After a major mishap with one of my clients, I ended up with a raw image of a formatted HDD with precious emails on it in order to try and recover what I could.
Thankfully, the client's mail backup app saved all the emails in an .zip archive at the root of the drive which, according to Recuva, is in Excellent condition with no overwritten clusters.
However, attempting to recover it, results in... nothing. No discernible disk activity, progress bar stuck at 0% for quite some time now.
What could the problem be? Is there something I'm doing wrong? This file is huge (~28GB) but it appears to have not been fragmented or overwritten during the format and reinstall of Windows which caused the loss in the first place.
hate to burst your bubble, but a 28gig file, that is compressed, AND possibly encrypted by the compression software, AND lived on a drive that has been formatted AND had Windows reinstalled AND lived on the busiest part of a drive - I would rate your recovery chances slim at best.
so the backup was done to the same drive as the original data - they need to be aware that is not a backup, it's called a file copy.
Good luck, hopefully others will chime in with some suggestions.
The file was not encrypted. It was created once the HDD was already almost full. Therefore, after the format and reinstallation of Windows, the file should (theoretically) be untouched.
Here's a screenshot:
This backup file was supposed to be dumped on an external USB HDD once every week, however said HDD had been inoperative for the past few months (obviously).
First of all if you are using Recuva for business purposes you require a licence which will give you support from Piriform.
There's a few misconceptions here. When the disk is formatted around 20 new metafiles will be created. The Master File Table will be one of these, and will most likely be created in the same place as the previous MFT. It will not hold details of any files that existed before the format: they are now in free space and are vulnerable to overwrites.
When Windows is reinstalled many more files will be created and records written in the MFT. These (and the metafile records) will be at the start of the MFT so there is a good chance that the MFT records for the old pre-format files have not been overwritten.
What option did you use to get the list of old files? A normal scan should not produce these files as it looks at the new MFT. Did you check Scan for Non-Deleted Files? I'm not sure how this option works but it probably scans beyond the end of the new shortened MFT looking for remnants of old MFT records with the file signature of FILE.
The state of excellent denotes that no live file has overwritten the data. I would think that Recuva looks in the new MFT to check this (and finds nothing) as any old MFT records are no longer valid.
With a bit of luck these old files can be recovered. Well you probably need a lot of luck with a file this size. It will probably be in many extents and you need all the multiple MFT and Index records to be available and uncorrupted. You say you let Recuva run for quite some time. How long is that? I would try again and leave it to its own devices for a few hours. This is a large file to recover.
