Augeas

A folder only exists as a record in the Master File Table. If a folder is deleted then that record is flagged as deleted and available for reuse by NTFS. If it is reused by a subsequent new file allocation then all the information held in that folder is physically overwritten. A deleted file uses a chainback value to find it's owning folder record. If that folder record has been overwritten then the folder name, and its own chainback value is lost. Recuva cannot determine what the folder was, or whether there were one or a dozen levels in the path. Recuva will mark the folder as ? The folder structure in this case cannot be recreated. The folders beginning with $ are system folders - don't touch. It seems as if you have Scan for Non-Deleted Files checked.

Restoring the folder structure depends on the folder path still being available. Deleted folders can be overwritten just as easily as deleted files. If a record for a folder is deleted then the folder structure can't be recreated and a ? is substituted. If this is the case then there's no way of recreating the folder structure.

If you ran the Wizard then there is a button on the top right-hand of the results page marked Switch to Advanced mode. If you're in Advanced Mode already there's a button on the top right=hand marked Options.

Nope.

Advanced Mode, Options/Actions, Restore Folder Structure (recovering to a new device, of course).

They are images embedded in webpages that a user of your pc has downloaded. Some sites, online newspapers for instance, are notorious for the amount of click-bait on the side. If you scan for images some pics won't be shown as they don't have a valid image extension.

Yes you can action the files already found by Recuva. There's no restart however. For some reason unkown to us (me, anyway) there are certain conditions which cause Recuva to become 'stuck' when scanning. There's also no known fix to it.

When you recover a file the clusters of that file are copied to whatever location you specify. The deleted clusters can still be accessed by Recuva or other software. To get rid of the deleted clusters (in Recuva) you can highlight the deleted file, right click and select secure overwrite. If that is what you are asking.

Switch to Advanced Mode, in Options/Actions check the Restore Folder Structure box.

What does 'mistakenly overwritten' mean? Did you delete the file? What are you recovering?

There is no difference in the recovery capabilities between the free and paid versions of Recuva.

If files larger than 4gb have been deleted - as opposed to a disk failure - then NTFS will overwrite all the file's cluster addresses. In that event the files aren't recoverable without professional help, and possibly not even then. It is theoretically possible for a deep scan file (with a [01234].ext name) to be in one contiguous 4gb+ extent, in which case that could be recovered, so it's worth a look.

Nope, there isn't, not easily that is. The only thing that I can think of is to highlight the first excellent file, hold down shift, scroll down until the first poor, and then highlight the last excellent. Yes I know, there's a lot of files to scroll through.

You can stop the scan at any point and Recuva will display whatever it's found up to that time. But as you say you don't want to recover deleted files that wouldn't be much use. You can select Scan for Non-Deleted File in Advanced Mode Options/Actions but you will still have to do the full scan of deleted files as well, there's not the facility to stop that. Have you selected deep scan? If so I would uncheck that and see what is produced with a normal scan.

Are you saying that Recuva found a .odf file (or many .odf fikles) on its scan, and when they were recovered it changed the extension to docx? I am highly unconvinced.

What do you mean 'History'? Recuva doesn't recover Chrome, or Firefox, or anything specific, it recovers files. If an entry in the MFT is marked as deleted then Recuva will show it, and if it is still accessible then Recuva will recover it. If Recuva doesn't find what you're looking for then it isn't in the MFT. I don't know if you are putting anything in the file/path box, but if you are this often causes confusion.

Try runnung a scan with Scan for Non-Del;eted Files checked (in Advanced Mode, Options/Actions).

Ho hum.. 'The drive must be able to hold at least x GB, and everything on the drive will be deleted.' 'Everything on the drive will be deleted. If you have any personal files on this drive, make sure you've backed up the drive.'

You can run a Recuva normal or deep scan, and that's it. There are no ways to force Recuva to squeeze more files from the device. As that device is an SSD that's been overwritten, I think your chances of recovery are very slim.

As none of us knows what Recuva or Easeus actually does then we can only speculate. The default settings of Recuva exclude files in hidden system directories, zero-byte files, and securely overwritten files, so this might explain some of the discrepancy. A normal scan reads the MFT (assuming NTFS) and selects deleted records, which is a relatively simple process. The MFT is the same whatever software is used, so it's difficult to see how one software would produce results that are significantly different from another. Recuva doesn't include live files by default, maybe Easeus does. A deep scan looks for a specific set of file headers in the clusters. There could be a variation in the file types covered, Recuva's list seems to cover most of the popular file types, perhaps Easus has more. I'm not really sure where recovery software could 'look' to find more files.

No, and it wouldn't make the scan any faster. The deep scan has to examine the header of every cluster it finds to determine if it contains a valid file header, and if so add it to Recuva's dynamic list. So if you don't want jpegs then all the clusters would still have to be searched to check that they had a file header, and then discarded if the header was jpeg. You can run a deep scan once, with nothing in the file/path box, and then filter the results afterwards by whatever file extension you want, altering the filter as you go. Running a deep scan with a filter applied might enable the run to complete without memory problems, but that's something I can't test.

There's no overwritten data because the files are all undeleted. They are system files which were created during the format and don't contain any data. $BadClus is a sparse file, which means that it's allocation extends to the full size of the drive but in reality it most likely doesn't occupy any space at all. A full format overwrites all cluster with zeroes. I would say that there's not a chance in a zillion that any data can be recovered from this drive.

Recuva will find the same deleted files over and over again, until some activity on the scanned drive changes what is accessible.

Are you attempting to recover to the failed flash drive? If so, stop now.

No, I'm afraid not. You can save a copy of the found files list, but it's just a list, that's all. It can't be used to restart the recovery process. You have to recover from a current scan. I assume you're doing a Save to Clipboard and then saving that? That's very laborious. I don't know what you mean when you say that a recovery only produces a file called Dummy, I've never heard of that.