I am still running XP (I know, I know...) with a Western Digital Elements 1T external USB hard drive attached. This drive has been my repository for all my docs and downloads. Due to the rather small size of the computer's HD, it's also been my primary picture storage drive. In November I was looking for some pictures in a folder on that drive and discovered the folder was empty. As I investigated further I found that, although the folders all remained, over 200G of picture files were missing from folders on that drive. My naming convention for these folders is <YYYYMMDD Then a brief Description>. Only the contents of these folders were "deleted". I suspected a virus but still couldn't figure out how or why those folders. There were numerous other folders on that drive with .jpgs in them and they were just fine. Also, there were .jpg files in few folders on the local HD that were not affected either. The only clue I have is the last modified date on the folders. They all ended up being dated 10/25/2014 and each folder's time was a few minutes (between 2 an 5) apart. In my experience with the number and size of the files in some of these folders, I couldn't have deleted all the pictures in that short a time even if I tried.
After running a 9 hour deep scan of Recuva and seeing how many files it was able to "see" I thought maybe I'd get lucky. My only option was to recover back to the local HD. Once the recovery was completed I was disappointed to see that those folders had files which have no extensions and appear to be some kind of hex code (I.E.1070E08F2120). At this point I went to the extent of contacting Western Digital and they provided me with a diag program. It ran for nearly as long as the deep scan and the results were that I have a perfectly healthy drive. Congratulations to me...
I just recently purchased EaseUS after pretty much giving up on Recuva. EaseUS did almost the same exact thing as Recuva by not returning me my .jpg files in those folders but providing me with a non-viewable "hex code" file name instead. The great hook EaseUS uses is that you must purchase their program to see that the files you hoped were there actually aren't. They even give you a "preview" option on the trial version but it's a button that doesn't do anything until you enter the license code which is where the money comes in. Oh well, I'll be getting my money back on that software but you know, if it had worked I would never have batted an eye about the $75. For that matter, I wouldn't care who recovered my files as long as it could be done for roughly that amount.
Hopefully I can find someone who will be able to perform an actual recovery without breaking my bank. It would definitely appear that whatever caused me to lose my files is far superior to the end user products available on the Internet currently. I'm attaching a small .jpg of what I have when trying to view the contents of these "recovered" files, just so you have a reference and can maybe let others know what "unrecovered files" look like. Thanks for letting me run on here for a while and for at least not charging me to find out that my files couldn’t be recovered.
Unfortunately recovering to the same drive - with a data amount of 200 gb - has probably ruined any chance there was of recovering any significant amount of valid data. I don't know what algorithm NTS uses to allocate space for new files, but you can bet that quite a lot of the recovered files went straight on top of data you're trying to recover.
It appears that the file names are coming from either an overwritten MFT folder entry or the recovery program is looking in the wrong place. trying to second-guess what a recovery program is doing and what state a disk is in is not an easy task.
That was actually a modified screen print from browsing in Windows, a view of the folder contents after the recovery attempt. After 2 attempts at recovery and numerous manual "copies" of files that were still there I will say that I can't be sure if this was an EaseUS or Recuva result. I do remember having the same basic file naming, regardless. As I stated above, my only option for recovery was from an external HD (where the data loss originally occurred) to the local HD of the machine. Also note that when I attempted the recover with EaseUS it was to another external USB HD that is 2T, not that it has any bearing on Recuva. As it appears something was discovered in the folders by both programs and I would like to think that maybe a program exists that can retrieve this data. I am merely pointing out my disappointment as I can see others are doing as well. Maybe we all did something wrong and have doomed ourselves. It's tough coming to grips with the fact that my data is not retrievable by any means.
Ah, I misread your original post and thought you had recovered to the same disk. So forget all that.
The file view in Explorer is taken from the directory entry in the Master File Table (MFT). This is a list of the files you have recovered. However that list of files came from the recovery software.
File names are held in ascending sequence in the folder record in the MFT. When a file is deleted the following file names are moved up to overwrite the deleted file info and a new EOF marker written on the now shorter folder record. If all files are deleted this closing up occurs multiple times until the folder is empty. So what is the recovery program attempting to read that returns these invalid names? I don't know. Records for large folders can be very complex, with separate indexes and tens of MFT extension records. It appears that the recovery program is reading invalid data that no longer relates to the deleted files. I don't think you are going to get anywhere by chasing these names. The names are invalid and the data associated with them is likely to be invalid too.
Ultimately the file names are held in the MFT, not the files themselves. If the file names have gone from the MFT, they've gone from the files. A deep scan looks directly at the file clusters, but if a file is in fragments you will only get the first fragment. Recovery isn't easy.
As I said, trying to guess what a recovery program is doing, and trying to guess the state of a disk, is not easy. Ultimately no file can be guaranteed to be recoverable.