So I downloaded the latest free edition of Recuva, installed it, then deleted the setup file and also purged it from the recycle bin.
What do you know, Recuva did not find this deleted file. Seriously? Does this program even work??
Of course it does. Unfortunately Mr Gates also wrote Windows so that it would 'work', and didn't consider the needs of recovering deleted files.
All files are listed in the MFT. When a file is sent to the recycler Windows renames it. When the file is deleted from the recycler the MFT entry is available for other file use. Recently created/deleted files are most vulnerable for that reuse. It's most likely that the MFT entry for the setup file you're looking for has been overwritten, perhaps even by launching Recuva. It's just the way that Windows and NTFS works - seriously.
If you open Recuva and run a scan, then do your file deletion, then run a Recuva scan again you'll most likely find the deleted file.
If you open Recuva and run a scan, then do your file deletion, then run a Recuva scan again you'll most likely find the deleted file.
Nope, does not work that way either, at least for me. The deleted setup file is not found even within a single Recuva session (and no there's no other filesystem activity on the PC during my testing of this).
If you delete an ordinary text file does it find that?
Did you do a deep scan?
(by the way recuva does really work, we just have to work out why it doesn't seem to work for you)
What is your operating system by the way?
Nope, does not work that way either, at least for me).
Did you actually launch Recuva and scan and leave it running before you deleted a SECOND copy of the setup file before you then repeated the scan,
or did you expect those actions to find the FIRST copy ?
Did you actually launch Recuva and scan and leave it running before you deleted a SECOND copy of the setup file before you then repeated the scan,
or did you expect those actions to find the FIRST copy ?
Of course I used a second copy, seeing as the first one was ir-recuva-rably deleted to begin with.
But I've just tried again and it does work, so not sure what was happening before. Maybe there really was a FS activity, just nothing obvious.
Thanks!
I have the same issue (vista sp2 32bit)
I've created a small text file, shift-delete it to skip recycle-bin and ran the installed copy of recuva. regular scan didn't find the file. deep scan found the file and 'recovered it' (to another disk) but when i checked, the file was empty.
when i left recuva running before deleting the file, it worked.
is it needed to leave recuva running all the time?
thanks.
No, unless you have a habit of creating, deleting and recovering files in a short period of time.
It's just the mechanics of NTFS. A new file will use the first available record in the MFT. If it is then deleted the MFT record it used becomes available for other files to use, and is probably the first available record again. So it is very likely to be reused by another file. Opening Recuva creates at least one new file, so that is why it's recommended that Recuva is running before this exercise is started. It is just an exercise, isn't it?
It is just an exercise, isn't it?
well, the small text file was, but I did that AFTER I failed to recover a 'real' file I needed.