How to scan only within a (Deleted) Folder instead of entire Drive

Recuva
1

Please excuse the ignorance of a frustrated newb in advance.

If I know what the path WAS to a given folder, then I thought that I could:

type that path in the upper box::

F:\Users\myUserName\myDeletedFolder\*.*

set the drive letter in the left box:: F:

and hit SCAN

to recover files that were recently deleted from that folder, and hopefully the folder also. Despite the redbox/white X icon on the right box when I typed a path, I tried a scan. However, it appeared to be scanning the entire hard drive ~250GB HDD (a laptop drive, but moved to be an external HDD using an adapter). After several hours, the scan was still at 0% and had ignored over 17,220 files.

So I aborted that scan to try to narrow the focus.

Please help! How can I define the path to a deleted folder?

Note: The folder does not show on the GUI dropdown on the left...I deleted the folder and contents (and many others) after I thought I had copied them onto another drive. But alas. not. The folder structure was, however, copied to another drive.

Thank you :~)

2

Whatever you select or type in the Filename/Path box Recuva will always do a full scan. It has to do this to recover all versions of the file selected, which may be held in any physical location on the disk.

Were you doing a deep scan? Several hours for 17k files is a long time.

I usually enter just the folder name in the Filename/Path box, such as \prefetch. The \ is required, but the folder name can be shortened as long as it's unique.

3

Thanks @Augeas!

Yes, that was a deep scan that I aborted after several hours at 0% progress.

I did a regular scan of F: that took ~4.4 hours, found 186 files, and ignored 645,359 (222GB, cluster size 4096, file record size 1024).

I have recovered some items using a regular scan. Unfortunately, in my tired&frustrated state, I failed to adequately examine the list of file extensions that would be snagged by the scan. Please confirm::

  • Must I rescan to recover even webpage (*.html,...), graphics (*.hip, *.bgeo, *.obj...), and system ( *.sys, *.bat, *.dll, ...) files (even though I marked to search for hidden files under OPTIONS)?

OR

  • Did RECUVA index the files in a way that will respond/filter the current scan if I change the extension lists in the box? I'm just learning about the existence, in some hidden, mysterious place, of Master File Tables, and am ignorant about indexes..so please alert me if I'm doing things the hard&slow way.

  • To get these files, is a deep scan required?
  • Will a deep scan for *.* this include ALL (recoverable) hidden and system files (assuming the show hidden files option is also checked) ?

What is the redbox/whiteX icon on the right box intended to indicate? Is it just there for decoration (static)? Does the X icon indicate that I'm trying to do something that is not compatible with RECUVA standard operating procedure?

May I insert additional extensions in this (upper righthand pulldown box)? Remove extensions?

OR, must I edit the .ini file to add or narrow extensions in existing categories?

e.g., Add to category COMPRESSED: *.raw, *. tgz, *.tar,

Must I edit the ini file to include additional categories with extensions?

e.g., categories

3D_DEV: *.hip, *.hip*, *.geo, *.bgeo, *.*geo*, *.skp, *.skb, *.skm, *.sk*,

ENCRYPTED: *.mht, ...

WEB: .style, .xsd, .strings, .db, .so, .def, .php, .inc, .htaccess, .htpassword, .rb*, rbd, .sql, .xpt, .css, .rdf, .js, .xul, .html, .xml,

SYSTEM, *.SH, *.sys, *.a ...

SUGGESTION: It would be very helpful, at least for new users, to be able to look at the whole list of file extensions at the same time, with the ability to select by category, by single extension, and to ADD extensions to the list (and have that saved for future use). My (possibly Hg-amalgam-impacted?) memory does not deal well with scrolling in a very small window through sublists of extensions. I suspect I'm not the only one.

TIMING

I'm trying to get some feel for normal RECUVA function. Is there a 'typical' time range for a:

...regular scan (of the entire, 222GB drive) for files associated with a folder?

...deep scan (of the entire, 222GB drive) for files associated with a folder?

...deep scan (of the entire, 222GB drive) for everything, *.*?

Do subsequent scans (of the same depth) speed up?

Thanks again!

