Does not find file deleted on external HDD

Recuva
1

Trialing Recuva using portable version

Using portable Recuva v1.53.1087

External portable USB HDD | drive letter “F” | NTFS | Data only

capacity: 50 GB | used: 10.1 GB | Free: 39.8 GB

created a TXT file in F:#1\folder_2\folder_3\folder_4\folder_5

File name: zz_test recuva_2017-02-08.txt

moved focus to another folder to ensure Windows registered the new file

returned to the test folder and deleted the test file

Recuva portable

Drive F:

Filter: zz*.txt

Scan Files…

Recuva did not find the file but did find an obscure, 8 year old file “ZZSMW2P6.txt”

path of the “ZZSMW2P6.txt” has never existed :blink:

Exported report from Recuva

------------------------------------------------------------------------------------------------------------------------

[F:] NTFS, 49.9 GB. Cluster size: 4096. File record size: 1024. Found 1 files.

Filename Size Path

ZZSMW2P6.txt 356 F:?\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\

There is no "Users\Owner" folder on F:\ nor has there ever been

F: drive is data only and has never been anything else

( I know Users\Owner etc is in C:\ drive

What am I doing wrong, the C:\ … F:\ drives mix up is very confusing. ?

- the actual first folder on F: is F:\#1 ... I wonder if my first folder with hash in the name is part of the problem

I would appreciate any help , thank you :)

2

It depends on how the file was deleted. If it went to the recycler first then it would have been renamed to $Rnnnnn.txt. If a shift/del then sometimes deleted files can be overwritten, and this is most likely with recently created/deleted files (due to the way MFT entries are reused).

Your eight-year old file must have existed at some time on the drive. The ? in the path name signifies that there are additional level(s) in the path name that can't be reconstructed.

The # folder name is not significant, apart from being an unnecessary sidetrack to the problem.