Fractalogic

Sorry! It appears that Recuva is unable to scan BitLocker encrypted drives: http://forum.piriform.com/index.php?showtopic=45792 I hope you had a backup of your files!

Hi! I recently ran a Recuva file scan on the Recycle bin, which made Recuva scan all my local drives. One of these was my USB flash drive which is BitLocker encrypted. However, I had that drive unlocked before the scan began. But still, Recuva encountered an error. Failed to scan the following drives: \\.\HarddiskVolume2: Unable to determine file system type It successfully scanned all the other drives, but none of the other drives were BitLocker encrypted. So! Is it true? Is Recuva unable to scan encrypted drives? Thanks!

Ah! That's interesting. It shows the address for some files, but not for others. Here is a PNG file info: Size: 167 KB (171 372) State: Not deleted Creation time: 2015-04-03 19:06 Last modification time: 2015-04-03 19:06 Last access time: 2015-04-30 21:09 Comment: No overwritten clusters detected. 42 cluster(s) allocated at offset 76944 Here is some JPG file info: Size: 544 bytes (544) State: Not deleted Creation time: 2015-07-16 11:58 Last modification time: 2015-07-16 11:58 Last access time: 2015-07-16 11:58 Comment: No overwritten clusters detected. Why is that? Why does it tell the address for some but not for others? In this case both files have the same status (not deleted) and no overwritten clusters.

Hi! I wonder... is it by any chance possible to figure out the offset address of the files that Recuva detects? I'm looking at a very important file in the list. Recuva reports the size as 405 KB and it has no overwritten clusters. But I have a reason to believe that this file is larger than that. It's not a huge file, but it is certainly larger than what Recuva is reporting. I would like to go ahead and use another program to pick up some more raw data at this location. The reason the size is reported incorrectly is probably because the file system entry for the file has been damaged. I suspect Recuva can't display this. Unless it has some kind of hidden feature or a command line mode (?). I have looked at the UI and could not find any such option. I would highly recommend that you implement this feature. This would be really useful in some situations to some people. Thanks!

Wait... what? A 2 GB external drive from Western Digital? How old is that drive? What kind of interface is it using? What kind of computer is it attached to? Are you sure you didn't mean to say a USB drive? Those are external too you know, but then again... I don't think WD makes those. I didn't get that time reference... you lost what and when? You lost 15 temporary files at 3:30? Then what happened at 6:30? It's a good thing that you backed up then. But what you're saying is that you have made changes since your last backup that you would like to recover if possible? Are you kidding? The scan operation has been running for 7 days? That's not normal. Far from it! You would need to be using something like the original PC and a real old disk drive for that to make any sense. But then again, Recuva won't run on anything that old. I would recommend doing a simple scan first, before doing the deep scan. Always! Sometimes, there is no sane reason to do a deep scan for something that a simple scan can pick up much more quickly. If it does not, then you switch to deep scan mode. If you cancel the operation, you will be presented with a list of files that the program has found. Obviously it won't present you the files it could have found had it not been interrupted. It will tell you which files it thinks are healthy, and which ones are not. You can then select which ones you want to recover. It may or may not be able to recover the files you want. You can use the search function to locate the files you want if there are many files to scroll through. I would recommended that you immediately stop saving any new files to the drive. If the scan has been going on for that long I would recommend that you cancel it. See if it found anything useful. If so, recover it to a separate drive, not to the patient drive. If not, then go on and do a simple scan. If it doesn't find anything useful, go ahead and do a deep scan. Let it scan till it finishes. Also note that the computer needs to be running all the time during the operation. You can't put it to sleep and then wake it up the next morning and continue. Even if it works I do not recommend that. If all this fails, give it up and tap yourself on the shoulder for creating a backup before the disaster happened. It would have been much worse had you not created that backup.

What is a fragment? Do you mean a cluster?

