Recovery of large video files

[frank9999]

There is a statement in the Recuva user documentation in the Technical Information section under How Recuva works the says:  "If the file is fragmented on the drive, however, Recuva will not be able to piece it back together."  Is this true?  I mean, most large files are fragmented, so does this mean that Recuva only works for small files?  Is there another software product available that will recover large files?

[Augeas]

I think - without looking at the documentation - that this applies to a deep scan. A deep scan looks in each cluster for a recognisable file signature identifying the start of the file. If the file is fragmented then subsequent fragments, which may be anywhere on the drive, will have no file signature and can't be recognised as either being of the same file type or belonging to any particular file. So it is very difficult to piece these fragments together, whatever software you're using. You could search for unrecognised fragments close to the first fragment and then try to patch them together and see what happens, but this is a job, an expensive job, for data recovery specialists. In the case of FAT some software will, when reaching the end of the first fragment, skip over whatever is in the way and continue with the recovery, but this is not really successful and this method can't be applied to NTFS, where the distribution of data clusters is different.

 

If your files are larger than 4gb then NTFS will zero the data cluster addresses on file deletion, so a normal scan will not be able to locate the file data, and you will have to try a deep scan. Unfortunately NTFS and FAT were not designed to make file recovery easy.

[frank9999]

I have tried a deep scan and the list view shows the files with a green circle (indicating recoverable) but when I try to recover these files the recovery is unsuccessful.  Am I doing something wrong?

[Augeas]

No. All files found by a deep scan (those with a number and file extension) will be classed as excellent. This means that no live file has overwritten them. It does not mean that the contents of the clusters are valid, nor that the file is complete. All it means is that a cluster with that particular file signature has been found. The following clusters until the next cluster with a valid file signature is found will be assumed to be the rest of the file.