system files etc). So I would clear the search filter and go from there. The live files will still be ignored, but presumably you're not looking for them with Recuva.
-
Yes. Open Explorer, navigate to where the file is, right click copy, paste it where you want to (although this exercise does seem rather pointless).
-
True, but many of the objectors are objecting about data collection. Rolling back will just out a cloak over that, if anyone actually has a cloak these days apart from Dracula.
-
So if Piriform were doing it before and we weren't aware of it, then ipso facto rolling back to an earlier version is pointless.
-
2 hours ago, nukecad said:
Remember that this data collection is nothing new.........
I couldn't agree with you more, Nukecad, but you might as well be typing in invisible ink.
-
If you have reached stage 2 or more then you can cancel Recuva without losing the list of files found.
-
You can overwrite the contents of the file by right clicking on it and selecting secure delete. You can't get rid of the file name in Recuva's found files list, as this would be modifying the MFT, which no sane person would attempt. A wipe free space would do it, and get rid of everything else as well, but you may consider this to be overkill.
-
Who suggested buying the pro version? There is no difference between the recovery capabilities of either, as you have found out.
No Preview Available usually means that the content of the file is not in any recognisable picture format, in other words it has been overwritten by another file at some time. An overwritten file is not openable by any software.
-
It is not really feasable that images would appear on your pc on their own volition. Otherwise nobody would be prosecuted for having anything the state considers to be moderately annoying on their pc. I probably have dozens of pics of footballers, fashion, irritating TV celebrities and what used to be called pop music, none of which is of the slightest interest to me.
I should add to post no 2 that software installs also download images, in some cases a great many, but these are more of a nuisance than a worry.
Put files that have already been recovered in correct directory?
in Recuva
Posted
Yes they will (minus any that have been overwritten by subsequent activity on your pc). Recuva copies deleted files to another device, they are untouched on the source device.