A cluster is the same thing as allocation unit in Windows, right? If so, then this one is 32K. Is an "unrecoverable" file actually recoverable? If it is, then shouldn't the recovered cluster data be the data of the new file? And not the data of the overwritten file? I don't see how this "unrecoverable" JPG file can have been overwritten by another file, according to Recuva, an MP4 file. Because there were no new file write operations done after the JPG file was deleted. The suspected MP4 that supposedly overwrote the data clusters of the JPG file coexisted with the JPG file and was deleted together with the JPG file. See why I don't think the data clusters of JPG were overwritten by MP4? Unrecoverable: 20151103_115540.jpg Overwritten by: 20160104_190343.mp4 You can tell the date of creation of each file by their names. However, they were both deleted today, 2 Feb 2016, at the same time. No new files have been written to the SD card. So how is this possible then? It's not! Please prove me wrong. But I believe this is a false positive. This file is in fact Excellent! I believe... I don't have the original to compare to, obviously. But I am pretty confident that this is it, it's in its original form, and Recuva recovered it. But it falsely states that it's "unrecoverable". It's close to impossible that any bit of the data cluster has been overwritten. Thank you for the explanation of the different states. But I don't think these can be trusted.

Microsoft marketing campaign about the new Windows 10: "Your files are right where you left them." Yeah... right! Haha!

I did some research after this incident. The "scanning and repairing" message actually means that Windows is running the CHKDSK utility program. The CHKDSK program is too primitive!... like many of the aging Windows components that keep appearing in every "new" version of Windows. This program can't handle encrypted data. In fact, it is often recommended that any FDE (full disk encrypted) disk be unlocked or decrypted before CHKDSK may be used on them, in order to avoid data loss. My disk was not encrypted, but this single file on it was in fact encrypted. As a result, it was the only one that got screwed up! Naturally! I now understand why it did that. All the pieces fall into place now. Have a full disk encryption?... or a single file encrypted on a disk? Don't run CHKDSK on it! From what I can tell, what additionally may have caused CHKDSK to not handle the encrypted KeePass file properly is because my file was not compressed. I believe the file header is slightly different for uncompressed files, and this can make the file more or less recognizable by programs like CHKDSK. So CHKDSK treated the associated KeePass file data pretty much like empty disk space. It didn't understand what it was looking at, so it assumed it was just a collection of bad sectors and started relocating them, and what not. One thing I don't understand though... is why would Microsoft, the software giant who knows this all too well... why would they have the CHKDSK command run with the destructive "repair" switch enabled? Why not just run a normal "scan", and then prompt the user for action? Because the user is too stupid to understand the prompt and too uneducated to make an informed decision? See! This is what I meant. Devices are not smart. They are dumb. You can automate things... supposedly "to make our lives easier"... but automated set of commands can't make informed decisions and handle exceptions like an literate, informed computer operator or user can! I miss the old days... when I could operate my own computer... now I have to let go and transfer control to billion dollar companies. They control our digital lives. Making backups is the golden rule of computing! I know that. But with increased complexities of the technology, storage capacity and bandwidth requirements, it's hard to keep up. I normally use Acronis for backups, but I was behind schedule and I was working on setting up a new external DAS disk before the incident. I removed my old backup archives from the internal backup partition as an intermediate step. But instead of making a new backup to the external DAS, I decided to go ahead with the upgrade to Windows 10 to get rid of the annoying nagware messages in notification area to upgrade. I was going to have one internal disk as primary backup, and the external as a secondary. I don't know though why Windows 10 thought there was something wrong with the internal J partition where I had my KeePass file... there is absolutely nothing wrong with it. Bad sectors? BS! It was most likely a false positive. The disk is a brand new Western Digital Caviar Red 4 TB. But I did have a multiboot configured previously with both Windows and Linux. The CHKDSK may have picked up on some trace of those previous installations. I have noticed that the newer Windows versions are overly sensitive about this type of thing.

