Files are messed up, even though Recuva claims no overwritten clusters

[krs000a]

Hello,

 

Extremely frustrated here, for a number of reasons. It all started a couple days ago, when I plugged my Western Digital external USB hdd in, only to find out there were 0 files on it (3 Tb worth of files - nice). I have no idea how that happened, I have been very careful with it. Anyway, I ran Recuva on it, and most of the files were found, now on to my questions:

 

1. Although Recuva claims a lot of the files conditions are "Excellent" and "no overwritten clusters detected", why are there so many files which are partly over-written? Let me elaborate, this harddrive was working great just a couple days ago, and after it failed on me, I did not do ANYTHING to it. Did not write even 1 byte of data to it, so how can these files be partly overwritten? I don't understand the logic. It just was not working one morning, and I immediately ran Recuva on it. How is partly overwriting even possible when no data has been written to the disc? And so many files, as well, we're not talking just a few, more than half of the files are in "very poor" condition or completely unrecoverable!

 

2. Another thing that bugs me is, the files that in fact are listed as "Excellent" condition, and no overwritten clusters, I don't fully trust that. The reason is because several of the pictures which were successfully recovered by Recuva, have one filename and then the picture itself is of something completely different. For example, if I named a picture "John's birthday 2017.jpg" then it might show "Lucy's wedding 2007" instead. What I mean is, the picture which I named "John's birthday 2017.jpg" and originally pictured just that, instead shows the image of something else I also had in my collection. Those were just two made up examples, but you get my point. Why is that happening? I know each respective image was named correctly prior to all files mysteriously being gone. And if these images are recovered incorrectly, with the filename saying one thing, how can I trust the rest of my files were in fact recovered in their original condition? Pictures are easily verified, but what about other files such as ISO files, how do I know that these are not messed up somehow too? Apparently, what Recuva says cannot be trusted.

 

I would like some answers please.

[Augeas]

1) Recuva principally looks at deleted files. The data for these can be overwritten in part or whole by newer file allocation. It is normal for a proprtion of deleted files to be overwritten.

 

2) Excellent condition simply means that the file has no overwritten clusters. It does not offer any indication of the cluster contents. Recuva will recover (copy) what is in those clusters which may or may not be a valid file.

 

What is your file system? Did you run a normal or deep scan? Did you have Scan for Non-Deleted Files checked?

[bill65]

Yes, exactly the same here.

 

Win 7 pro.

Disk is NTFS.

 

Files were not in the rubbish bin IE not 'deleted'.

The FAT was overwritten by quick formatting the drive.

There was nothing written to the disk after the quick format.

 

Consequently, the 'scan for non deleted files' is empty.

 

Then Deep Scan was used. ('scan for non deleted files' is un-checked)

Files are listed:

- all files have "no overwritten clusters dtected"

- State is 'unknown' for all files

- Last Modified and Size seem to be correct

 

But only garbage is "recovered". Even a simple notepad file is just garbage.

 

When 'recovering' a single file the popup says:

Total recovered 1 file(s):

Fully recovered 0 file(s)

Partly recovered 1 file(s).

 

Cheers,

Bill

 

[Mos Eisley]

It's possible that some files were heavily fragmented and for whatever reason recuva couldn't quite put the right pieces together.

I'm just theorizing on this next point on how Recuva might work, but one of many possible methods of data recovery is to locate and identify a table of contents (addresses of files on a disk) which might be "current," or might be an old version (from before some files were moved or otherwise rewritten), or might be partially corrupt, and then use this table to locate files.

As a simplified example, a file might have an address of 12345, which in binary is 11000000111001.  Through some random corruption, perhaps a hardware error or exposure to a magnetic fields, one random bit got changed; perhaps the first 1 changed to a 0, resulting in 01000000111001, which is 4153 in decimal.  A recovery program might read this incorrect address of 4153 and then look in completely the wrong area of the disk for the file's data.

I had a 2TB drive recovered (using some other software), and I would guess that 5-10% of the recovered files contained the wrong data.  I was even able to recognize the some of the incorrect contents, e.g. one recovered image file contained a chunk of text that come from web pages, so it wasn't just random binary garbage (although image data replaced with text does amount to garbage output).

[krs000a]

1) Recuva principally looks at deleted files. The data for these can be overwritten in part or whole by newer file allocation. It is normal for a proprtion of deleted files to be overwritten.

 

2) Excellent condition simply means that the file has no overwritten clusters. It does not offer any indication of the cluster contents. Recuva will recover (copy) what is in those clusters which may or may not be a valid file.

 

What is your file system? Did you run a normal or deep scan? Did you have Scan for Non-Deleted Files checked?

 

I still don't understand how those files could be partially overwritten, when I have not added any data to the disc after all files had been wiped from it. My filesystem is NTFS and I used deep scan. I don't know if I had the "Non-Deleted Files" checked, but I have now disposed of that harddrive and moved on. I will not be using Western Digital's drives again, way too many issues with them. I also won't be using Recuva next time I lose any files, as it never seems to be able to recover anything usable anyway.

[bill65]

Thanks for the replies.

 

"It's possible that some files were heavily fragmented and for whatever reason recuva couldn't quite put the right pieces together."

I'm sure it does happen. Not in my case though.

I was 'digitizing' hours-n-hours of videos to a brand new drive.

Nothing ever have been deleted that could possibly create fragmantation.

Absolutely nice sequential writes.

As I was using Premiere to do that, new project files may be written in-between the video-files. But not while 'digitizing'.

As it is a 32bits OS, filesize is limited to 4GB. Since the tapes are some 2-3hrs long, there should be several 4GB files written in a sequence.

No reason for recovery error due to fragmentation.

 

I tried other softwares.

While the 'recovered' files are mostly corrupted, the first 0.5 to 2 seconds of every file play in Windows Mediaplayer.

So far I haven't got the faintest clue what to make of this.

[Augeas]

Bill, if your disk is NTFS then you will have a MFT, not a FAT. Also filesize in NTFS is not limited to 4GB, but it is in FAT32. So what is the file system on your disk?

 

Files do get fragmented. A few years ago I loaded an 800mb ISO file to a NTFS disk with some 150+ gb spare space. It ended up in 4000 fragments. I've no idea how NTFS allocates space but on a used disk it can be chaotic.

 

Files found with a deep scan will always have no overwritten clusters. I don't know what the state of unknown is, it should be excellent. Deep scan will only find the first extent of a file, as subsequent extents are unable to be identified by any software. Or most software, anyway. This could explain why you get a few seconds of play. Deep scan won't find text files as they have no file signature.

 

If your disk is FAT32 then other factors come into play, making file recovery very difficult.

 

Unfortunately data recovery is not quite as simple as it may at first appear.