Augeas
-
Posts
4,542 -
Joined
Posts posted by Augeas
-
-
I think we should call an end to this semantic wrangling (I trust you can understand what I mean).
-
Is this a system drive? You can see the drive letter in Explorer, can you see any files with Explorer? Have you run chkdsk aganist this drive?
What options are you running with Recuva? You should be running normal scan with Scan for Non-Deleted Files checked.
-
In Dcxxx.ext the xxx bit is some randomish number and the ext is the extension type, which I assume is psd.
With a deep scan I would expect you to find something, even if it is not up to date. It would most likely not be associated with any folder, as a deep scan looks at clusters on the disk and directory info is held in (or in your case lost from) the MFT.
If you've found any psd's then recover them all to a flash drive and see if you can open them, and if so what's inside.
-
Firstly, do as little on your pc (or on that particular drive) as possible.
How did you delete the file? If it went to the recycler first then it may have been renamed by Windows. In XP it's Dcxxxx.ext, and in Vista/7 it's $Rxxxxx.ext.
If you can't find these files then try a deep scan. I guess the file has been edited many times (?) so there's a good chance that there will be a recent edit copy hanging around. Deep scan will take some time, keep your eye on it and cancel it when stage 2 is running to save some time. The full file list will still be displayed. In Advanced mode you can enter the filename, or part of it, or .psd, in the Filename/Path box. If you get any results recover the most recent to a flash drive or somewhere other than this drive.
-
To be honest Rhh, I'm bemused trying to figure out what you have done.
What is 'Routine deleting with recuva'?
Did you run a normal scan?
Did you have Scan for non-deleted files checked, or any other non-default option?
Was your 'routine deleting with recuva' by folder or drive letter in tree view, or by individual files?
How many files did Recuva show before you lost your drive?
If you attempted to recover 12,000 files back to the original drive then this will kill the recovery, and your chance of recovering the majority of the files.
As Dennis says, I know of no way that Recuva will delete live files. If you highlight or check a live file then you will not get the option to overwrite it (I don't know about doing this at a folder level, but I would think that Recuva would not delete live files here either). In any event live files are only shown if the relevant option is chosen.
In a brief test, I could not get the behaviour that Dennis did, I could not encourage Recuva to delete anything except what it should, even though the root box was ticked.
-
Not necessarily. One option is for file deletion, the other is for WFS. The two are separate entities and both can be quite validly specified: a user could, for instance run CC daily without the WFS box in the Cleaner panel checked in order to do secure file deletion, and then on occasion check the box to wipe the selected drives.
-
Yes, just to clarify I believe that the Secure Deletion parameters in the Options/Settings are for File deletion and have no effect on the Wipe Free Space option. With WFS in Options/Settings you get one pass of zeroes.
In Drive Wiper you have the choice of selecting multiple overwrites for wiping free space, should you so wish.
-
Go to the boys' r&b and demand that they accept girls. Then you will have annoyed the whole school.
-
There are factors that cause certain areas not to be wiped. Have a look at the documentation. This might explain why the first test wipe wiped all, then subsequent wipes wiped less. How are you measuring in mb how much is wiped?
-
I assume you are running a normal scan, and at 5 gb+, how many pics are there, 5,000, fewer?
There could be many reasons why you are not seeing what you expected, although I would not think that they would apply to all of your files. Do you, or have you, run a defrag? If not then there's always Windows' internal defrag every few days - look at the list in c:/windows.prefetch/layout.ini to see just how many (useless) files are shuffled around the disk.
What the preview shows is what the data now is at the location of your file. If the data has been overwritten then you'll see what's overwriting it. You could be seeing a valid live pic - but not for all of your files?
How did you delete the files, did you use the recycler? If you did, and then emptied it, then the pics many have been renamed to Dcxxx.jpg, so you could sort Recuva's results by name and then look for that.
I would restore what you can to another device, then run a deep scan to see if anything else turns up. It will take some time, but you can't do much else with Recuva, unfortunately.
And what does 'Files being overwritten before delete' mean?
-
In that case keep a ruler next to the pc. When you find your mouse straying to the Deep Scan option, smartly whack the ruler over your fingers holding the mouse.
-
I agree entirely with Alan. Just reformat the partition as NTFS and Recuva in normal mode will see no files at all, as it will be reading the newly-created MFT. Seeeemple.
-
It doesn't sound too good. Perhaps the boot sector or one of the system files is corrupted. I don't know if any more knowledgeable person will pass by with some advice.
-
For the file that has 'Access Denied' look at the Info panel (in Recuva Advanced view). Does it have a size but no cluster numbers listed? If so then I don't think it can be recovered.
-
I always assume people are running in Advanced Mode. Are you running in Advanced Mode or using the Wizard? If wizarding, press the top r/h Switch to Advanced Mode box, and then clear anything that's in the Filename or Path box.
-
Go to Options/Actions and tick the top three boxes (you don't even have to scan again). The bad news is that if this shows your ignored files it's because they're zero bytes in length, and so unrecoverable.
You could try a normal scan with Scan for Non-Deleted File checked. Failing that, try a deep scan.
-
Delete deletes the entries from the startup list. It doesn't delete any files/programs/etc. Pretty harmless unless you want the entries back in the startup ilst in the future.
-
1) Not that long. If you're in Stage 2, cancel it and continue recovery from there. If you're in Stage 1, cancel it. I would run a chkdsk against the drive, then run Recuva in normal scan with Scan for Non-Deleted Files checked in Options.
2) Couldn't really say.
-
I believe it is retained for users who wish to include WFS in their normal cleaning process (Drive Wiper being a one-off process).
-
Roland, if you Google "the volume for the file has been externally altered" you will get many responses. I suugest that you plough through those. It does not appear to be a Recuva problem.
-
Enough bickering.
-
A normal delete will simply flag the file as deleted, as it does for a file that has data outside of the MFT. The file can be securely deleted using CC, or try the wipe MFT option in CC.
-
If a file is small enough, say 6-700 bytes, then it can fit entirely into its 1024-byte MFT record. Recuva will not overwrite data in the MFT so it cannot securely delete these files. You could try wiping the MFT with CC, or not bother about it.
-
I have some sympathy with Exasse as regards Index.dat files. For a start the documentation on Index.dat files does not reflect any new or different action. There's nothing to say that Index.data files are cleaned elsewhere. And there's no specific list of what Index.dat files are cleaned, so it's all guesswork really.
Why is the old Index.dat checkbox still present?
I ran a few tests and found that:
The Index.dat box does nothing on clean
The History box cleans the Index.dat file in history, no more
The Cookies box cleans a few Index.dat files
The Temp Int Files cleans Index.dat in the Temp Int Files folder.
So it seems that you get Index.dat's cleaned in History and Temp Int Files. I'm not going to install an old version of CC to see what that did, but I have a feeling that it cleaned more than that.
Maybe if the Index.dat box is removed then the cleaning would be more as it is described: History for History, Cookies for Cookies, and TIF for TIF.
A new user coming to CC would be fine: the old users who remember the Index.dat box are confused.
ccleaner
in CCleaner
Posted
You can only WFS on the system drive. I've no idea what would happen if you try to wipe a rewritable CD.