Files discovered on USB stick all start with an underscore

[DanWoods]

So someone removed a USB stick before the end of a data transfer, but AFTER Windows reported that the data had been written.  They then went on to completely overwrite the disk, but I want to know how much data was written and why the files disappeared.

 

Obviously, it might be a Windows write caching thing, but everything suggests it was not active at the time.

 

So I ran a Deep Scan using Recuva and ~8GB was found in 7200 files (1,189MB each), which correlates well with what was supposed to have been written.  The files all had the right modification dates and the file names all fit the right pattern EXCEPT they all had an underscore added to the beginning of the file name.  The files were marked irrecoverable, except one (which is suspicious in itself).

 

Does anyone know if this underscore is actually added in the filenames (by Windows...?), or has been added by Recuva to indicate an incomplete filename or something else?

[Augeas]

The file system (FAT32, I assume) changes the first char of the file name to 0xE5 on file deletion. This is not an allowable file name character so Explorer displays it as an underscore.