I'm trying to recover a folder that I accidentally performed a Shift+Del on

Recuva
1

I'm trying to recover a folder that I accidentally performed a Shift+Del on. The operating system is Windows 10 and the folder was located under the Downloads folder under one of the user profiles. The deletion took place on the 23rd of October 2023.

When I perform a deep scan, I do not see the deleted folder under the Download folder at all. I've also tried to do a deep scan on a shadow copy of the drive which it was deleted from, dated the 19th of October, but to no avail.

Am I missing something or is Recuva unable to recover folders which have been Shift+Delete(d)?

2

Recuva does not recover folders per se, but it will reconstruct them during a file recovery if the option is selected.

A deep scan will not reconstruct folders as the folder information is held in the MFT, which a deep scan does not reference.

Reconstructing folders is possible during a normal scan. To add to the confusion a deep scan runs a normal scan first, so during a deep scan you will see some folders that have been reconstructed: the additional files found by the deep scan - those with no file name - will have no 'owning' folder.

I wonder if you actually mean recovering a folder? After all you can just create it with Explorer. Is it files you are trying to recover?

3

Is the drive a HDD or an SSD?

If it is a SSD then it will almost certainly have been automatically TRIM'ed - either straight following the deletion, or sometime since.

Once an SSD TRIM has been carried out then any previously deleted data will no longer be recoverable.

4

Thank you for your advice Augeas and nukecad.

I have selected the File Recovery -> Restore File Structure option and performed a scan again, both on the shadow copy prior to the deletion as well as the entire C: drive. No luck in recovering the deleted folder or any of its contents.

The drive is an SSD.

5
7 hours ago, fadel825 said: 
<div class="ipsQuote_contents ipsClearfix" data-gramm="false">
	<p>
		The drive is an SSD.
	</p>
</div>

In that case I'd assume that the SSD has almost certainly been TRIM'ed, and the data is no longer recoverable.

Sorry, but it's something that we see more often these days as more people have SSDs in their computers.

It's one reason nowadays why it is more important that ever to have your files backed up to an external drive, or in the cloud. 

Having 2 or even 3 backups, to different drives kept in different places, is a good idea to keep your data even safer from accidental loss.

However I would be interested in knowing just what you are meaning when you say that you have a "shadow copy"? 

Do you mean a Windows Restore point?


If not a Windows Restore Point then what software was used to create that 'shadow copy'? Is it saved on your internal drive?, an external drive?, or in the cloud?

Here is a bit more of an explanation of why deleted data cannot be recovered after an SSD TRIM: