Questions about recovering files from an External HDD

Recuva
1

Hello,

Several days ago the majority of my important files that I back-up to an External HDD on a daily basis were accidentally deleted. I have verified that most (if not all) can be recovered using Recuva Pro. However, when attempting to recover my files after performing a scan, the recovery process froze after 4% of my files had been recovered. I can only assume this was because I was actively using/working on the same computer that was running Recuva. I understand this is discouraged, but for one, I am not trying to recover files off of my local machine, and for two, I'm mostly active and working on a remote server that I am connected to via Windows Remote Desktop Connection. I am going to go ahead and perform another recovery attempt to see if it freezes again. However, I have some questions I'd like to ask the community in advance.

1) Due to the fact the deleted files were on an External HDD and I have since stopped using this External HDD (I have not written any new files to the drive, nor have I even read/opened any of the remaining files), I feel I'm safe even though several days have passed since the files were accidentally deleted. I'm wondering if there is any situation and/or risk that would make the files harder to recover?

2) Right now, I have the External HDD plugged into one of my USB ports but as previously stated, nothing is being read from or written to the drive. Does this pose any threat/risk to any future recovery attempts?

3) Ever since the files were accidentally deleted, I have safely removed/ejected the External HDD from my computer (I have since reinserted it into my computer), and I also inserted and safely removed it from an HP laptop and an HP All-in-One PC). Does inserting and safely removing the drive into any computer/device pose any threat/risk to any future recovery attempts?

4) I'm planning on running a Deep Scan when I make my next recovery attempt, even though a regular scan seemed to recover a decent portion of the files. My logic is based on being able to increase my chances of recovering as many files as possible. My logic also includes the fact that I cannot remember every single file that has been deleted (there were a lot). Does it make any sense to do this or should a Deep Scan only be performed in the event that all of the deleted files were not recovered?

5) Does executing multiple recovery attempts pose any threat/risk to any future recovery attempts?

Those are all the questions I have for now, and hopefully forever. I feel it's worth noting that this is my first time trying to perform any type of file recovery process. Right after this happened, I read over the Recuva Documentation, however not only am I a very thorough person, more so these files are very important to me.

Thank you to all of you who have taken the time to open and read my thread. I am definitely open to (and I welcome) any suggestions and/or possible instances of going about the recovery process a different/better way.

Cheers.

P.S. I have attached a summary image from Speccy displaying the specs of the computer I attempted the initial recovery on, and this will be the same machine in which I'll be using when attempting the second recovery as well.

PC_Specs.png

2

1) Is this disk included in Windows' regular defrags? I don't know if usb connected devices are included but it's worth checking. Plus things I can't think of or don't know about.

2) I think that it's safe to say that a device withour power or means of access will be safe from modification, except by Martian death rays. If it is connected then it could be modified. I'm not saying that it will be, but nobody can say for sure that it won't.

3) More or less the same answer as 2. Not as far as I know. Maybe there is some error checking done or logs written somewhere.

4) A normal scan is very fast and reads the MFT, not the disk. A deep scan takes far longer and reads each unallocated cluster. It is advantageous if you can recover your files from a normal scan, they will be complete and up to date, one hopes. A deep scan does not retrieve file names or secondary extents, only selects a small range of file types, and does not differentiate between files days or years old. And takes ages to run.

5) A recovery - as long as you are recovering to a different device - should not harm the files nor degrade any future recovery attempts. It is a read process.

3
6 hours ago, Augeas said: 
<div class="ipsQuote_contents">
	<p>
		1) Is this disk included in Windows' regular defrags? I don't know if usb connected devices are included but it's worth checking. Plus things I can't think of or don't know about.
	</p>

	<p>
		2) I think that it's safe to say that a device withour power or means of access will be safe from modification, except by Martian death rays. If it is connected then it could be modified. I'm not saying that it will be, but nobody can say for sure that it won't.
	</p>

	<p>
		3) More or less the same answer as 2. Not as far as I know. Maybe there is some error checking done or logs written somewhere.
	</p>

	<p>
		4) A normal scan is very fast and reads the MFT, not the disk. A deep scan takes far longer and reads each unallocated cluster. It is advantageous if you can recover your files from a normal scan, they will be complete and up to date, one hopes. A deep scan does not retrieve file names or secondary extents, only selects a small range of file types, and does not differentiate between files days or years old. And takes ages to run.
	</p>

	<p>
		5) A recovery - as long as you are recovering to a different device - should not harm the files nor degrade any future recovery attempts. It is a read process.
	</p>
</div>

Thank you so much for your reply. Unfortunately, this drive is included in Windows' regular defrags and the last time it was defragmented was on April 12. Needless to say, this was AFTER the files/data had been deleted. I'm guessing this is bad, right? <_<

Well, I guess the only thing I can do now is try to run a regular scan, hope Recuva doesn't freeze up on me again, and most importantly, hope that any defragmentation didn't cause any permanent file/data loss. I'll post back to the thread with my results once they are available.

Once again, thank you very much for your response. I really appreciate it.

Cheers.

4

A defrag is bad news. As you know only too well it will utilise any free space it requires to create unfragmented files, and that free space includes the files that were deleted. So a percentage of the deleted files could well be overwritten. A normal scan may find evidence of the deleted files, as their records will still be in the MFT, but the clusters they previously used will quite possibly be overwritten.

5
8 hours ago, Augeas said: 
<div class="ipsQuote_contents">
	<p>
		A defrag is bad news. As you know only too well it will utilise any free space it requires to create unfragmented files, and that free space includes the files that were deleted. So a percentage of the deleted files could well be overwritten. A normal scan may find evidence of the deleted files, as their records will still be in the MFT, but the clusters they previously used will quite possibly be overwritten.
	</p>
</div>

Thank you once more for the information you have provided. I can't believe I didn't think this was a possibility. However, I'll see what I can recover and if it's really that bad, I'll worry about it then. Once again, I'll update this thread once I'm finished. I've since safely removed my External HDD from its USB port and its not going to be plugged back in until it's time to launch another recovery effort which will either be here in about 30 minutes, or tomorrow morning.

Thanks again.

6

Hello all,

Well, I performed the recovery process for a second time this morning and surprisingly I was able to recover most of my previously deleted files/data (I would say over 90%). I am very excited and I would just like to say Recuva is a wonderful program! The files/data I was not able to recover had already been overwritten, most likely from the defrag that occurred a few days prior. However, as I said, the amount of unrecoverable files/data was minuscule compared to what I had feared.

I used the Recuva Startup Wizard, I selected "All Files" for the 'file type' that I was trying to recover, and I recovered them directly from my External HDD (where the files/data had accidentally been deleted) so therefore I did not create a Virtual Hard Disk (although I would have if my primary drive had enough free space). Thankfully I was able to select the exact location/directory path from where the files/data had been deleted. Lastly, I did not run a Deep Scan but I was still able to recover more than I had imagined. Oh, and also, I recovered the files to a different drive (my primary drive) other than the one that once held the lost files/data (my External HDD) upon the suggestion of Recuva. I own and use the Professional Edition/version of Recuva.

If anyone has any questions, please feel free to ask and I will answer them to the best of my ability.

@Augeas Thank you once again for taking the time to read my posts and answer all of my questions.

If anyone is experiencing a situation similar to the one I had recently found myself in, I suggest you download Recuva and recover your files/data as soon as possible!

Take care everyone. :)