Any ideas? Files being overwritten before delete

[wsnmbaker]

Hi Ya'll,

 

While setting up a new laptop computer, I accidentally deleted 5+gb of pictures before assuring that they ALL made it to their new destination. And of course, they hadn't. So after much researching I used Recuva to try to restore these lost files. While reviewing the Recuva's scan results only a very, very few of the files were deemed recoverable & lots of them I could not 'preview'. So, looking closer at the details I noticed it said that a LOT of my files had been overwritten by programs days (few and lots) before the files were accidentallly deleted.

 

Okay, my system is Windows XP NTFS. I run Norton 360 and have not had any viruses corrupt my .jps (that I am aware of). And, as soon as I realized that I shouldn't use the computer if I wanted any chance of recovering the files, I stopped using it.

 

Any ideas of how I not using Recuva correctly? Or, what I should be doing that I am not? Any other thoughts? Please help, these are photos of my only child.

 

Thank you,

Nikki

[wsnmbaker]

More Information from the Recuva scan results:

 

1. The path given for a .jpg is not the expected path. And, then it says that the file was overwritten by another program. But, it previews a legimate picture.

 

2. Indicates that a .jpg file is recoverable but, the image shown in the 'preview' is not the correct picture for the file.

 

Does, it sound like something is out of sync somewhere?

[Augeas]

I assume you are running a normal scan, and at 5 gb+, how many pics are there, 5,000, fewer?

 

There could be many reasons why you are not seeing what you expected, although I would not think that they would apply to all of your files. Do you, or have you, run a defrag? If not then there's always Windows' internal defrag every few days - look at the list in c:/windows.prefetch/layout.ini to see just how many (useless) files are shuffled around the disk.

 

What the preview shows is what the data now is at the location of your file. If the data has been overwritten then you'll see what's overwriting it. You could be seeing a valid live pic - but not for all of your files?

 

How did you delete the files, did you use the recycler? If you did, and then emptied it, then the pics many have been renamed to Dcxxx.jpg, so you could sort Recuva's results by name and then look for that.

 

I would restore what you can to another device, then run a deep scan to see if anything else turns up. It will take some time, but you can't do much else with Recuva, unfortunately.

 

And what does 'Files being overwritten before delete' mean?

[wsnmbaker]

Yep, I guess there's about 5,000 pictures give or take. I don't have an exact count but that sounds about right.

 

And yep, it's been awhile since I've run a manual defrag. And, I've not dared do anything to that computer since this deleteing episode.

 

Preview & 'What does 'Files being overwritten before delete' mean - Some of the few pictures that are recoverable do show the expected picture in the preview pane. But, for one example, for a studio photo that was taken last year it shows, in the preview pane, a picture from our security camera that was taken 2 days 'before' I accidentally deleted the pictures. So.....? The picture should still be there right? It shouldn't have been overwritten by another program with a file that has a datetime stamp prior to my actually deleteing the photo studio file.

 

Ok, how did I delete these files. I don't think I 'actually' did. I had both the new & old laptops on my home network. While on the new laptop I copied (from old) and pasted (to new) the folder the files were in. The Windows copy said that there was '5.5gb' to copy. And, I left the computer to run after my little boy. I came back quite a while later and the windows copy message box was no longer being displayed. So, I assumed it was done and went on copy & pasting other stuff. Now, I did delete 'other' files across the network from my new laptop but, I specifically recall thinking don't delete the "Seth" folder. Well, its gone. My guess is that somewhere in the copy....about early 2008 something went oops and it stopped coping and my files disappeared. Is it possible that there's someplace else in my network that I could find these files?

 

I have been working off the results of a 'deep scan'. And last night, early am actually, I recovered everything I possibly could (and then some) to a thumb drive.

 

I've been working on this for 4 days now and I've about decided that this is all I'm going to get. It's my fault I didn't have a proper backup for these files. And now I'm going to have to live with the result of my inactions.

 

Thank you for all your help.

Nikki

 

 

I assume you are running a normal scan, and at 5 gb+, how many pics are there, 5,000, fewer?

 

There could be many reasons why you are not seeing what you expected, although I would not think that they would apply to all of your files. Do you, or have you, run a defrag? If not then there's always Windows' internal defrag every few days - look at the list in c:/windows.prefetch/layout.ini to see just how many (useless) files are shuffled around the disk.

 

What the preview shows is what the data now is at the location of your file. If the data has been overwritten then you'll see what's overwriting it. You could be seeing a valid live pic - but not for all of your files?

 

How did you delete the files, did you use the recycler? If you did, and then emptied it, then the pics many have been renamed to Dcxxx.jpg, so you could sort Recuva's results by name and then look for that.

 

I would restore what you can to another device, then run a deep scan to see if anything else turns up. It will take some time, but you can't do much else with Recuva, unfortunately.

 

And what does 'Files being overwritten before delete' mean?

[Osamao]

as i know, once the files were overwritten, it cannot be recovered, you may try more software first, if the software still cannot find it, you may turn to some data recovery specialists for help.

 

Be noted that do not do any change to the drive any more,leave the drive alone, you may have more chance to get data back.

[wsnmbaker]

Thanks. And, I've completely stopped using that drive in hopes that ..... well.....hope.

 

 

as i know, once the files were overwritten, it cannot be recovered, you may try more software first, if the software still cannot find it, you may turn to some data recovery specialists for help.

 

Be noted that do not do any change to the drive any more,leave the drive alone, you may have more chance to get data back.

[DennisD]

Hi Nikki.

 

Really sorry to hear of your predicament.

 

This may not make any difference, but if you haven't tried this already, go into Recuva's Options and under the General tab, in the "View Mode" window select "Tree View".

 

Now under the "Actions" tab, tick the "Restore Folder Structure" box.

 

This will give you a view which will enable you, using the "+" boxes, to navigate to the folder/s you had the files stored in, instead of a list of every file Recuva pops up.

 

If this gives you any better success, try recovering a few files at a time.

 

This is based upon my experience a while back with a lot of accidentally deleted music albums.

 

http://forum.piriform.com/index.php?showtopic=23991

 

As I say it may not be of any help, but if you haven't tried it, give it a go.