Jump to content

Does not find file deleted on external HDD


bawldiggle

Recommended Posts

Trialing Recuva using portable version

 

Using portable Recuva v1.53.1087
External portable USB HDD | drive letter "F" | NTFS  |  Data only
capacity: 50 GB | used: 10.1 GB | Free: 39.8 GB

created a TXT file in F:\#1\folder_2\folder_3\folder_4\folder_5
File name: zz_test recuva_2017-02-08.txt
moved focus to another folder to ensure Windows  registered the new file
returned to the test folder and deleted the test file

Recuva portable
Drive F:
Filter:  zz*.txt
Scan Files...
------------
Recuva did not find the file but did find an obscure, 8 year old file "ZZSMW2P6.txt"
path of the "ZZSMW2P6.txt" has never existed  :blink:

Exported report from Recuva

 

------------------------------------------------------------------------------------------------------------------------
[F:] NTFS, 49.9 GB. Cluster size: 4096. File record size: 1024. Found 1 files.
------------------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------------------------------------------------------
Filename      Size  Path                                                          
------------------------------------------------------------------------------------------------------------------------
ZZSMW2P6.txt  356   F:\?\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\  

 

There is no "Users\Owner" folder on F:\ nor has there ever been
F: drive is data only and has never been anything else
( I know Users\Owner etc is in C:\ drive

What am I doing wrong, the C:\ ... F:\ drives mix up is very confusing. ?

-  the actual first folder on F: is F:\#1 ... I wonder if my first folder with hash in the name is part of the problem

 

I would appreciate any help , thank you :)
 

Link to comment
Share on other sites

  • Moderators

It depends on how the file was deleted. If it went to the recycler first then it would have been renamed to $Rnnnnn.txt. If a shift/del then sometimes deleted files can be overwritten, and this is most likely with recently created/deleted files (due to the way MFT entries are reused).

 

Your eight-year old file must have existed at some time on the drive. The ? in the path name signifies that there are additional level(s) in the path name that can't be reconstructed.

 

The # folder name is not significant, apart from being an unnecessary sidetrack to the problem.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.