Augeas

If you overwrote the pics with Recuva as in option 2 above, and can still see the pics, then they must be either small pics held in the MFT (which Recuva can't touch) ot they are live pics that are using the clusters that the deleted files had allocated to them. Bear in mind that we don't know exactly what you are doing nor do we know exactly what Recuca does.

No. Read this.... https://www.ccleaner.com/ccleaner/faq/general/is-it-ok-to-use-ccleaner-in-my-business-or-to-provide-services-to-other-companies

I shouldn't think so. How would it access a sector that couldn't be accessed?

I have never known Recuva to take more than a few minutes at the most with a normal scan. I have just run a normal scan on a file/folder and it took under 14 seconds (on a modest but ancient system).

I've no idea. Do you mean start with "$$_"filename, or $$_filename? Does the folder name give you a clue?

A defrag is bad news. As you know only too well it will utilise any free space it requires to create unfragmented files, and that free space includes the files that were deleted. So a percentage of the deleted files could well be overwritten. A normal scan may find evidence of the deleted files, as their records will still be in the MFT, but the clusters they previously used will quite possibly be overwritten.

The entire disk is being read, not just the old lost data. Two tb is a large drive, about 500 million 4k clusters, each of which has to be read and analysed, and an internal results table built. Unfortunately 18 hours is not an unrealistic time, going from what others have posted.

You could run Defraggler to defrag free space. If you're not a Defraggler user then see how to in the documentation. Then rerun the wipe free space Are you running Drive Wiper?). If you do this then please let me know the results, as it will test a theory of mine. Alternatively run Recuva deep scan then select all/overwrite selected (one pass). This will still leave very small files (under 700 bytes) untouched, as they are held in the MFT. This is a bit of a sledgehammer solution.

No, the filter applies only to the results of the scan, the scan will still take the same time as all sectors have to be scanned. You don't say what the capacity of your drive is, if it is huge then a deep scan will take some time. Eight hours is not particularly long. It might be just me, but perhaps a backup of data before doing a system install would be circumspect.

1) Is this disk included in Windows' regular defrags? I don't know if usb connected devices are included but it's worth checking. Plus things I can't think of or don't know about. 2) I think that it's safe to say that a device withour power or means of access will be safe from modification, except by Martian death rays. If it is connected then it could be modified. I'm not saying that it will be, but nobody can say for sure that it won't. 3) More or less the same answer as 2. Not as far as I know. Maybe there is some error checking done or logs written somewhere. 4) A normal scan is very fast and reads the MFT, not the disk. A deep scan takes far longer and reads each unallocated cluster. It is advantageous if you can recover your files from a normal scan, they will be complete and up to date, one hopes. A deep scan does not retrieve file names or secondary extents, only selects a small range of file types, and does not differentiate between files days or years old. And takes ages to run. 5) A recovery - as long as you are recovering to a different device - should not harm the files nor degrade any future recovery attempts. It is a read process.

Don't use any selection criteria, just search for everything and sort the results later.

No, I run Windows Defender.

I've run CC portable for years and it has never updated automatically. There is an option in Option?settings to be informed of updates, which is unchecked. There is also the option to accept silent background updates, which is greyed out and unselectable. It also has the CC Pro logo next to it, implying that silent updates are not available in CC free?

There are difficulties in recovering very large files, very fragmented files, very old - and very new - files, and files on FAT32 devices. These are to do with the way the file system handles file deletion, not to do with Recuva (or any recovery software). Recuva will recover (i.e. copy) whatever is in the clusters pointed to by the addresses held in the file tables. In Recuva advanced mode have a look at the file header. Does it look valid (you can find out what a valid mp4/wmv file header looks like with Google)?

Plese post screenshots of Recuva, not your private documents, no matter how corrupted they are.

First of all, we are talking about an HDD (not SSD), and it’s NTFS (not FAT32)? There’s been no change to Recuva’s recovery techniques well, forever, as far as I can tell. Also I don’t know of any Windows setting that would cause this. So I think it’s some other factor. If the files had been sent to the recycler then NTFS renames them to two components called $Innnn.ext and $Rnnnn.ext. Ignore the $I as they are indexes. Your videos may be recoverable under the $R names. Don’t put any search criteria when running Recuva. It won’t catch the above $R files for a start. Just search for everything, it won’t take any longer. I assume you’re running a normal scan. I wouldn’t run a deep scan yet. Have you run a wipe free space with wipe MFT? This will of course erase pretty much everything. Recuva will scan the MFT and show all file names for all records that are flagged as deleted, including the $I and $R files. These deleted records in the MFT will remain available until another file creation overwrites them. The greater the activity on the drive the more likely the names will be overwritten. Files created and deleted, as in your test, are most likely to have their MFT records reused quite quickly, as they used the first available record when they were created, and on deletion they become the first available record again. I’ll post again if I think of anything else. At the moment I would concentrate on the first two points, the $R names and the search criteria.

Yes, he - or she - was warned in his last thread. He doesn't actually seem to spam anything but the questions are very childish.Perhaps he's never heard of Google.

I don't agree with you Willy as - apart from the wear on the SSD - wiping free space cannot possibly achieve what it is trying to do as you cannot physically overwrite an SSD page. To the O/P, TRIM is an inbuilt function that tells the SSD that deleted pages are no longer required. If your SSD and PC/laptop are no more than say, five years old then TRIM should be available and enabled automatically. With TRIM there should be no deleted files in free space as the pages are emptied by the SSD controller. However TRIM is not infallible and occasionally some pages (deleted files) are left in an SSD's free space. To get rid of these you can run an Optimise from either Window's defragger or Piriform's Defraggler. This in effect runs a TRIM on the whole SSD and removes any deleted files there may be in free space. Mnay of your questions can be answered (far better) by Google or Wikipedia.

Whenever you check the Wipe Free Space box in Cleaner/Advanced, and next run Cleaner, or if you r/click on Wipe Free Space in Cleaner/Advanced and select Clean Wipe Free Space.

You could download Recuva (portable) if you haven't alrready, in Advanced Mode Options/Actions check Scan for Non-Deleted Files (don't check Deep Scan) and run it. Then l/click on the State column header to sort the results, which will bring the Non deleted files to the top, and look if there are any unrecognised large files there. Or l/click on Size to order by size. If you find anything you can then delete them in Explorer, not Recuva.There are other ways of finding files on a disk, I'm sure.

You should have one or more files with long apparently random names in the root directory with a create date of the wipe. And of approx 400 gb in total. Delete them. Overwriting 35 times is, well, what can I say, rather excessive. That's writing about 18 terabytes of data to your drive when a single pass of 500 gb would have done just as well. The 35 pass overwrite is pointless, decades out of date and a waste of your time which you could spend mining for bitcoins, or some other ridiculous exercise the human race is prone to follow.

If you have selected pictures as a scan filter then don't, clear any file type filters you have. I don't think that Recuva recognises .orf as a picture format. Is your laptop drive HDD, SSD, NTFS, FAT32?

Well, you can right click and select Save to Text File.

Why not attach a file in a format we can open?

We can't open that file. Please post as a screen snapshot, with other information.