Jump to content
CCleaner Community Forums

Augeas

Moderators
  • Content Count

    4,373
  • Joined

Posts posted by Augeas

  1. Assuming that it's NTFS then files 4gb and larger have their cluster addresses and some other fields in the MFT set to zero on deletion by MTFS. The file is effectively unrecoverable. Files less than 4gb can also have cluster addresses set to zero if they are, or were, heavily fragmented.

  2. It's common in new installation to see very many deleted files from the install. Non-deleted files will have Non-Deleted (or whatever the description is) as their status. To stop showing non-deleted files uncheck the box in Advanced mode/Options/Actions. Free and Pro versions act the same.

  3. It appears that the deleted file is called sandvich.png somewhere in c:\users. The overwriting file is also called sandvich.png in c:\users. If you follow the path of the overwriting file you will find a live copy of sandvich.png. As the deleted file and the overwriting file are both the same image then when you recover the deleted file you will get the live file's contents. This has caused the confusion. I don't know if you want to get rid of sandvich, but if you do then delete the live copy. You will then be able to overwrite your deleted file.

    This may have been caused by sandvich being deleted and then recreated more or less immediately afterwards. The new allocation has used a different record in the Master File Table to write the file name etc, but the same clusters have been used to hold the new file. Thus the live file and the deleted file entries in the MFT point to the same clusters, and co-incidentally it is the same image as before.

  4. The entry for the deleted file in the Master File Table contains the addresses of the clusters it used. If these clusters have been reused then another live file is using them - they have been overwritten. The cluster addresses in both the deleted file and the live file point to the same clusters  If you recover an overwritten file you will be recovering (copying) what's in the live file. the data from the deleted file has gone forever. You cannot secure overwrite the deleted file's clusters because they are being used by the live file. Recuva is working fine, this is how NTFS works.

  5. Recuva is working fine. Overwritten by another file means that the deleted file's clusters have been reused by another live file. You can 'recover' the original file as a recovery is simply copying what's in the file's clusters. What you will get however is the data from the overwriting file, the original data has gone forever. You cannot overwrite an overwritten file as you would be overwriting the data from the new file, which is not what you want to do.

  6. I have to disagree Nukecad, shift/del is not, and has never been, a secure delete. The file's content is unchanged. It's true that small files can be, and probably are, held in their MFT record. In some cases, long file names etc, there is not enough room for even a small file and a separate cluster is used to hold the data.

    Why is the O/P seeing 00's? I guess he or she's using an SSD. In which case kiss goodbye to recovering any of that data.

  7. Unlimited? No, but the FBI has 36,000 employes and a $9.6 billion budget (and the NSA slightly more), which is a bit more than we can stretch to. You're quite free to try though.

  8. Outwit the FBI and NSA? Perhaps you need to speak to that nice Mr Putin. For those with rather less lofty aspirations, format the SSD then reinstall Windows, if you want to.

  9. If you have an SSD with TRIM enabled on both the device and the O/S - which I assume you have - then file recovery is with a few exceptions impossible. The TRIM'd data has gone forever and nothing that Recuva or anything else can do can retrieve it.

    Small files (under 700 bytes) will lbe stored in the MFT so they will be recoverable.

  10. There are no limits to the number of files recovered nor their size in Recuva free and professi9onal.

  11. The ignored file count  is non-deleted files, zero length files, etc. If you are using an SSD then a deep scan is likely to find nothing. If you have some search criteria in  the File/Path box then it is possible that no file fits that criteria.

×
×
  • Create New...