tonyp12

Try to Scan Contents... if you just need some part of text. The text could be inside a large buffer file and still be a readable string available, use win10 cmd find on the file.

Revuva deepscan said the file was unrecoverable, Revuva's Scan Contents... did find the text I was looking for. Had to use a thirparty software to actually display that text though, I used win10 command find. So just a rawscan for a text string on the drive would be nice.

Maybe you don't need the file, just find me the strings that start with this part. crypto currency password file recovery, email address recovery, phone number recovery etc

I'm now telling other people how to use Revuca to find keystore files, people (like I did) think password you use to set up Mist Wallet is your account, but it's just used to hide the privatekey from plain view, without it the money is gone in the cloud forever, some people have lost $1000. https://github.com/ethereum/mist/issues/3489

But the text string was actually still there, unless some shadow text of it was in a second location, but I never copy/pasted/deleted that file. Recuva's Scan Contents... found the file the text was in, in was the same file Recuva said had overwritten it, I recovered it by using windows FIND. So here is a new recommended feature for Recuva: recover crypto currency accounts. Scan that harddrive just for known beginning text of encrypted privatekey strings, don't care about if it's still a file.

Not really true, what does "overwritten (0)" mean? After a day of trying I used Recuva's Scan Contents... and searched for {"address": it said it was inside the 17GB pagefile that the new win10 installation is using, I had set it to that size as 6 graphics cards needs it Recovered it (just copy and save really), used windows cmd FIND "cfebf89f6fcea755ebba061b25a0db398a592055" K:pagefile.sys As I could not look for strings that have " in them, maybe with escape char? so I could not look for {"address": again. and bingo, ready to copy and paste back the whole ciphertext back in to Mist Ethereum wallet. The dot in file name is what separates the name and type, so I recreated those for the file, just in case.

Filename: UTC--2017-12-15T05-23-06.593317100Z--cfebf89f6fcea755ebba061b25a0db398a592055 Path: C:\? Size: 491 bytes (491) State: Unrecoverable Creation time: 12/15/2017 00:23 Comment: This file is overwritten with "C:\pagefile.sys" 1 file cluster(s) overwritten (0) 1 cluster(s) allocated at offset 7864679