Fractalogic

Sorry! It appears that Recuva is unable to scan BitLocker encrypted drives: http://forum.piriform.com/index.php?showtopic=45792 I hope you had a backup of your files!

Hi! I recently ran a Recuva file scan on the Recycle bin, which made Recuva scan all my local drives. One of these was my USB flash drive which is BitLocker encrypted. However, I had that drive unlocked before the scan began. But still, Recuva encountered an error. Failed to scan the following drives: \\.\HarddiskVolume2: Unable to determine file system type It successfully scanned all the other drives, but none of the other drives were BitLocker encrypted. So! Is it true? Is Recuva unable to scan encrypted drives? Thanks!

Ah! That's interesting. It shows the address for some files, but not for others. Here is a PNG file info: Size: 167 KB (171 372) State: Not deleted Creation time: 2015-04-03 19:06 Last modification time: 2015-04-03 19:06 Last access time: 2015-04-30 21:09 Comment: No overwritten clusters detected. 42 cluster(s) allocated at offset 76944 Here is some JPG file info: Size: 544 bytes (544) State: Not deleted Creation time: 2015-07-16 11:58 Last modification time: 2015-07-16 11:58 Last access time: 2015-07-16 11:58 Comment: No overwritten clusters detected. Why is that? Why does it tell the address for some but not for others? In this case both files have the same status (not deleted) and no overwritten clusters.

Hi! I wonder... is it by any chance possible to figure out the offset address of the files that Recuva detects? I'm looking at a very important file in the list. Recuva reports the size as 405 KB and it has no overwritten clusters. But I have a reason to believe that this file is larger than that. It's not a huge file, but it is certainly larger than what Recuva is reporting. I would like to go ahead and use another program to pick up some more raw data at this location. The reason the size is reported incorrectly is probably because the file system entry for the file has been damaged. I suspect Recuva can't display this. Unless it has some kind of hidden feature or a command line mode (?). I have looked at the UI and could not find any such option. I would highly recommend that you implement this feature. This would be really useful in some situations to some people. Thanks!

Wait... what? A 2 GB external drive from Western Digital? How old is that drive? What kind of interface is it using? What kind of computer is it attached to? Are you sure you didn't mean to say a USB drive? Those are external too you know, but then again... I don't think WD makes those. I didn't get that time reference... you lost what and when? You lost 15 temporary files at 3:30? Then what happened at 6:30? It's a good thing that you backed up then. But what you're saying is that you have made changes since your last backup that you would like to recover if possible? Are you kidding? The scan operation has been running for 7 days? That's not normal. Far from it! You would need to be using something like the original PC and a real old disk drive for that to make any sense. But then again, Recuva won't run on anything that old. I would recommend doing a simple scan first, before doing the deep scan. Always! Sometimes, there is no sane reason to do a deep scan for something that a simple scan can pick up much more quickly. If it does not, then you switch to deep scan mode. If you cancel the operation, you will be presented with a list of files that the program has found. Obviously it won't present you the files it could have found had it not been interrupted. It will tell you which files it thinks are healthy, and which ones are not. You can then select which ones you want to recover. It may or may not be able to recover the files you want. You can use the search function to locate the files you want if there are many files to scroll through. I would recommended that you immediately stop saving any new files to the drive. If the scan has been going on for that long I would recommend that you cancel it. See if it found anything useful. If so, recover it to a separate drive, not to the patient drive. If not, then go on and do a simple scan. If it doesn't find anything useful, go ahead and do a deep scan. Let it scan till it finishes. Also note that the computer needs to be running all the time during the operation. You can't put it to sleep and then wake it up the next morning and continue. Even if it works I do not recommend that. If all this fails, give it up and tap yourself on the shoulder for creating a backup before the disaster happened. It would have been much worse had you not created that backup.

What is a fragment? Do you mean a cluster?

