Files that show as "Excellent no overwritten clusters" won't save

Recuva
1

I've been trying to do a recovery on a 1 TB Western Digital "Green" drive that came up as unformatted. It has a number of video files on it. An initial quick scan came up with one file. I tried deep scan and after a recovery period of several hours it shows 117 files as "Excellent no overwritten clusters". Some of them retain the original file name, some come up with a numerical filename like [000062].avi

I attempted to save to a separate drive - the files with the numerical name will save but most of the files that show the original file name within Recuva won't save - comes up with an "Invalid clusters range" message. I find that the only files with the original file name that will save are the few that GetDataBack was able to recover. GetDataBack however didn't recover the various files that Recuva assigned a numeric filename to.

Any suggestions? Thanks.

System is WinXP Pro SP3

post-69516-0-55752600-1400114552_thumb.jpg

2

The files with the numerical names are those that Recuva deep scan has found by reading the file data sector headers and finding a file signature for .avi files. They will be the first extent only of the file, so may not be valid when recovered.

The filenames come from the MFT (filenames are not usually held in the file data). The entry in the MFT will also have the cluster addresses In certain circumstances these cluster addresses can be corrupted, principally in files in excess of 4gb. I've never actually seen that error message: if you are (still) in Advanced mode can you look at the file info panel and report what it says about the cluster addresses?

3

I recently restored a Macrium image backup of a 10 GB partition image to both a 10 GB partition and a 2 GB partition.

(I had my reasons).

All 800 MByte of the "Normal" files were accurately and identically restored to both.

For the 2 GB partition, Macrium shifted all the "Normal" files into the 2 GB partition,

and corrected the MFT records of the sector clusters that hold those files,

but did NOT bother to correct MFT records for the DELETED files

Recuva could detect in the MFT many previously deleted files in both partitions.

Many of those in the 2 GB partition were obviously reported at their original locations outside of the 2 GB boundaries,

and were classified as "Invalid clusters range".

Perhaps your files were in a 1 TB partition on the 1 TB HDD,

and now Recuva perceives this as a smaller partition (e.g. 900 MB),

and it is unable to access the files which are in the last 100 MB.

The solution to that might be a Quick Format to the maximum size of 1 TB,

but that might be inappropriate and could cause further problems.

A screenshot of Windows Disk Management would give a better idea of the situation and of what might be appropriate.