Can't recover files deleted _SECONDS_ ago

[EclipseWebJS]

It seems that if I accidently delete something within seconds of it ending up getting deleted, I try to recover it back, but unfortunately every time I do, I can't find it! I thought Recuva was a"file recovery program", but all it does is just ignore files that just get removed by the operating system and not "securely deleted". I work around with video a lot and sometimes I forget to change something and have to go back, but if the original video gets deleted and Recuva can't recover it back, it'd be useless.

[Augeas]

Recuva does of course find files that have 'just been deleted by the operating system'. Some 20,000 in my case.

 

I'm not sure what you're actually saying. Do you take a copy of your video file and then delete the original, or edit and overwrite the original? If the former, then perhaps holding on to the originals until the new versions are proved would help. If the latter then the file hasn't been deleted and Recuva won't be able to find the old version.

 

Do you delete using the recycler? If so, are you Vista or XP? Deleted files (may) have their names changed using the recycler.

[SuperSport]

It seems that if I accidently delete something within seconds of it ending up getting deleted, I try to recover it back, but unfortunately every time I do, I can't find it! I thought Recuva was a"file recovery program", but all it does is just ignore files that just get removed by the operating system and not "securely deleted". I work around with video a lot and sometimes I forget to change something and have to go back, but if the original video gets deleted and Recuva can't recover it back, it'd be useless.

 

You need to remember that Recuva is exactly that, a 'Recovery Program', not a 'Backup Program'. If you've deleted a video, then continue to work on other videos, the chances that the new video overwrites the old one on the drive are great. Thus the old video will not recover.

 

Recovery programs work best when you run them immediately after deleting the file, so that another file does not have a chance to overwrite the original.

 

In the case of Video work, I'd recommend you 'Backup' each version of your video as you go so that you can restore it at a later time if needed. An easy way would be to 'save as' incremental file names. ie: Video 1, Video 2, Video 3, etc... Then delete the ones not needed when you have a finished product.

[wormal]

Hi, I was trying to recover files from a compact flash card and was able to recover files that I had taken years ago, but strangely the files that I wanted and had only just been deleted were not found. These were photos that were taken on Fuji Finepix s7000, and they were deleted in-camera (perhaps a secure deletion is performed by this camera, does anybody know?). Only 1gb (485 files) were recovered from this 2gb card and nothing was recovered from recent shots, i.e. even stuff that wasn't deleted in-camera but deleted when I moved them across to my computer, only the files that I had taken about 2 years ago were intact. None of this seems to make any sense, I'd be very grateful if I could get some help on this, thank you.

[wormal]

The camera also formats the card in FAT16 and Recuva only seems to search the first gigabyte and ignores the second. Is this is a bug? I gather that my card is not very fragmented because I seemed to be able to recover most files, I understand the limitations of FAT16.

[Guest MrRon]

We will investigate the FAT16 issue.

Thanks

MrRon

[kslice]

Recuva does of course find files that have 'just been deleted by the operating system'. Some 20,000 in my case.

 

and in my case, it JUST recovered some 80,000 files

 

Let me see if I can help to explain how Recuva works:

 

When you save a file, your computer's Hard Disk acts just like a stone slate would. The laser etches an image into the disk that it will later read. It then adds the location of the etched image to a hidden file on the disk that most operating systems will not allow users to see (let's call this the "map" of the hard disk). When a file is deleted, the system simply opens this mapping file, and deletes the location of the image that was previously etched onto the Hard Disk. This saves both time, and the life expectancy of the Hard Disk. As you work with new files, the laser continues to etch new images onto the Hard Disk. If it comes across previous data on the Hard Disk that is not found in the mapping file, it will simply smoothen out the surface of the disk, then re-etch a new image into it, then; of course, add the location of the new image to the mapping file.

 

So you see, if you just delete the mapping file but never force the laser to etch ANY new images to the Hard Disk; then Recuva SHOULD be able to find that etched image. However, the very second the laser starts to re-etch an image into the location of the previous file's image, that file is impossible to recover.

 

When working with LIVE data (such as video or audio streams), the laser is constantly etching new images to the hard disk. Mostly likely, as you were working, the new images were being etched onto the Hard Disk where the old ones used to exist. This makes the old files impossible to recover.

 

This is why; just as 'SuperSport' has stated, Recuva is a "Recovery" program (hence its name) and not a "Backup" program. It can only recover files that exist with no mapping files. It cannot recover files whose image has already been etched over.

[Alan_B]

It seems that if I accidently delete something within seconds of it ending up getting deleted, I try to recover it back, but unfortunately every time I do, I can't find it! I thought Recuva was a"file recovery program", but all it does is just ignore files that just get removed by the operating system and not "securely deleted". I work around with video a lot and sometimes I forget to change something and have to go back, but if the original video gets deleted and Recuva can't recover it back, it'd be useless.