4

When Recuva does a normal scan it scans the Master File Table (MFT). If no search criteria are entered, the results are x files found, and y files ignored. X is the deleted files from the MFT, and Y is the live files. If you enter some search criteria the files that don't match are added to the ignored total. So in your normal scan of F the MFT contained a total of 645,369 + 186 files, live and deleted. If you remove the search criteria, without doing another scan, the results should change so that x and y reflect the total deleted and live files found.

A deep scan will do the normal scan first, and then carry on looking at each cluster to identify a file signature. If a valid sig is found then the file is added to the x list. You will always have a file ignored count unless you check the Scan for Non-Deleted Files box.

You can change the search criteria as you wish without rescanning. You can speed up scans by cancelling stage 2. I have never found this to be a hindrance.

There's nothing special about system files and normal/deep scan. If they're in the MFT a normal scan will find them, and if they can be identified with a deep scan, it will find them also. As for what file extensions are found, have a read of http://forum.pirifor...showtopic=39016

A deep scan will not find bat or txt files, as they have no file signature, or any file without a file sig.

The red x is just to clear the Filename/Path box, it's quite harmless. You can put whatever you like in this box.

A normal scan on my 160 gb drive takes around 8 secs if I cancel stage 2, and a 221 gb disk around 12 secs, plus a little sort time. I hardly ever run a deep scan but I think it takes around 45 mins on the 160 gb disk. 4.5 hours on a normal scan is not er, normal, even though you have around 5 times as many files as I have. Perhaps - in future - you're in need of a disk defrag.

What else? You can't add extensions to the ini file, that just keeps the display and search settings.

5

@Augeas: Thanks again - your descriptions are very helpful :~)

C:~<F: SAGA IF YOU WANNA KNOW (maybe someone else will avoid my mistakes):

It is possible that my Master File Table (MFT) has become fragmented.

During extended travel (without my external HDD), I ...acquired a lot of data. I was down to 20% free, and had scheduled myself to move massive amounts off of my laptop C: ...very soon...make enough space to set restore points and defrag. However, last week I made the hopefully not fatal mistake of failing to limit the sync before sharing a DropBox with someone...who saved who knows how many videos in the Box - and my C:. So then I couldn't boot, first getting "ACLs are not proper" error messages - with no mention of disk space. I had just verified 20% free a few days before, so I muddled around and finally recognized that free space was suddenly <10%, and likely the core issue. Since I couldn't boot, I had already attached the laptop drive through an adapter to a friend's PC while I tried to figure out what to do about the ACLs. Explorer would hang/crash trying to even display files. So I started looking using TreeSize Free. Unfortunately, I attempted to delete some files using Explorer. Then, in order to avoid moving files around on the already very full F:, I decided to use command line xcopy. It's been a very long time since I did DOS, and so I googled and used some random reference. The unfortunate guidance I referenced indicated that the xcopy /l switch was used to list the copy process in the log. So I used /l. Then I looked at the destination, and the folders I had xcopied were there on E:. So I began deleting files and folders from F: ...then had a near stroke when I recognized that all the folders I had xcopied onto E: were ...empty. :wacko:

So I did some remedial searching and began a more methodical process of testing my script, including testing on small folders verifying the files were copied to E. Time has passed :( ... I now have a set of Robocopy *.bat files that DO copy AND log.

(I work with a lot of this data on a day to day basis, so am in the process of copying all to E (1TB), re-organizing to a more streamlined laptop drive with additional data maintained on an external E:. I didn't want to archive or mirror my over-full dysfunctional source drive. I recognize the need to get another external drive and then Mirror the reorganized C/F and E drives.

So I'm learning a lot. The hard way mostly. Suggestions for easier learning paths are welcome.

I'm looking into:

  • disk space issues - including how much should be reserved for MFT to prevent overwriting MFT with data...
  • file signatures - Link(s) to a list of file types that lack signatures would be much appreciated. "A deep scan will not find bat or txt files, as they have no file signature, or any file without a file sig." I wonder how many more files are abandoned?

The file ignored count I get. I'm just surpised to not find more deleted files - especially suprised at how few from the $Recycle.Bin were found. Will the files that are emptied out of the $Recycle.Bin still be associated with it (by the MFT, and by Recuva)?