Yeah... all true! Indeed, I was going through a phase... now I'm just about done. Sorry about the bad language! Recuva actually managed to grab an old version of the file from the affected partition. It was not the most recent version, but it was better than what I had. I said I had an old copy, but I didn't manage to locate it. I must have misplaced it somewhere, or deleted it. Anyway! The file that Recuva dug up was good enough for me. I used that to build a fresh new file. Technically, I imported the recovered file into the new file. Then I added some new entries and made some edits as well. I'm still not back at where I left off but I have come to accept it now. All that's left now is to try to get back access to my Hotmail account. The password I used there was recently changed prior to this incident. It was changed to some very long random password, auto generated by KeePass. And stored in KeePass! I didn't mind remembering it because KeePass did all that for me! So I don't have that on record anywhere. To make matters worse... I had no alternative email address setup on the account... and!... I can't get a reset code to the registered phone number, because my prepaid SIM card expired in early January! Now I'm fighting Microsoft to get back access! Paper is awesome! I actually had a "hard copy" of many of the entries I had in the KeePass file. I estimate I had a printout of about 50% of what I had on the computer file. But I gotta tell you, I love Recuva! It has bailed me out many times. Even this time! It saved me from a lot of manual work of entering all the data from paper to the computer. Additionally, the recovered file had more entries than what I had on paper. Imagine making printed paper backups of binary data like pictures, videos, and programs... that's totally workable! But it's a lot of hard work to put it back into the computer. Maybe if one had some sort of paper scanning system that feeds, scans, interprets and stores all the weird printed characters into computer files. It would be a funny hack. But absolutely not something I would recommend as a viable backup solution... imagine what it would be like to "sync" the backups... paper style! Wow! Haha! One would have to stock keep tonnes of paper! But for limited amount of data, paper is definitely a workable solution, as backup.

Hello! I'm looking at a microSD card here, and I can't help but wonder what the different file "states" as seen in Recuva actually mean. I have one JPG picture file that's "unrecoverable" and another that's "poor". But after I recover them both, the file that was supposedly "unrecoverable" is 100% OK from what I can tell by naked eye, while the file that was rated "poor" is missing the bottom half of the picture. What are the criteria for the various states to appear? Unrecoverable, Poor, Very poor, and Excellent? How can "unrecoverable" be better than "poor"? I would imagine that unrecoverable means that the file can't be recovered, at all. While poor or very poor means that the file is partly or completely corrupted, and that only parts of it can be recovered. Maybe I'm looking at this upside down?... could this be a bug?

Thanks! I tried the KeePass repair method without any luck. How could it repair it? It's a 0 byte file. Is it beyond recovery then? I can't believe this piece of s*** for an operating system! I had Windows 8.1 installed on an SSD, system disk C, no partitioning except the RAW caching partition. I had the backup partition on a separate partition J, which is a mechanical HDD. Windows 10 should not have even touched my J drive. The reason it did the scan may have something to do with my previous Windows installations and my dual, triple, quad boot configurations with Windows 7, 8, 10, 10 with different builds and so on and so forth, and different Linux distros. I know Windows hates it when other systems are present on the same machine, even if it's another Windows version, even if it's the same version of Windows. Not to mention when it's a Linux or another system present. These stupid automatic disk scan and repair and other "features" try too hard to be smart for their own good. Windows 10 especially, so I've noticed, does not like having multi-boot configurations. I previously had 3 installations of Windows 10 on separate partitions of the same disk. Same build version, same bitness, but different languages. Each time I would reboot into one or the other, the disk repair feature would detect and complain about corruption and s***. The thing is, I saw when Windows 10 was preparing to do the scan and repair. But it was a 3 second timeout! By the time I reached the keyboard, it was already too late! It had began scanning and "repairing". Had I known it would corrupt my KeePass file, I would have pulled the power plug on the f****** machine. Even if it would break the stupid Windows 10 installation. I would rather have my KeePass file intact than Windows 10 smarty pants "feature" destroy my data. I do have a backup of the file, but it's not a fresh copy. I have about 6 months worth of edits that are now lost! Thank you Microsoft! I don't like the empty threats people make by saying things like "I will switch to Linux". But I have never in my life been this close to completely ditching Windows for good! Like many people, I have been tolerating a lot of things on part of Windows and Microsoft, and I kept coming back to Windows for one reason or another. Even though I have been using Linux in a multiboot configuration alongside Windows on many machines and for a long time. But this incident, combined with the buggy and nu-finished bloatware called Windows 10 and surveillance "features", this might just be the last straw that broke the camel's back! At very least, disk scan and repair should have a longer timeout than 3 seconds before it begins! And! It should be non-destructive! It should not have the repair switch enabled! It should be interactive! First, do the scan! Then, ask the user for a course of action! Then, so on and so on. Interactive! Of course, this requires some computer know-how on part of the user. But what's the alternative? Have every f****** computer task automated for us? By Microsoft? Have them "smartphones" and gadgets read our mind and do the right thing for us? Seriously? Are people really this f****** lazy and retarded, that they, for instance don't know how to check the date and time so they would rather have "Cortana" read that loud for them? Or they don't know how to name their folders, so they would rather have a complex algorithm do that for them based on their personality by letting Microsoft learn all about them? What happened to thinking, reading books, learning, and doing things on your own, and thinking on your own? It sickens me to see how this so called "technology" is making people stupid! I know I should have kept several copies of this file. Backup is the golden key to computing! I know this! I have been using computers for over 30 years. I hate myself for not taking a backup of the backup sooner. But I have a busy schedule, like many other people who have a life. I fell behind on backing up to an external disk. But why should I be punished for this? Why would Windows 10 even dare to touch the mechanical J drive? This is certainly not the target disk it was being installed to. Let me tell you! It's because it's a dangerously unsafe, unstable, and defective by design operating system! Windows is too complex! It's hard to build something new from something old. It's hard to keep compatibility with devices and applications, and build new features at the same time. This is hard work even for the most insightful Windows experts. You can dress it up any way you want... Windows will still be Windows. Defective by design! Sticking a Ferrari emblem on a Fiat doesn't make it a Ferrari! I so regret upgrading to this piece of s*** of an operating system. By comparison, even Windows 8, especially 8.1 was excellent! But the best Windows so far was Windows 7! This has been said many times before, and it's worth saying it again. Windows 7 is the best Windows so far! And if look at the way Microsoft is going with Windows 8 and 10, then Windows 7 will be the best and last Windows ever! Windows XP and Windows 7, those are the ones worth mentioning. Of course XP is no longer supported, but so will Windows 7 one day... unfortunately.