 

This is nothing to do with Recuva. It applies to ANY data recovery utility.

 

I suggest you should NOT put your stuff into the System Partition.

 

Windows is ALWAYS busy and building up fragmentation so it needs to be de-fragmented.

It is likely to have an extra burst of business whenever you delete a file from the system partition.

Every time Windows writes to the system partition, it is likely to hit the sectors which hold deleted _SECONDS_ ago.

 

If you have a partition which the system does not meddle with,

( i.e. excluded from System Restore monitoring, and possible FAT32 rather than NTFS ),

THAT would be a safer place for your video etc.

Sectors holding any accidentally deleted file should not get overwritten by Windows,

but they will still be vulnerable to anything you subsequently write to that partition.

 

Regards

Alan

[loretta80]

I also have the same Problem like EclipseWebJS. I try to explain:

 

System WinXP 32, 3 identical Harddisks in Raid 5 Mode on a Intel ICH 7R Raid contoller with Matrix Storage Contoller Software 8.6.0.1007, NTFS

 

I deleted a .mkv file with 4.37GB (DVD5-Size) which is to big for the recycler bin so you cant find it in it and started immediately Recuva 1.22.384.

 

I used the normal scan first and than deep scan. In both cases the file was not to find. Recuva shows me a lot of files which are more than 1 year old and maximum about 2gb big but not that file.

 

Can it be that the raid software-mode doesn't make it possible for recuva to find files with more than 2gb?

 

Smaller files are shown which are deleted seconds before. I tested to delete a .ac3 file with 282mb. I moved the file to the recycler bin and emptied it.

The file was shown by recuva with normal scan but the file was renamed from movie_name.ac3 to Dd1.ac3. This would make an identification a little bit difficult after a longer time, but this is not the problem here.

If i delete the same (i made a few copies before) file by pressing down shift to bypass the recycler the file is shown in recuva with the correct name.

 

After that test i tested a .mkv file with 2,18 GB (2.347.450.052 Bytes). same result: different name after the recycler, full name when shift is pressed.

 

The next .mkv file with 4,24 GB (4.558.965.472 Bytes) wasn't shown at all after the same procedure.

 

At the moment i dont have files with about 3GB to find the point where recovering stops. Maybe there is a technical explaination which size is possible and which not.

 

By the way: is it possible to show the time of deletion?

 

hasta luego

 

PS: if some sentences are not written correctly please correct me.

 

Oh and to kslice: datas are magnetized to a harddisk. etching is for optical devices like dvds or cds

[kslice]

Oh and to kslice: datas are magnetized to a harddisk. etching is for optical devices like dvds or cds

I'm aware of how data is stored on a hard disk. I was only simply trying to give him a visual representation of how it all works.

 

Also, the file size has nothing to do with trying to find the file. Recuva was able to find files in excess of 7GB for me with no problems. Just know that you don't have to over-write the entire file that was deleted to make it irrecoverable. You only have to over-write 1 byte of the entire file before it is broken and cannot be fully seen by Recuva. Therefor, something as simple as installing Recuva (or even browsing the internet where cookies and cache is stored) could cause the file to be irrecoverable. It's less likely to happen the larger amount of free space you have on the hard disk; however, can still happen. As far as the technical stuff about it being RAID and all...well, I really don't know a thing about that and you should probably wait for somebody who does to reply.

 

Just telling you what I know and hoping it helps!

[csnv]

I'm aware of how data is stored on a hard disk. I was only simply trying to give him a visual representation of how it all works.

 

Also, the file size has nothing to do with trying to find the file. Recuva was able to find files in excess of 7GB for me with no problems. Just know that you don't have to over-write the entire file that was deleted to make it irrecoverable. You only have to over-write 1 byte of the entire file before it is broken and cannot be fully seen by Recuva. Therefor, something as simple as installing Recuva (or even browsing the internet where cookies and cache is stored) could cause the file to be irrecoverable. It's less likely to happen the larger amount of free space you have on the hard disk; however, can still happen. As far as the technical stuff about it being RAID and all...well, I really don't know a thing about that and you should probably wait for somebody who does to reply.

 

Just telling you what I know and hoping it helps!

 

 

you don't understand what he was saying...

 

if you have files added up to be 7GB but none (single file) above 4.2GB then yes, you can recover them without any problems.

 

The problem here is that Recuva (along with 8785624923423423424423422 recovery software out there) recognized those 4.2GB+ files as 0 Bytes.. for some reason and unrecoverable.