"You can change the search criteria as you wish without rescanning." NICE - I'll try this!

"You can speed up scans by cancelling stage 2. I have never found this to be a hindrance." ...and this!

"There's nothing special about system files and normal/deep scan. If they're in the MFT a normal scan will find them, and if they can be identified with a deep scan, it will find them also. As for what file extensions are found, have a read of http://forum.pirifor...showtopic=39016." Will look when the storm passes & web connection returns.

"The red x is just to clear the Filename/Path box, it's quite harmless. You can put whatever you like in this box." Wonderful! Maybe a screen tip added to a future version would be helpful for other newbs?

"A normal scan on my 160 gb drive takes around 8 secs if I cancel stage 2, and a 221 gb disk around 12 secs, plus a little sort time. I hardly ever run a deep scan but I think it takes around 45 mins on the 160 gb disk. 4.5 hours on a normal scan is not er, normal, even though you have around 5 times as many files as I have." Dang! Good to know.

"Perhaps - in future - you're in need of a disk defrag." SERIOUSLY. I was working my way towards doing that then took 3 giant leaps backward (DropBox sync + xcopy /l + command line del ...).

"What else? You can't add extensions to the ini file, that just keeps the display and search settings." Oh. I read " You can modify these settings by setting Recuva to create an external INI file and editing it" on http://www.piriform.com/docs/recuva/advanced-usage/advanced-usage-scripting-with-recuvas-ini-file , and thought I might need to go down this path to use alternate extensions. I just looked at a copy of the recuva.ini ... clearly no file extension definitions therein.

Best regards.

6

@Augeas

I took a look at your link http://forum.pirifor...showtopic=39016, in which you clarify "in a Normal scan Recuva will find any and all file names held in the MFT. In a Deep scan Recuva will use a predetermined list of file signatures (I think there's a command to list these, someone else will know and hopefully pipe up)." Please confirm that 'signatures' as opposed to 'extensions' are used in the Deep scan.

If so, then how do I access this list of signatures?

The piriform list of file extensions, from Using Recuva / Wizard Mode /Specifying file types

When you're using Recuva's Wizard mode, you can tell it to search for a type of file, or all files. Here are the file extensions Recuva uses for each selection:

Pictures
- .JPG, PNG, .RAW, .GIF, .JPEG, .BMP

Music
- .MP3, .WMA, .OGG, .WAV, .AAC, .M4A

Documents
- .DOC, .XLS, .PPT, .ODT, .ODS, .PDF, .DOCX, .XLSX, .PPTX

Video
- .AVI, .MOV, .MPG, .MP4, .FLV, .WMV

Compressed
- .ZIP, .7Z, .RAR, .BZIP2, .GZIP, .TAR, .WIM, .XZ

Emails
-
deleted emails
from Thunderbird, Outlook Express, or Windows Mail.

If you select
Other
, Recuva searches for all types of files (*.*).

Note
: You can search for compressed files (.ZIP, for example), but you must do so in
Advanced mode
.

Once you've specified file types, click
Next
to
specify file locations
.

Best,

7

This still relates to the main question: I'm querying the scan for various extensions, using the filename box. Mostly I get nada. However, it's the behaviour when I find something that i find puzzling. I select a portion of the items that show in the left folder pane, and choose a place on E to recover to - but everything that shows in the left pane is copied to that E location. Not just the items checked. I'm trying to achieve a semblance of order. But having multiple copies of files on E is compounding confusion.

What am I doing wrong?

Thanks.

8

File signatures are not the same as file extensions. Have a look at http://filesignatures.net/

Recuva searches for file signatures, it would be foolish to search for file extensions. For example the file sig for the file extension doc is x'D0CF11E0A1B11AE1', whilst the ascii for .DOC is x'2E444F43'.

I don't know of a way to extract the list of sigs that Recuva uses.

I haven't experienced the behaviour described in your last post. Just make sure that you have unchecked your previous selection before moving on to a new selection, as the old 'checks' still apply.

9

Whatever was happening before - to copy what looked unchecked (to me), is not happening now. Thankfully.