I have run across an issue with Recuva that I can not explain. I am trying to perform a secure overwrite of the file with Recuva. It appears that the file has reverted back to a prior state after approximately 22 hours.
I performed the following steps:
1) Performed a scan at 10-24-11, 1:01:42 PM (State shows as Excellent)
2) Performed a Secure Overwrite Highlighted at 10-24-11, 1:02:29 PM (State shows as Unrecoverable)
3) Performed a scan at 10-25-11, 11:23:22 AM (State shows as Excellent)
The Filename, path, Last Modified Date, size are the same for all three steps.
Can you please provide a solution to my issue.
If you need any additional information, please let me know
I assume you mean that the reported state reverts back to recoverable, and you're not saying that the file data has miraculously recovered from an overwrite.
I find that the file state - as reported by Recuva - is not a definitive classification, and it does indeed change occasionally. I don't know how Recuva tests a file for recoverability, possibly by some combination of are the clusters overwritten by another file in whole or part, does it have a valid file signature, etc. Recuva doesn't keep a list of files it has overwritten, so has to analyse each file in each run. A cluster full of zeroes, or random data, is as valid a file as any other collection of data, so Recuva makes the best guess it can.
The use of the word unrecoverable is perhaps confusing: all data clusters can be 'recovered', that is copied to some other medium, whatever their state. Some clusters contain what you want to see, and some contain what you don't. You can look at the file header using Recuva (Advanced Mode, Header) and see what's in it. It should either contain zeroes (if you have selected simple overwrite) or the data from another file that has used the deleted clusters.