Win 10, version 2004 (20H1), 64 bit. I was editing a file in Notepad and my system hung and i had to do a hard shutdown via an extended power button press. On rebooting File Explorer showed the file that I was editing as a 0 byte file. The good news is that Recuva Pro shows that file's size as 24 KB, Not deleted, No overwritten clusters detected. When I select that file in the Recuva window's left pane the Preview tab says No preview available (it seems to say that for every file I've selected in the Recuva window's left pane). Clicking recover and saving to another drive produces a 0 byte file ?
Anyone have any suggestions on how i can view the 24 KB that Recuva says are allocated to the file?
You'll only get a preview in files that have an embedded thumbnail, and Notepad isn't one of those.
Explorer gets the name and file size etc from the directory MFT record, it doesn't look at the MFT records for all the individual files. Recuva scans the MFT and - at a guess - takes the file size from the file's record. However on a recovery, which is a copy and paste operation, perhaps whatever request Recuva is making to retrieve the file gets the info from the directory, you are after all copying a live file. I don't know how Recuva or NTFS works at that level, I'm just trying to fit the theory to the facts.
You could use HexDen (free portable hex editor) to find the clusters as identified by Recuva, and then copy the contents to a safe place. It's all rather tricky though. I would look at thre header info in Recuva first, as if it isn't what you expect then you may be barking up the wrong tree.