Jump to content
CCleaner Community Forums

Recuva can't find WIndowsImageBackup file


djtorchmusic

Recommended Posts

This is strange. Before moving forward with Recuva I tried another product to see if it was possible to recover this file which is located on the root of an external hard drive. The other product did using just it's initial scan. With this in mind I thought Recuva could do the same thing. First of all, it didn't find anything in it's initial scan and then after a deep scan I still could not find this file. Recuva did find other stuff but not what I needed. If there is some special process I'm missing, please help! 

Link to comment
Share on other sites

  • Moderators

Recuva normal scan will list all deleted files for which a record exists in the MFT, no matter what their name or extension is, or whether they have an extension at all. Deep scan will scan for a specific list of extensions. It will not find files with an unknown, or no extension.

If a normal scan can't find the file then the record in the MFT is most likely not available any more - reused or overwritten. If a deep scan can't find the file then it probably has an unknown or no extension.

If it's a very large file (and I would guess it is) then it won't be easy to recover even if it is found.

Link to comment
Share on other sites

Why do you think the other program could find it in a normal scan? It's a huge file as you assumed. I was hoping there was some way to simply reverse what was done to the drive. The partition was deleted and then the drive was formatted. Below I have an image which shows how the other program was able to locate the backup, no problem. 

WindowsImageBackup.JPG

Link to comment
Share on other sites

  • Moderators

That's a folder not a file. Perhaps you haven't checked Show Files in Hidden System Directories. To reverse a partition delete and format you need a time machine. I don't know what the other sw does (or even what Recuva does), but the file names and path are all held in the MFT. I guess after a format that you're looking at the remnants of the old MFT that weren't overwritten.

I should display the results as a List and sort on folder name (after doing the check and rescan as above).

Link to comment
Share on other sites

  • Moderators

That's a different drive, or at least in a different state. The first screenshot doesn't look as if a file system has been found. I'm not really sure what you are doing.

Link to comment
Share on other sites

  • Moderators
5 hours ago, djtorchmusic said:

. I'm still waiting to hear from CCleaner support. Not a peep yet. 

Did you contact them via the pro user priority support or just post it here.  If the latter then follow the link in my signature below this post.

 

ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION

DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF.

Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark)

ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T.

CCLEANER, RECUVA, DEFRAGGLER AND SPECCY DOCUMENTATION CAN BE FOUND AT  https://support.piriform.com/hc/en-us and  https://www.ccleaner.com/docs

Pro users file a PRIORITY SUPPORT request at https://support.piriform.com/hc/en-us/requests/new

link to WINAPP2.INI explanation

Link to comment
Share on other sites

On 21/08/2019 at 16:29, Augeas said:

That's a different drive, or at least in a different state. The first screenshot doesn't look as if a file system has been found. I'm not really sure what you are doing.

Same drive. It inherited a different drive letter when I reconnected it. 

Link to comment
Share on other sites

  • Moderators

The first image shows no file system, the second shows NTFS. The odds of recovering a huge file after a partition and format are about the same as England winning a test match.

Link to comment
Share on other sites

On 26/08/2019 at 12:55, Augeas said:

The first image shows no file system, the second shows NTFS. The odds of recovering a huge file after a partition and format are about the same as England winning a test match.

Well, it seems like the other product didn't have an issue locating the file. I never tried to restore the file but I just thought Recuva would as good or better at this.

Link to comment
Share on other sites

  • Moderators

It appears to have located a folder. Recuva doesn't list folders explicitly, but lists files and then builds up the folder structure (if required and requested) in a chain-back process. Deleted folders, as far as I can establish, are cleared of their list of files by NTFS, so finding a deleted folder is of little use, it's just a name. You are of course free to use whatever software you want to aid any file recovery.

Link to comment
Share on other sites

44 minutes ago, Augeas said:

It appears to have located a folder. Recuva doesn't list folders explicitly, but lists files and then builds up the folder structure (if required and requested) in a chain-back process. Deleted folders, as far as I can establish, are cleared of their list of files by NTFS, so finding a deleted folder is of little use, it's just a name. You are of course free to use whatever software you want to aid any file recovery.

What do you mean "chain-back process"? Will I be able to restore this file with Recuva?

Link to comment
Share on other sites

  • Moderators

The MFT record for a folder contains the addresses of the MFT records of all the files in the folder. The MFT record for a file contains the address of the owning folder. When a folder is deleted NTFS removes the addresses of the files. Recuva reads the folder address in a file's MFT record to locate the owning folder, chaining back all the way to the root (if the chain is still extant).

If a ? is shown as a folder it means that the backwards chain to the root cannot be completed, probably because the MFT record for that folder has been overwritten.

Nobody knows whether you can recover 'this file' with Recuva or any software, we don't even know its name. Judging by what's been done to the drive I would doubt it, as I've said twice before.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.