All Local Disks. Populated with failed System Image Failure Shadow copies..

[rodalsa1]

I understand that Recuva returns data even when the user stops an ongoing scan and the data may be of use to the user.  This may also be true for Recuva's Failed scans (I had not seen evidence of this until yesterday).  But what if the user is not interested in one or none of the terminated scans as I suspect most user are.

 

I have noted that after several system image creations (Failed & terminated & a final one ... successful) the list of "All Local Disks" Shadow copies has been increased in size. See attachment. The left frame is the earliest. I attributed the increase in size to four of the Shadow copy files that I remembered as being either terminations or failures.  I achieved the success by emptying the Trashbox.

 

Can the "All Local Disks" list be color coded to specify successful Shadow copies from Failures from terminated by users or by a column with S,F,T in the proper rows?  Or is there something that I via assumption am missing here?

 

[Nergal]

Do you have recuva pro? If not what makes these shadow copies? Are there any "failed" in your screenshot, if not what exactly are these failures, I'm not understanding.

[rodalsa1]

I have Recuva free V. 1.53.1089 (64-bit).

All shadow copies were created using Windows 7 Pro via Backup and Restore / Create a system image.

The "failures" precise causes I cannot specify.  In my composite screenshot (see updated attachment below) the left pane's three entries under "All shadow copies" were present before my attempts to produce the "Shadow copy of drive (C:) 3/7/2017 15:17" seen in the right pane.  Between the 3/6/2017 13:34 shadow copy in the right pane and the 3/7/2017 15:17 shadow copy you will find the four "failures" that I am referencing here.  There are two groups separated by minutes within the four shadow copies shown.  The time difference between the first and last shadow copies in each of the two groups indicate that the first shadow copy in the group is not a full shadow copy.  It was either a error flagged by Recuva or me terminating the scan.  Memory fails at 81 years of age.  The second shadow copy of each group (by memory again) was a short scan.  Only the second group's shadow copy produced an observed error message.

 

I recall "red bar" failures twice.  I believe the other two short duration Recuva runs were due to me terminating the scans.  One of the "red bar" failures was discovered when I returned to my monitor some hours later. I expected the scan to exceed one hour as had been typical. No error messages were noted at that time as I remember it.  The other "red bar" incident produced an error message telling me that there was not enough space for the shadow copy to be created.  That particular error message clued me into the need to dump the trashbox.  After that dump I ran the last scan seen in the right pane to a successful finish.

[rodalsa1]

I'll add to the details above.  I began a "fresh" start.  I went to my network drive's folder in which Microsoft's Backup and Restore was told to place its backups.  I deleted all of the folders there that contained data files.  All I had left were folders.  I deleted the "Trashbox".  I then made a Windows backup (user data and shadow copy) of my C: drive (the only one).  I ran Recuva again and opened the "All Local Disks" drop down box.  It contained the same three Shadow copy files seen in the left side of my attachments above plus the backup that I just completed.  I have no idea where these three Shadow copy file originated.

 

I want to somehow have Recuva report to me only the Shadow copies that exists in my specified backup location or allow me to locate all Recuva's reported Shadow copies' paths as well as the status of those copies either "Failed" or "Terminated" as appropriate.  Knowing were the files reside should allow me to go there and delete as desired and get on with my day.

 

One "assumes" that since Recuva can find these drop down listed files, some program created them.  I have used over time several backup programs in evaluation mode.  I went back to each of them that I can recall and still have access to and made an attempt to delete any output they may have deposited on my drives.  Remaining here are "those" that may have been installed and removed and their residue.

[Augeas]

I must admit that I am struggling to grasp what is happening, and what is wanted, here. You seem to be somehow confusing Window's shadow copies with Recuva scans. Your first post is especially confusing, what's the connection between the first and second paragraph? A terminated Recuva scan is not a failed shadow copy.

 

And in post 3, 'The time difference between the first and last shadow copies in each of the two groups indicate that the first shadow copy in the group is not a full shadow copy.  It was either a error flagged by Recuva or me terminating the scan.' How is a Recuva cancelled scan affecting a Windows system operation?

 

If - in the end - you want Recuva to indicate whether the system shadow copies are good or bad then (whilst that might theoretically be possible) I think that the chances of that are slimmer than Alonso becoming F1 world champion.

 

You don't have to delete the failed copies, just let them cycle round. If you want to rerun those that have failed then that is another matter.

[rodalsa1]

I have had Recuva flag a scan as Failed.  I have terminated Recuva Scans.  I have had successful Recuva Scans.  I have shown all three types of Recuva scans listed in the "All local disks" drop down box as shadow copies.

 

All I wanted to do was to either know which shadow copies were associated with which class of file (Failed, Terminated or Successful) without having to do the interpretations I have discussed.  This would allow me to avoid scanning any files that were not successful.

 

In the process of trying to find a way to that goal, I managed to delete the Failed & Terminated & Successful files that I created in the past several days.  That left three unknowns that I did not want to look at again.  I wanted to delete them.  They were outdated and were not going away by any technique that I knew how to use.  Thus my query.

 

I remembered reading... (another copy from OneNote)

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

I ran across this while searching the online help…

Secure overwrite does not affect file names, which continue to exist in the MFT (Master File Table). In order to overwrite names of deleted files, please use the Wipe MFT Free Space option in CCleaner.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

This led me to try CCleaner Free --- Just in case there was some help there.

 

 

Now!  I have found a solution to my problem.  CCleaner's / Tools / System Restore listed four files that looked like Recuva's list of four files.  My latest Windows Backup and Restore shadow copy was an exact match Recuva drop down to CCleaner list.  The other three were not..  Here is a copy of the table I generated in OneNote making the comparison...

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

These four "System Restore" points look eerily familiar.  I will make a table to compare their dates and times…

INDEX

CCleaner Date & TIme

CCleaner Description

Recuva Date & Time

Time Difference

1

3/12/2017 12:52:33 PM

Windows Backup

3/12/2017 12:52

-00:00:33

2

3/10/2017   7:11:31 AM

Installed Rapport

3/10/2017  08:12

+01:00:29

3

3/7/2017     3:17:21 PM

Windows Backup

3/7/2017    16:17

+00:59:39

4

3/7/2017     9:05:57 AM

Windows Backup

3/7/2017    10:06

+01:00:03

 

 Table 29g

New information is in CCleaner's Description column.

I know that Index 1 is the last backup that I made.

I recall that I made a special backup when Rapport was installed.

Indexes 3 & 4 are unknown to me.

Indexes 2, 3 & 4's Time differences [(Recuva Date & Time) - (CCleaner Date & Time)] are seconds apart around 1 hour.  Compared to Index 1's time difference of 33 seconds, I cannot explain why the difference of one hour would exist.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

What did I have to lose!  I removed the oldest item from the CCleaner list.  I checked Recuva's drop down list. The Index 4's file was gone.  I repeated this with Index 2 & 3 as a group.  Now the only shadow copy Recuva lists is the one that I made yesterday.

 

Even though I had to install CCleaner (I've gotten into trouble with this program before) I have achieved what all my palaver has been about.

 

Thanks for pushing me onward.

 

Now:  How about the time differences between Recuva and CCleaner's listings of the same files?

 

You never know what you are going to find in the dark recesses of computing system!

[rodalsa1]

Sorry.  The posting process wiped out the table structure.  I'll work on getting a JPG of it and post it later.  If there is a faster way let me know.

[rodalsa1]

Here is the JPG of the table...