A cluster is the same thing as allocation unit in Windows, right? If so, then this one is 32K. Is an "unrecoverable" file actually recoverable? If it is, then shouldn't the recovered cluster data be the data of the new file? And not the data of the overwritten file? I don't see how this "unrecoverable" JPG file can have been overwritten by another file, according to Recuva, an MP4 file. Because there were no new file write operations done after the JPG file was deleted. The suspected MP4 that supposedly overwrote the data clusters of the JPG file coexisted with the JPG file and was deleted together with the JPG file. See why I don't think the data clusters of JPG were overwritten by MP4? Unrecoverable: 20151103_115540.jpg Overwritten by: 20160104_190343.mp4 You can tell the date of creation of each file by their names. However, they were both deleted today, 2 Feb 2016, at the same time. No new files have been written to the SD card. So how is this possible then? It's not! Please prove me wrong. But I believe this is a false positive. This file is in fact Excellent! I believe... I don't have the original to compare to, obviously. But I am pretty confident that this is it, it's in its original form, and Recuva recovered it. But it falsely states that it's "unrecoverable". It's close to impossible that any bit of the data cluster has been overwritten. Thank you for the explanation of the different states. But I don't think these can be trusted.

Microsoft marketing campaign about the new Windows 10: "Your files are right where you left them." Yeah... right! Haha!

I did some research after this incident. The "scanning and repairing" message actually means that Windows is running the CHKDSK utility program. The CHKDSK program is too primitive!... like many of the aging Windows components that keep appearing in every "new" version of Windows. This program can't handle encrypted data. In fact, it is often recommended that any FDE (full disk encrypted) disk be unlocked or decrypted before CHKDSK may be used on them, in order to avoid data loss. My disk was not encrypted, but this single file on it was in fact encrypted. As a result, it was the only one that got screwed up! Naturally! I now understand why it did that. All the pieces fall into place now. Have a full disk encryption?... or a single file encrypted on a disk? Don't run CHKDSK on it! From what I can tell, what additionally may have caused CHKDSK to not handle the encrypted KeePass file properly is because my file was not compressed. I believe the file header is slightly different for uncompressed files, and this can make the file more or less recognizable by programs like CHKDSK. So CHKDSK treated the associated KeePass file data pretty much like empty disk space. It didn't understand what it was looking at, so it assumed it was just a collection of bad sectors and started relocating them, and what not. One thing I don't understand though... is why would Microsoft, the software giant who knows this all too well... why would they have the CHKDSK command run with the destructive "repair" switch enabled? Why not just run a normal "scan", and then prompt the user for action? Because the user is too stupid to understand the prompt and too uneducated to make an informed decision? See! This is what I meant. Devices are not smart. They are dumb. You can automate things... supposedly "to make our lives easier"... but automated set of commands can't make informed decisions and handle exceptions like an literate, informed computer operator or user can! I miss the old days... when I could operate my own computer... now I have to let go and transfer control to billion dollar companies. They control our digital lives. Making backups is the golden rule of computing! I know that. But with increased complexities of the technology, storage capacity and bandwidth requirements, it's hard to keep up. I normally use Acronis for backups, but I was behind schedule and I was working on setting up a new external DAS disk before the incident. I removed my old backup archives from the internal backup partition as an intermediate step. But instead of making a new backup to the external DAS, I decided to go ahead with the upgrade to Windows 10 to get rid of the annoying nagware messages in notification area to upgrade. I was going to have one internal disk as primary backup, and the external as a secondary. I don't know though why Windows 10 thought there was something wrong with the internal J partition where I had my KeePass file... there is absolutely nothing wrong with it. Bad sectors? BS! It was most likely a false positive. The disk is a brand new Western Digital Caviar Red 4 TB. But I did have a multiboot configured previously with both Windows and Linux. The CHKDSK may have picked up on some trace of those previous installations. I have noticed that the newer Windows versions are overly sensitive about this type of thing.