Hi! I just realized that my KeePass database has been rendered useless by the Windows 10 upgrade process. I am still in shock! Toward the end of the upgrade process, Windows 10 did the m*****f****** disk scan and repair b******t and I remember seeing that it scanned my J: drive. This was my backup partition. I didn't realize until now when I tried to open my KeePass file that it has become corrupted. The file name itself is still there! But it's a 0 byte file! Is there any chance Recuva can recover a file whose file name is still intact but the data is missing? I mean, would Recuva even consider such file as missing? What else can I do to undo the wrongdoing of Windows 10 scan and repair process? Can it be undone? Note that it's only this file that's corrupted! All the other s**t is still intact on the partition! Conveniently... only the most important file is corrupted (its data is not linked to its name or whatever). I have never been so screwed by Windows! Ever! In my 20 years of using Windows! I had over 200 passwords saved in that file! Thanks in advance! I would appreciate any help I can get.

I just accidently deleted a backup file. It's an Acronis True Image TIB file. Recuva 1.43.623 finds the file through the recovery wizard but it is unable to recover it. The "state" of the file is "unrecoverable". So the resulting file is 0 byte. The file was stored at H:\My backup and the name of the file was File_backup_2012-10-18.tib. Why does the recovery process fail? Is there no way to save it now? I have stopped using the H disk because I know it can affect my chances of recovering the file. I really need this file.

Is there a good reason for this?... Perhaps it's because it would be contradictory to its mission, namely to keep the computer clean? That is not true my good man. I don't remember making any changes to the settings. I just had the latest version of CCleaner installed just to put this to the test. It defaults to having this option enabled. My memory serves me well. Check the screenshots for reference. I installed version 3.21.1767 but I previously had an earlier version, like version 3.0x something. It was not a much older version than the most current version. It could be that the default settings were changed since that version, but I wouldn't expect it to. In either way, what I meant was that CCleaner should ask you if you really want to do this. So that when you click the "Run CCleaner" option over the recycle bin CCleaner starts and then says something like "Wait a minute mate! You are about to delete all your application data! Are you sure you're 100% sober? Are you really really sure you want to do this?" This would at least given me a chance to regret the "run ccleaner" operation. Those who can't stand prompts like this should be able to disable this in settings. Mistakes like this do happen and they always will. But the way I see it is that the software can be designed more intelligently (predictively) to avoid this kind of thing.

