deleted files overwritten by older files - unrecoverable ?

Recuva
1

hello,

I accidentally deleted some raw image files from a memory card. Clumsy me! :rolleyes:

Here's what I did (as far as I remember):

  1. cut a few image files from the card and paste them to the computer
  2. lose the files on the computer

From my previous (poor) understanding of how memory works and the help of your docs, I concluded that the files should still be on the card.

I ran recuva and it listed all the lost files.

However, they are all marked as unrecoverable, because they are overwritten by other files.

Now here's the tricky part that I do not really understand:

Those files that have supposedly overwritten the lost files are actually older than the lost files.

The last modification dates (seen in windows explorer) date back several months.

In fact, the lost files were the newest files on the card. (written most recently)

I tried a recovery.

2 of the 282 files are readable.

The interesting thing is that they do not have the expected content.

The 2 readable files have the content of those files that have supposedly overwritten them.

But that means that windows would have copied all files of the card to a new position which doesn't make too much sense. (according to how windows handles deletion of files)

I guess (hope) the offset created by deleting files is not considered and the old files (indexes) happen to be lined up with deleted files and are confused with each other, hence the content of an old file in a deleted one.

Is all lost or is there still hope to get those files back?

thanks

2

Hopefully you have copies of those files stored elsewhere since with Recuva stating they're overwritten you wouldn't be able to recover them.

3

Is it possible that after the lost files were deleted some user initiated or scheduled or Microsoft initiated de-fragmentation simply relocated some old files into the free space created by losing those files.

Only old date stamp does not mean the file has not been moved since it was created.

4

Is it possible that after the lost files were deleted some user initiated or scheduled or Microsoft initiated de-fragmentation simply relocated some old files into the free space created by losing those files.

Only old date stamp does not mean the file has not been moved since it was created.

That's what came to my mind as well.

I found two other programs that were able to recover the files.

One of them was paid and only allowed a few files to be recovered for free.

The other one: "PhotoRec" worked great.

While its use does not look as convenient as the other tools it got the job done.

Most of the recovered files seem to be usable.

It's GPL, so you might want to take a look.

Thanks guys.