Jump to content

Filtering the 'deleted files' list


Recommended Posts

First use of Recuva (1.42.544) - pretty straightforward, nice simple interface.


Friend of mine, not PC-savvy laptop user, had a bit of trouble when a Windows Update failed in some way (he remembered no details). On restart he was presented with a confusing screen and he latched on to the word "recovery" as being a safe haven and press the F11 key expecting normal service to be resumed.


Instead, what happened was that his machine was restored to factory condition by the automatic system restore "service" built into the laptop. At which point he knew he was really in trouble.


I installed Recuva onto one of my boxes and pulled his 320GB drive (he hadn't tried much/anything after his misfortune had been converted to full-on disaster) from the laptop and connected the drive for Recuva to have a look at. Set the thing to run a deep scan and went out for a game of squash.


Some time later I had a look at the machine. Didn't have a good time estimate - it had initially been quoting 60+ minutes, but I didn't really care, since I wasn't planning on sitting there. The scan had found appr 1.8 million files.


My objectives were:

1. try to get a good fix (the names, dates, sizes) on all the user-significant files that were deleted

2. try to get as many user-significant files undeleted as possible.

3. rebuild the machine into his 'usual' desktop and app specification.

4. load back any/all recovered material


Before acquiring the laptop, he was using a desktop machine - which is still in service. Many of his files were copied from that machine. The results from (1) above would allow him to see which of the irrecoverable files were actually still available to him from the old machine. Also that same list could focus his attention on which files he would urgently need to 'regenerate'.


When I went to use the "Save List to Text file" pop-up option I discovered a couple of surprises. First was that the format/content of the generated text file did not match the on-screen display. Most particularly the "State" info seemed to be absent. The second surprise was that the generated file did not reflect the current 'filter' (at one point I set a filter of "*.odt") ... came out at 102MB. I had hoped to prepare several listings, so that he could focus on text documents (.odt, .doc etc) separately from images and so on. This needed to be doable 'offline' since it was all going to happen 'after the event' - i.e. I would salvage whatever I could and proceed with the rebuild, and he would do the debris sorting after that.


Equally, the Recover button does not seem to be limited to the current filter. For example, a ticked selection is made from a *.odt start point and the chosen items written to a folder. Then the filter is changed to *.doc and another subset of that is ticked. The Recover button then writes all of the selected .doc files PLUS all of the previously selected .odt files. Not quite what I would have expected.


While typing the filter text, there were considerable delays between each character. The filter is clearly trying to operate in "real time", dynamically filtering the display as each character is typed. With 1.8 million items in the start list, this was painful delay. Might be preferable to suppress this feature or at least make it an option.


Extensions to the filter would also be very helpful. For example, to filter in/out based on "State", "Date", "Size" would be very handy. If I were looking for movies, I might also want to exclude anything less than 200MB. OK, I guess the list could be sorted by size, but how could I then reset to the originally-presented sort order? Same thing with applying ticks - I'm only going to attempt to recover items with State of 'Excellent', and maybe size > 1KB or 2KB depending on the doc type.


Trying to get a handle on the general state of things when working with a list of >1million items is inevitably time-consuming. Maybe it is unrealistic to get it done in one session. It might be handy to be able to shut down Recuva and resume at a later time without having to run a re-scan of the problem drive. In that scenario a 'save session', 'restore session' option would be of benefit.


So, in summary, my suggestions are:

1. Allow more complex filtering to assist those with "disaster recovery" tasks (i.e. whole disc recovery) - State, Size, Date as filter basis

2. (Optionally) allow on-keypress filtering to be suppressed, and trigger filtered by Enter or Go button

3. (Optionally) allow the exported text file to reflect the current filter (ideally, note the current filter details at the head of the export list) - and possibly also the Recover action could be filter-limited

4. Include the "State" assessment in the exported row data.

5. Introduce a "Save Session", "Restore Session" capability to allow recovery work to be attacked in chunks, without having to re-scan what might be a terminal (i.e. almost dead) hard drive.


Finally - and feel free to ignore all the above - thanks for this free of charge program which has already done a great job.

Link to comment
Share on other sites

  • Moderators

1) Yes, would be a help

2) This was implemented in the previous version of Recuva, but seems to have reverted, or been forgotten, in the current release.

3) The text file reflects the entire scan. no matter what filters have been selected

4) OK

5) Hmmm, so-so, The problem is that the state of the disk, orthe files on the disk, may well have changed since the last scan, so a restore session could cause a great deal of confusion.


One other point from your post, if you check a selection from say .doc files and recover them, and then check a selection from .txt files and try to recover those, you will find (as you have found) that you'll be recovering both selections. The trick is to uncheck the previous selection before moving on to the next. You should be able to do this by checking the 'master' box at the column heading on and off.


As you are trying to recover live files that have been made inaccessible, you could try a normal scan with Scan for Non-deleted Files checked. It'll be far faster than a deep scan, and produce - I hope - a more manageable and representative selection of files.

Link to comment
Share on other sites

  • 3 weeks later...

Sounds pretty good, Augeas...


Question. If he does a scan for only non-deleted files, would that even include the files he lost? I know they are not "deleted" so far as by the user in Windows, but would it count as a deletion to the recovery program being that his system ran the factory reinstall & "removed/deleted" all files?


I know it did a quick format probably, but would that affect whether a file is counted as a "deleted" file?


I ask not just for the sake of the user above, but for my own knowledge in future endeavors.

Link to comment
Share on other sites

  • Moderators

I can only guess how the scan for non-deleted files works on a formatted disk, and that guess is that a quick format would recreate the MFT in the same location as the old one. At that point only system files are allocated, and they occupy the first 32 or so entries in the MFT. The existing user records are untouched, and I guess the allocated space for the MFT does not include this part of the old MFT. So Recuva could read the clusters following the sys file entries and select every 1k chunk that has a file signature of FILE0. And then stop.


As with any recovery attempt, the least that's done to the disk the better are the chances of recovery.


I believe that in Win7 a full format will overwrite the disk with zeroes, so then all recovery chances are out of the window. A Win7 quick format, and an XP/Vista format, leaves the data on the disk, with more chance of recovering data.


As for the factory reinstall above, any software reinstalls will lessen the chance of recovery due to the possibility of data overwrites.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.