I have now restored some of the tabs I had open and parts of the browser history in Firefox and Chrome. It was not an easy task because I had no shadow copies and my backup was older than I thought, it's in fact one week old. I used Acronis True Image to recover the profiles to their previous versions. But I made another mistake by restoring all of the files and overwriting existing files. This resulted in a corrupted Firefox profile and caused it to close unexpectedly every time I started it. This was most likely caused by restoring an add-on (a tab preview add-on) that previously disabled and removed. It was now back again. Firefox prompted me about it the first time I started it and asked if I wanted to continue and install it. I decided to go ahead and since that Firefox has been closing as soon as it starts, with no error at all. I had to do some tricks with profile manager and safe mode to fix it. I at least have my bookmarks back now, and I have restored some of the tabs from history. It didn't help to copy over and rename the sessionstore.bak file. I didn't have this much trouble with Chrome, but I had to restore the tabs from history there as well. It's amazing how one small mistake can make you spend so much time on resolving a problem that should not have happened in the first place, had the Ccleaner software been designed better. I urge you to change this behaviour in CCleaner. One simple confirmation dialog box before it actually starts destroying my application data would not hurt. Or at least an option to set this behaviour in settings. Right now I am about to uninstall CCleaner. Not just because of this, I rarely use it anyway. I prefer to keep this type of application data whenever possible, rather than remove it. Cheers!

Firefox browser history and session file is stored in \AppData\Roaming\Mozilla\Firefox\Profiles. Chrome browser history and session file is stored in \AppData\Local\Google\Chrome\User Data\Default. This is true at least for Windows Vista and 7, for Windows XP it's not. It should be somewhere in the Documents and Settings folder on XP. However, I was unable to restore any previous versions of the files in these two folders using shadow copy. In fact, all my shadow copies seem to be gone! Could it be that CCleaner has deleted them? Could it be that CCleaner is in fact designed to remove shadow copies of files and folders as well? I have not found any setting or option for this. And what about that log file? CCleaner loggs performed tasks, does it not? Looks like I will have to rely on my 2 day old backup of my users folder in order to restore these two folders to their previous state. It's a shame, because I had so many new tabs open in both of the browser since that. It's too bad that shadow copy didn't work, otherwise I would have restored the browser files in a snap. It's a mystery to me why they are gone. I am currently suspecting Ccleaner for it.

Hey everyone! I accidently right-clicked on the recycle bin on my desktop, and then clicked "Run CCleaner". But that's not what I wanted, I wanted to click on the "Eraser" option that belongs to another sofware I have installed. Little did I know that by clicking the "Run CCleaner" option from the recycle bin context-menu it actually automatically starts to remove browser history, saved passwords, cookies, browser sessions and so forth, once the program has loaded. Also, there is no program window appearing in the task-bar. Instead, an icon appears in the notification area (system tray). Once I realized what was going on it was too late to stop it. What I would like to do is to recover my browser session and history data. I don't care for the other stuff. What can I do to recover it at this point? First of all, I would like to know what was deleted, and get the file paths. But I cannot locate any log file for CCleaner. Where does CCleaner store its log file? I can't seem to find it anywhere. You can see in the attached screenshot what settings were used. Where is browser history for Google Chrome and Firefox stored? Where is browser session file for Google Chrome and Firefox stored? Thank you in advanced!

Hey all! Are there any plans on supporting the DCF file system in Recuva? I suppose that supporting DCF would allow Recuva to access memory card information while the card is still inside the camera. That would be great, if possible. DCF stands for Design rule for Camera File system. http://en.wikipedia.org/wiki/Design_rule_for_Camera_File_system As far as I understand the Wikipedia article on this subject, the DCF is merely a "design rule" while the files are actually stored in a FAT file system. I know that Recuva supports FAT, but reading the files directly from the camera, in Recuva, that's a whole different story than having to insert the card in the computer.

