bawldiggle Posted February 8, 2017 Share Posted February 8, 2017 Trialing Recuva using portable version Using portable Recuva v1.53.1087External portable USB HDD | drive letter "F" | NTFS | Data onlycapacity: 50 GB | used: 10.1 GB | Free: 39.8 GBcreated a TXT file in F:\#1\folder_2\folder_3\folder_4\folder_5File name: zz_test recuva_2017-02-08.txtmoved focus to another folder to ensure Windows registered the new filereturned to the test folder and deleted the test fileRecuva portableDrive F:Filter: zz*.txtScan Files...------------Recuva did not find the file but did find an obscure, 8 year old file "ZZSMW2P6.txt"path of the "ZZSMW2P6.txt" has never existed Exported report from Recuva ------------------------------------------------------------------------------------------------------------------------[F:] NTFS, 49.9 GB. Cluster size: 4096. File record size: 1024. Found 1 files.------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------Filename Size Path ------------------------------------------------------------------------------------------------------------------------ZZSMW2P6.txt 356 F:\?\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\ There is no "Users\Owner" folder on F:\ nor has there ever beenF: drive is data only and has never been anything else( I know Users\Owner etc is in C:\ driveWhat am I doing wrong, the C:\ ... F:\ drives mix up is very confusing. ? - the actual first folder on F: is F:\#1 ... I wonder if my first folder with hash in the name is part of the problem I would appreciate any help , thank you Link to comment Share on other sites More sharing options...
Moderators Augeas Posted February 8, 2017 Moderators Share Posted February 8, 2017 It depends on how the file was deleted. If it went to the recycler first then it would have been renamed to $Rnnnnn.txt. If a shift/del then sometimes deleted files can be overwritten, and this is most likely with recently created/deleted files (due to the way MFT entries are reused). Your eight-year old file must have existed at some time on the drive. The ? in the path name signifies that there are additional level(s) in the path name that can't be reconstructed. The # folder name is not significant, apart from being an unnecessary sidetrack to the problem. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now