Yeah... all true! Indeed, I was going through a phase... now I'm just about done. Sorry about the bad language! Recuva actually managed to grab an old version of the file from the affected partition. It was not the most recent version, but it was better than what I had. I said I had an old copy, but I didn't manage to locate it. I must have misplaced it somewhere, or deleted it. Anyway! The file that Recuva dug up was good enough for me. I used that to build a fresh new file. Technically, I imported the recovered file into the new file. Then I added some new entries and made some edits as well. I'm still not back at where I left off but I have come to accept it now. All that's left now is to try to get back access to my Hotmail account. The password I used there was recently changed prior to this incident. It was changed to some very long random password, auto generated by KeePass. And stored in KeePass! I didn't mind remembering it because KeePass did all that for me! So I don't have that on record anywhere. To make matters worse... I had no alternative email address setup on the account... and!... I can't get a reset code to the registered phone number, because my prepaid SIM card expired in early January! Now I'm fighting Microsoft to get back access! Paper is awesome! I actually had a "hard copy" of many of the entries I had in the KeePass file. I estimate I had a printout of about 50% of what I had on the computer file. But I gotta tell you, I love Recuva! It has bailed me out many times. Even this time! It saved me from a lot of manual work of entering all the data from paper to the computer. Additionally, the recovered file had more entries than what I had on paper. Imagine making printed paper backups of binary data like pictures, videos, and programs... that's totally workable! But it's a lot of hard work to put it back into the computer. Maybe if one had some sort of paper scanning system that feeds, scans, interprets and stores all the weird printed characters into computer files. It would be a funny hack. But absolutely not something I would recommend as a viable backup solution... imagine what it would be like to "sync" the backups... paper style! Wow! Haha! One would have to stock keep tonnes of paper! But for limited amount of data, paper is definitely a workable solution, as backup.

Hello! I'm looking at a microSD card here, and I can't help but wonder what the different file "states" as seen in Recuva actually mean. I have one JPG picture file that's "unrecoverable" and another that's "poor". But after I recover them both, the file that was supposedly "unrecoverable" is 100% OK from what I can tell by naked eye, while the file that was rated "poor" is missing the bottom half of the picture. What are the criteria for the various states to appear? Unrecoverable, Poor, Very poor, and Excellent? How can "unrecoverable" be better than "poor"? I would imagine that unrecoverable means that the file can't be recovered, at all. While poor or very poor means that the file is partly or completely corrupted, and that only parts of it can be recovered. Maybe I'm looking at this upside down?... could this be a bug?

Thanks! I tried the KeePass repair method without any luck. How could it repair it? It's a 0 byte file. Is it beyond recovery then? I can't believe this piece of s*** for an operating system! I had Windows 8.1 installed on an SSD, system disk C, no partitioning except the RAW caching partition. I had the backup partition on a separate partition J, which is a mechanical HDD. Windows 10 should not have even touched my J drive. The reason it did the scan may have something to do with my previous Windows installations and my dual, triple, quad boot configurations with Windows 7, 8, 10, 10 with different builds and so on and so forth, and different Linux distros. I know Windows hates it when other systems are present on the same machine, even if it's another Windows version, even if it's the same version of Windows. Not to mention when it's a Linux or another system present. These stupid automatic disk scan and repair and other "features" try too hard to be smart for their own good. Windows 10 especially, so I've noticed, does not like having multi-boot configurations. I previously had 3 installations of Windows 10 on separate partitions of the same disk. Same build version, same bitness, but different languages. Each time I would reboot into one or the other, the disk repair feature would detect and complain about corruption and s***. The thing is, I saw when Windows 10 was preparing to do the scan and repair. But it was a 3 second timeout! By the time I reached the keyboard, it was already too late! It had began scanning and "repairing". Had I known it would corrupt my KeePass file, I would have pulled the power plug on the f****** machine. Even if it would break the stupid Windows 10 installation. I would rather have my KeePass file intact than Windows 10 smarty pants "feature" destroy my data. I do have a backup of the file, but it's not a fresh copy. I have about 6 months worth of edits that are now lost! Thank you Microsoft! I don't like the empty threats people make by saying things like "I will switch to Linux". But I have never in my life been this close to completely ditching Windows for good! Like many people, I have been tolerating a lot of things on part of Windows and Microsoft, and I kept coming back to Windows for one reason or another. Even though I have been using Linux in a multiboot configuration alongside Windows on many machines and for a long time. But this incident, combined with the buggy and nu-finished bloatware called Windows 10 and surveillance "features", this might just be the last straw that broke the camel's back! At very least, disk scan and repair should have a longer timeout than 3 seconds before it begins! And! It should be non-destructive! It should not have the repair switch enabled! It should be interactive! First, do the scan! Then, ask the user for a course of action! Then, so on and so on. Interactive! Of course, this requires some computer know-how on part of the user. But what's the alternative? Have every f****** computer task automated for us? By Microsoft? Have them "smartphones" and gadgets read our mind and do the right thing for us? Seriously? Are people really this f****** lazy and retarded, that they, for instance don't know how to check the date and time so they would rather have "Cortana" read that loud for them? Or they don't know how to name their folders, so they would rather have a complex algorithm do that for them based on their personality by letting Microsoft learn all about them? What happened to thinking, reading books, learning, and doing things on your own, and thinking on your own? It sickens me to see how this so called "technology" is making people stupid! I know I should have kept several copies of this file. Backup is the golden key to computing! I know this! I have been using computers for over 30 years. I hate myself for not taking a backup of the backup sooner. But I have a busy schedule, like many other people who have a life. I fell behind on backing up to an external disk. But why should I be punished for this? Why would Windows 10 even dare to touch the mechanical J drive? This is certainly not the target disk it was being installed to. Let me tell you! It's because it's a dangerously unsafe, unstable, and defective by design operating system! Windows is too complex! It's hard to build something new from something old. It's hard to keep compatibility with devices and applications, and build new features at the same time. This is hard work even for the most insightful Windows experts. You can dress it up any way you want... Windows will still be Windows. Defective by design! Sticking a Ferrari emblem on a Fiat doesn't make it a Ferrari! I so regret upgrading to this piece of s*** of an operating system. By comparison, even Windows 8, especially 8.1 was excellent! But the best Windows so far was Windows 7! This has been said many times before, and it's worth saying it again. Windows 7 is the best Windows so far! And if look at the way Microsoft is going with Windows 8 and 10, then Windows 7 will be the best and last Windows ever! Windows XP and Windows 7, those are the ones worth mentioning. Of course XP is no longer supported, but so will Windows 7 one day... unfortunately.

