I ran a normal scan of a formatted harddrive, and Recuva found a majority of the files that were on the drive and declared them recoverable. However, a number of these "recoverable" files were listed with a file size of 26 bytes (basically zero). When I told recuva to recover the files, the ones with a file size of 26 bytes recovered as unusable files (as one might expect).
My question is this: will a deep scan improve the chances of finding all of the data for these files and recovering them successfully? Or does a deep scan only improve the chances of finding files, and since these files were found with the normal scan there isn't much more that Recuva can do.
Well, maybe. A normal scan takes the file name, directory, file length and cluster addresses from the MFT record. So it recovers whatever that info specifies. A deep scan first runs a normal scan and then reads each cluster in turn trying to identify valid data by looking for a file signature in the first few bytes. A deep scan will not usually return the file name and directory name as they are held in the MFT. Also a deep scan can't find multiple extents, as only the first extent has a file signature and subsequent extents just look like strings of randomish data. Also text and bat files can't be found with a deep scan as they have no file signature.
So try a deep scan by all means, just don't count on it.
I don't know why some of your files are showing as 26 bytes in size. Sounds like the dreaded cookies.