What types of deletions count as 'deletions'?

Hello,

I've used Recuva a few times and love it, however the question has been brought to my attention: What types of deletions count as actual deletions?

If a system process removes a file, will Recuva be able to see that and mark it as restorable or not? In a nutshell, I'm trying to use Recuva to figure out if a user deleted a file, or if the deletion was system generated. Would Recuva see files deleted in both ways with the same result? Would there be any indication that a file was deleted by system rather than a user?

Thanks!

An actual deletion is when the entry for the file in the MFT has the delete flag set, and the file's data clusters are made available for reuse (that's NTFS, FAT is different).

There is no indication of how, or by whom, any file has been deleted - in general.

If CC has run normal file deletion then it is the same as a shift/del.

If CC has securely deleted a file it will be renamed and overwritten with zeroes.

If a file has been sent to the recycler and then deleted the path of the file will be the recycler path, and the file may be renamed.

I don't know what CC does when it is run against the recycler as I've never used this facility.

Recuva will see all these files in the same way (if they have not subsequently been overwritten) but recovering a file full of zeroes is obviously not as gratifying as recovering user data.

Cool thanks for the info. Basically, we've got a user that claims that nothing was deleted, but files 'vanished'. I'm trying to figure out if they were deleted by the user or by the system, and I'm having a hard time figuring out if system deleted files appear with an MFT entry just as normally deleted files do.

Basically, will Recuva see files deleted by the system as they would by a user?

That was indeed what I was trying to say.

Okay thanks!