So someone removed a USB stick before the end of a data transfer, but AFTER Windows reported that the data had been written. They then went on to completely overwrite the disk, but I want to know how much data was written and why the files disappeared.
Obviously, it might be a Windows write caching thing, but everything suggests it was not active at the time.
So I ran a Deep Scan using Recuva and ~8GB was found in 7200 files (1,189MB each), which correlates well with what was supposed to have been written. The files all had the right modification dates and the file names all fit the right pattern EXCEPT they all had an underscore added to the beginning of the file name. The files were marked irrecoverable, except one (which is suspicious in itself).
Does anyone know if this underscore is actually added in the filenames (by Windows...?), or has been added by Recuva to indicate an incomplete filename or something else?