The tale of ParetoLogic Data Recovery Pro I remember once using ParetoLogic Data Recovery Pro to try and locate a file with a specified file name on a busy C system volume. It was able to find the exact file I was looking for, even though none of the other six or seven tools I had tried with did not. It seemed very impressive. But it took about three hours to complete the scan. And as it turned out that software is not free at all, it costs 50 USD. But there is no price listing on the website, at least it's not easy spotted. You only discover that it costs 50 USD after installing it and after running the scan and finding the file. And of course you need to pay for it first before you can use it to recover the file. Compare this to Norton Utilities trial edition which also costs 50 USD but it will actually restore the files for you, so you can inspect them and see if they are healthy, even though you don't have a full license yet. And here's another twist to the story: the license is not perpetual! You don't just pay 50 USD for a single license and for a given version of the software and use it for as long as you want, just like most software products including Microsoft Windows and Office products. You have to actually pay 50 USD every year! That's their licensing policy they say. It's a bloody subscription license. You can think of it as Anti-Virus software license which are renewed every one to three years. But I understand the concept of Anti-Virus software licensing, since new viruses are created every day, you need the latest virus definitions to counter these threats. That's what you are subscribing to. But what are you subscribing to with ParetoLogic? Just the ability to use the damn software! You don't get any other benefits, I've checked. Why would I pay 50 USD annually just to use this software once or twice in a three year period? It's not like I intentionally screw up my files on a regular basis, just for the fun of it to see what happens, to see if I can restore them. Regardless of how effective ParetoLogic Data Recovery Pro software is, I advice against buying a license. Correction: you don't buy anything, and you don't own anything, you just subscribe to it as if it was some kind of service and not a product. This is a greedy company who just wants fast earned money. I'm not too sure that they even found that file they said they did. They could just tell the software to show me that they have found the file I was looking for, just to get me in and start paying a 50 USD annual license fee. You can never know if it works, because you can not check and validate the files it supposedly founds, since it won't allow you to recover until you pay. You know, like those funny little web ads like "warning, your computer is at risk, click me and I will help you". So far I have had the chance to use Recuva two or three times in a real situation. In this latest situation it has been most successful, it was just as good as the other competing commercial products. Why it was less successful in previous situations, I can't really tell. There are so many factors that count in. Like that time when I was using the ParetoLogic thing, the file I sat out to find was stored on the C system volume which is always busy writing information. The file might just got overwritten before I could recover it with Recuva. It's interesting in this context that the ParetoLogic thing was able to locate that file, while both Recuva and about five others failed. I think Recuva really is a project worth donating to. If it was a commercial product it would definitely be worth buying. But I will sure make a donation, you do a great job with this software.

