recuva deep scan: damaged files

[woffi]

I used recuva on a friends pc, win8. She had accidentenly erased lots of files. First I used normal scan and recovered quite a few files perfectly. Some were still missing so I used deep scan for a second go.

 

Deep scan recovered many more files, but all deep scan recovered files are damaged and can not be opened ( for instance .pdf and .odt files). Strange enough even the same files recovered by normal scan in a perfect condition are "damaged" after recovery with deep scan.

 

The PC was not used in between the two scans, everything stored on external HD... Is there any secret how to open files recovered through deep scan?

 

Hoping for help!

 

woffi

[Nergal]

In all honesty, if they are damaged then they are unusable, deep scan shows more files but the majority of them will be damaged. There are some specialized programs to fix certain broken files.

[Augeas]

Recuva only reads the first extent of a file with deep scan (subsequent extents are not identifiable). So any file in extents will not be complete. A Recuva deep scan runs a normal scan first and does not return the files found with the normal scan during its deep scan phase.

 

Recuva returns whatever is in the clusters on the disk, bit by bit. It does not change or interpret any data.

[woffi]

Recuva only reads the first extent of a file with deep scan (subsequent extents are not identifiable). So any file in extents will not be complete. A Recuva deep scan runs a normal scan first and does not return the files found with the normal scan during its deep scan phase.

 

Recuva returns whatever is in the clusters on the disk, bit by bit. It does not change or interpret any data.

Thanks a lot Augeas!

 

That explains my deep scan and normal scan results. But is there any chance to identify the various extents of one file, lets say "example.odt", found by a deep scan and put the pieces together to one file again?

I suspect the extents are those numbered files without a proper name found by deep scan???

[Augeas]

The numbered files ([001234].odt for example) are first extents of a file found by a deep scan. The named files are found by reading the MFT and should return all extents of a file, unless those extents have subsequently been overwritten.

 

A deep scan can only identify the first extent of a file by reading the file header. Subsequent extents don't have a file header so cannot be identified as such and are not returned by a deep scan. Data recovery specialists may look for suitable blocks of unallocated data close to the first extent and attempt to patch the file together, but this is not a job for Recuva.