New Recuva user, what am I doing wrong?

[bru20]

I have had several Piriform programs for many years but today I finally installed Recuva.
 

So what am I doing wrong?

 

I deleted a video file from a microSD card while it was connected to my computer and immediately tried to recover it and Recuva  said it was "unrecoverable".  I literally did nothing else but open Recuva after it was deleted.  It shows it was overwritten by a file that hasn't been on the card for months.
 

I did go to advanced and tried to recover it and after 10 minutes it said it was "partly recovered" but the video will not open or play in WMP.

 

I also tried to recover items I deleted from the Recycle Bin (which I imagine is pretty common) and it said most were unrecoverable.

 

Would this happen with the Pro version? 

 

edit:  I just did another test.  Deleted a video file from the microSD card.  Immediately opened Recuva.  It classified it's state as "poor".  I recovered it to my computer and WMP could not open it.  It was a corrupted/useless file.

 

Seems like this program won't work for the very things it would be needed.

[Augeas]

Recovery in the pro version is the same as the free version.

 

As far as I can interpret, a state of poor means that some clusters have been overwritten, and unrecoverable means that all have been overwritten. And excellent none.

 

I would think that the card is formatted as FAT32, or some similar variant. In FAT file systems every cluster has an entry in the File Allocation Table and clusters for a particular file are linked in a chain to identify where the file is on the storage device. On file deletion there is some rearranging of the cluster chains in the FAT. (I'm no FAT expert, but there is a lot of info available if you want to spend many hours figuring out what happens.) On a larger file there is the likelihood that the file is fragmented with a greater chance of the cluster chains becoming corrupted on file deletion.

 

I've just copied a 500 mb video file to an almost empty flash drive. It took up one extent and played fine. I then deleted it, opened Recuva and scanned the drive. The file was unrecoverable, every cluster was overwritten by an older file. I believe this is caused by the FAT cluster chain being updated by the file system. The file data hasn't been overwritten but the entry in the FAT now points to the other file's data.

 

Possibly I could run a deep scan and find the deleted file in one extent. You could try this too, but it will only be valid if your file is in one extent (deep scan can't find secondary extents). Recuva Advanced mode Info will tell you if the file is in more than one extent.

[bru20]

Recovery in the pro version is the same as the free version.

 

As far as I can interpret, a state of poor means that some clusters have been overwritten, and unrecoverable means that all have been overwritten. And excellent none.

 

I would think that the card is formatted as FAT32, or some similar variant. In FAT file systems every cluster has an entry in the File Allocation Table and clusters for a particular file are linked in a chain to identify where the file is on the storage device. On file deletion there is some rearranging of the cluster chains in the FAT. (I'm no FAT expert, but there is a lot of info available if you want to spend many hours figuring out what happens.) On a larger file there is the likelihood that the file is fragmented with a greater chance of the cluster chains becoming corrupted on file deletion.

 

 

OK I can buy that related to the microSD and FAT32 but what about the items I tried to recover from the Recycle Bin?  They had been deleted literally minutes earlier and again most said unrecoverable.  No way could they have been rewritten that quick.

[Augeas]

We need a few more details about that process, SSD, hdd, file system, file create time etc. You'd be surprised how many files are written 'that quick'. Recuva writes a dummy file to the system disk on startup, then there's prefetch entries etc.