recovered files not readable

[vomkolke]

I used revuca today to recover deleted files from my SSD

 

* I did it immediately (files weren't overwritten)

* recuva finds my files: green button, state: excellent, no overwritten clusters detected (but no preview available (e.g. for PNG-files)) (see attached screenshot)

 

Files are listed correctly in the newly chosen folder. (name, file size, program icon e.g. for WORD etc.), but no file (docx, pptx, mp3, mp4) can be opened .

 

Any advice for me how to make the files readable again?

 

Coco vom Kolke

[Augeas]

What does Recuva show in the header of the file?

 

Do you have TRIM enabled?

[vomkolke]

I have attached the answers to your questions:

 

What does Recuva show in the header of the file?

Do you have TRIM enabled?

 

Greetings and thank you for the fast reply

 

vom Kolke

[Augeas]

Thanks for that Kolke, it is quite rare to get the exact response to our questions.

 

The fsutil command says that TRIM is enabled in the operating system, and TRIM commands are being sent to the device. I shall assume that the SSD is fairly new and accepts TRIM commands. There is another aspect however: if the SSD is external then the drive enclosure controller may not be capable of passing the TRIM command to the SSD.

 

Now to your files. The png file in your image contains zeroes. There is no file signature or anything else. The file clusters can be recovered, but will contain zeroes and will be useless. Possibly this applies to the other files too. Although I am no expert on SSD internals, this is what I think is happening.

 

(Assuming the TRIM command is sent to and executed by the SSD controller)

 

The TRIM command assigns the data pages (clusters) of the deleted file to the invalid page queue.

These pages will, at some time in the future, be collected and erased by the SSD garbage collector routines.

The pages are unmapped from the logical to physical block address table in the SSD.

When a request to read an unmapped page is sent to the SSD by the OS, a default page of zeroes is returned.

 

Although the logical block addresses are still in the MFT, they all point to unmapped blocks in the SSD, and will be presented to the user as zeroes. So unfortunately your deleted files have been lost, for all purposes forever. This is unfortunately the nature of SSD's.

[vomkolke]

OK! "Sad" result, but thanks anyway for your profound explanation of the unfortunately undeniable facts. (seeing the "zeroes" in the header, I've already myself feared the worst!) Modern tech (SSD) has sometimes its detriments.....

 

Thanks for the quick response!

 

vom Kolke