Need Assistance Please ...

Recuva
1

Greetings,

I downloaded and installed the Recuva application today and I would like to get some advice if possible. After installing the Recuva software, I intentionally deleted two files into my Windows 7(X86) recycle bin and I emptied the recycle bin. However, I am unable to see or recover either file after performing the default Recuva recovery scan. With this in mind, I'm hoping someone can explain why my testing failed? Lastly, I have a big red X in the Filename or path field whenever I attempt to change the field using the default options (Pictures - Music - Documents - Etc.) What does this red X indicate? What am I missing? Thanks in Advance ... Dave

File Names:

Wallpaper - W001.jpg (60.1KB)

Pink Floyd - Us and Them.mp3 (10.8MB)

2

welcome.gifDave

Try rtclk and select View Mode > List View, click Last Modified heading once or twice to set the most recent deletes at the column top to search for your deleted files, then work from there.

If you click on the red X you will be taken back to the initial results of your scan, which is everything.

PS - You can speed up the results by canceling at the beginning of Stage 2 analysis.

3

rtclk

right click

4

welcome.gifDave

Try rtclk and select View Mode > List View, click Last Modified heading once or twice to set the most recent deletes at the column top to search for your deleted files, then work from there.

If you click on the red X you will be taken back to the initial results of your scan, which is everything.

PS - You can speed up the results by canceling at the beginning of Stage 2 analysis.

Thanks for the courteous feedback Kroozer!

Sheeez ... It's a good thing I didn't delete anything important! Ha Ha

Well I tried your advice and here's the status:

1. I deleted the following two files from my Windows 7 desktop at hh:mm

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.jpg

ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ.mp3

2. I emptied the Windows 7 trash can at hh:mm

3. I discovered the two files were recovered and renamed as follows:

$I9S7KA3.jpg Size:544 Bytes State:Excellent

$I4Y2MD2.mp3 Size:544 Bytes State:Excellent

4. I recovered the two files to my desktop and to a USB flash drive.

5. In both cases, the files were recovered successfully ... but both files are corrupted as follows:

Windows Photo Viewer can't open this picture because the file appears to be damaged, corrupted, or too large!

Windows Media Player encountered a problem while playing the file!

Note: There was NO disk activity between the delete and recovery process.

Oh well ... The results of this simple test are rather unsettling.

Am I missing something? Is my testing method flawed? Can anyone offer some advice on why this test failed?

Thanks once again ... Dave

5

When a file is sent to the recycler it is renamed to $Rsomething and an index component created called $Isomethimng. You're recovering the index components, as the size indicates. These will not produce any pic or video.

If you can't find the $R equivalent of your files then the entries for them in the MFT have been overwritten and recovery will be more difficult, if not impossible. Whilst we don't know what your pc is doing it is very likely that there is disk activity between the deletion and recovery operations. MFT updates, $I file creation, logfiles written, prefetch updates, volume checkpointing etc.