Thanks for replying! By normal scan you mean quick scan, right? I did a deep scan, not a quick scan. So the 2 files I saw withing parenthesis labeled as "ignored" on the status bar, those were only fragments of 2 files that could no longer be recovered? Well, I am not so sure anymore that the 533 MB file, you know the "consolidated" file, that it was actually a consolidated file. Here is why. Assume that you have 10 files with the following file sizes. File 1: 100 MB File 2: 150 MB File 3: 200 MB File 4: 250 MB File 5: 300 MB File 6: 350 MB File 7: 400 MB File 8: 450 MB File 9: 500 MB File 10: 550 MB We are assuming that they are numbered according to the time they were created, so number 1 would be the oldest and number 10 would be the newest. This will give a total of 3250 MB. If they are merged or "consolidated" in backup software terms, it means that one of them would become preciesly 3250 MB in size. Which one would become 3250 MB? It's usually the first file that is consolidated. The first backup is usually a full backup, and all new backup files thereafter are incremental backups containing only the changes done since the last full lbackup. This is the same for most backup software. But we will assume that file number 10 is the consolidated one, so file 10 is now 3250 MB. By increasing the size of file 10 from 550 MB to 3250 MB while at the same time deleting the first 9 files, that would cause the clusters of those 9 files to be overwritten by the new bigger file. The chances for this happening is especially big when the overall free disk space is limited. What I'm saying is that by consolidating the backup files to one single file in this type of scenario would greatly decrease the chances of restoring the files that get deleted by this process. Now, if the files are consolidated into one single 3250 MB file, by reverting back the consolidation process so that you have 10 individual files again, the total of the 10 files should not exceed 3250 MB. File 10 = 3250 File 1 + 2 + 3 + 4 + 5 + 6 + 7 + 8 + 9 + 10 = 3250 MB The sum of the individual file sizes cannot exceed 3250 MB. If individual files are bigger than the one consolidated file, then that backup most probably never was consolidated at all. In my situation the last file was 533 MB after the first nine files disappeared. They disappeared for some reason when I attempted adding that last file to the list of backups in Acronis True Image 2011. Since they did disappear from the holding folder, I only assumed they were consolidated by Acronis True Image 2011. I thought it needed to consolidate them first, before adding the backup to the list of backups. But for this to hold true, when reverting back the process and "unconsolidating" or restoring back the removed files, the individual files cannot be larger than the consolidated single file. Well this is what I discovered when I restored the 9 files. For instance, one of the files was 1,22 GB. But the last file was only 533 MB. This means that the last file was not at all a consolidation of all the previous files, because a 533 MB file cannot hold a 1,22 GB file, plus additional 8 files with just about the same big size. These are the files I restored with Recuva. MyBackup__2009-12-18.tib 882 MB (925?325?824 byte) MyBackup__2009-12-20.tib 1,46 GB (1?573?391?872 byte) MyBackup__2009-12-21.tib 1,22 GB (1?320?400?896 byte) MyBackup__2009-12-23.tib 1,56 GB (1?683?230?208 byte) MyBackup__2009-12-25.tib 1,41 GB (1?516?966?400 byte) MyBackup__2009-12-27.tib 229 MB (240?476?160 byte) MyBackup__2009-12-28.tib 323 MB (339?008?512 byte) MyBackup__2009-12-30.tib 168 MB (176?160?768 byte) MyBackup__2009-12-31.tib 533 MB (559?581?184 byte) These are the files I restored with TuneUp Utilities 2011 (10.0.4310.27). MyBackup__2009-12-18.tib 882 MB (925?325?824 byte) MyBackup__2009-12-20.tib 1,46 GB (1?573?391?872 byte) MyBackup__2009-12-21.tib 1,22 GB (1?320?400?896 byte) MyBackup__2009-12-23.tib 1,56 GB (1?683?230?208 byte) MyBackup__2009-12-25.tib 1,41 GB (1?516?966?400 byte) MyBackup__2009-12-27.tib 229 MB (240?476?160 byte) MyBackup__2009-12-28.tib 323 MB (339?008?512 byte) MyBackup__2009-12-30.tib 168 MB (176?160?768 byte) MyBackup__2009-12-31.tib 533 MB (559?581?184 byte) These are the files I restored with Get Data Back for NTFS (4.22). MyBackup__2009-12-17.tib 0 byte MyBackup__2009-12-18.tib 882 MB (925?325?824 byte) MyBackup__2009-12-20.tib 1,46 GB (1?573?391?872 byte) MyBackup__2009-12-21.tib 1,22 GB (1?320?400?896 byte) MyBackup__2009-12-23.tib 1,56 GB (1?683?230?208 byte) MyBackup__2009-12-25.tib 1,41 GB (1?516?966?400 byte) MyBackup__2009-12-27.tib 229 MB (240?476?160 byte) MyBackup__2009-12-28.tib 323 MB (339?008?512 byte) MyBackup__2009-12-30.tib 168 MB (176?160?768 byte) MyBackup__2009-12-31.tib 533 MB (559?581?184 byte) These are the files I restored with Norton Utilities (15.0.0.122). Deleted ZIP Archive 1.zip 228 kB (233?512 byte) Deleted ZIP Archive 2.zip 208 kB (213?264 byte) Deleted ZIP Archive 3.zip 136 kB (139?962 byte) Deleted ZIP Archive 4.zip 158 kB (162?754 byte) Deleted ZIP Archive 5.zip 109 kB (112?638 byte) Deleted ZIP Archive 6.zip 454 kB (465?228 byte) Deleted ZIP Archive 7.zip 523 kB (536?487 byte) Deleted ZIP Archive 8.zip 13,9 kB (14?286 byte) Deleted ZIP Archive 9.zip 117 kB (120?595 byte) Deleted ZIP Archive 10.zip 62,1 kB (63?684 byte) Deleted ZIP Archive 11.zip 24,9 kB (25?518 byte) MyBackup__2009-12-17.tib 0 byte MyBackup__2009-12-18.tib 882 MB (925?325?824 byte) MyBackup__2009-12-20.tib 1,46 GB (1?573?391?872 byte) MyBackup__2009-12-21.tib 1,22 GB (1?320?400?896 byte) MyBackup__2009-12-23.tib 1,56 GB (1?683?230?208 byte) MyBackup__2009-12-25.tib 1,41 GB (1?516?966?400 byte) MyBackup__2009-12-27.tib 229 MB (240?476?160 byte) MyBackup__2009-12-28.tib 323 MB (339?008?512 byte) MyBackup__2009-12-30.tib 168 MB (176?160?768 byte) MyBackup__2009-12-31.tib 533 MB (559?581?184 byte) The 9 files that are common to all four applications are binary same. I have let Byond Compare 3 do a CRC check on them. But Norton Utilities didn't restore the last modified dates, instead it set new dates for the restored files. It's not a big deal but it may be useful to know the modified date of the original file in some scenarios. Also, the TuneUp Utilities did restore the original dates, but the time stamps were differing by about 2 hours, more or less. Recuva didn't have this issue. But isn't it possible to restore 0 byte files with Recuva? As you can see I have tried out some other recovery software as well and some of them have found a 0 byte file. One such software is Get Data Back for NTFS. There may be scenarios where you would want to recover 0 byte files as well, in case you need the file name. Even thou the file may not contain any secrets, the file name itself may be too informative, revealing confidential information, and you want to shred it just to make sure it is safely deleted. It might just be that this 0 byte file is one of the 2 ignored files during deep scan with Recuva. The 11 ZIP files found by Norton were some kind of deleted files with very consistent file name schemes like "Deleted ZIP Archive 1.zip" up to Archive 11. They may be some kind of ZIP versions of the backup (TIB) files. Or so I thought. They are 1,99 MB (2?087?928 byte) in total, so they are pretty much useless and not needed anyway, given the fact that the real backup files are over 300 MB each. Also, Norton Utilities prompted "Repair File?" when recovering these ZIP files. "'Deleted ZIP Archive 1.zip' has been recovered and has been detected as corrupt. Would you like to repair this file?" Later on after the recovery process of all files it tells that some files may not have been repaired. After all the investigation I was unable to recover this backup, neither with Acronis True Image 2011 nor with True Image 2010 with wich the backup was created. I think it has to do with that 0 byte file. I think that first file should be at least few hundreds of MB in size for this backup to be complete. Although, this was not a critical backup for me. I was only trying to recover some old software and log files. I can do without those logs, and I can reinstall the software. However, I am really impressed with Recuva! I am impressed that Recuva was just about as effective as these other recovery software tools. It means that Recuva does for free what others want you to pay for. And even if you do pay for it, there's no guarantee that they will be more successful than free tools like Recuva.

Hey all! I am new here. This is a really nice forum, I love the green theme. I just installed Recuva 1.40.525, hoping to be able to recover a backup file that just got deleted by Acronis TrueImage by mistake. It's a long story. But I know the file name, I know the file size and I know where it was stored. File: MyBackup__2009-12-31.tib Size: 533 MB Location: D:\MyBackups\ Note that this is not my system volume. This volume is merely used, so there are virtually no write operations done on it that would ruin my chances of recovering the file. Recuva successfully found 9 of the 10 or 11 lost files, depending on how you count. Let me clarify that a little bit. From the beginning there were 10 backup files with the TIB file extension. That was before TrueImage decided to merge (consolidate) these into one single file, and it did this in complete radio silence, without my consent and without a single notice. Like I said, it's a big story, and Acronis has been notified about it. But the main thing is that there were 10 files from the beginning, these were merged into 1 file, then this 1 file got deleted by mistake from within TrueImage. Now Recuva is listing 9 files, but it ignores 2 files. Can someone explain to me my why it ignores the 2 files? Can I tell it to show me those 2 files somehow? I would like to get back to the point where I had the 10 individual files. That would be best. This is because the consolidated file appeared to contain errors. But I would be happy if I could at least get back the 1 consolidated backup file, at least. Can someone help me with this? Thanks!