Hi! I just realized that my KeePass database has been rendered useless by the Windows 10 upgrade process. I am still in shock! Toward the end of the upgrade process, Windows 10 did the m*****f****** disk scan and repair b******t and I remember seeing that it scanned my J: drive. This was my backup partition. I didn't realize until now when I tried to open my KeePass file that it has become corrupted. The file name itself is still there! But it's a 0 byte file! Is there any chance Recuva can recover a file whose file name is still intact but the data is missing? I mean, would Recuva even consider such file as missing? What else can I do to undo the wrongdoing of Windows 10 scan and repair process? Can it be undone? Note that it's only this file that's corrupted! All the other s**t is still intact on the partition! Conveniently... only the most important file is corrupted (its data is not linked to its name or whatever). I have never been so screwed by Windows! Ever! In my 20 years of using Windows! I had over 200 passwords saved in that file! Thanks in advance! I would appreciate any help I can get.

I just accidently deleted a backup file. It's an Acronis True Image TIB file. Recuva 1.43.623 finds the file through the recovery wizard but it is unable to recover it. The "state" of the file is "unrecoverable". So the resulting file is 0 byte. The file was stored at H:\My backup and the name of the file was File_backup_2012-10-18.tib. Why does the recovery process fail? Is there no way to save it now? I have stopped using the H disk because I know it can affect my chances of recovering the file. I really need this file.

Is there a good reason for this?... Perhaps it's because it would be contradictory to its mission, namely to keep the computer clean? That is not true my good man. I don't remember making any changes to the settings. I just had the latest version of CCleaner installed just to put this to the test. It defaults to having this option enabled. My memory serves me well. Check the screenshots for reference. I installed version 3.21.1767 but I previously had an earlier version, like version 3.0x something. It was not a much older version than the most current version. It could be that the default settings were changed since that version, but I wouldn't expect it to. In either way, what I meant was that CCleaner should ask you if you really want to do this. So that when you click the "Run CCleaner" option over the recycle bin CCleaner starts and then says something like "Wait a minute mate! You are about to delete all your application data! Are you sure you're 100% sober? Are you really really sure you want to do this?" This would at least given me a chance to regret the "run ccleaner" operation. Those who can't stand prompts like this should be able to disable this in settings. Mistakes like this do happen and they always will. But the way I see it is that the software can be designed more intelligently (predictively) to avoid this kind of thing.