janareed Posted March 21, 2020 Share Posted March 21, 2020 Recovered about 40GB of data from C Drive's deleted 'desktop' folder from c:\user\userid\desktop after its content, not the folder, all been perm deleted. Recuva seemed to be working very well until trying to view any of the recovered O365 office docs. All corrupt, won't open or repair. Lots of text files and SQL queries recovered okay. The C drive is NTFS and not encrypted. Anything else to check on the source drive? Bitlocker is installed but off. Symantec is installed and running. Since all the docx. xlsx recovered files were consistently invalid content, rather than a few corrupt seems odd. Data was deleted day prior to running RECUVA from a 500GB C drive with about 100GB used. Expected at least some Office O365 word and excel files to recover successfully. ? Thanks. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted March 21, 2020 Moderators Share Posted March 21, 2020 Is the c drive an SSD? How were the files deleted, recycler or shift/del? What is in the header on the Info pane in Recuva? How large are the bad files? Link to comment Share on other sites More sharing options...
janareed Posted March 21, 2020 Author Share Posted March 21, 2020 Yes, drive is a LITEON CV8 8E512 SATA disk / Solid State; Delete did not go thru recycle bin; Data loss oddly seemed to happen after a robocopy with just the copy:DAT option that locked up (command was start /wait robocopy /E /R:1 /W:5 /copy:DAT "%UserProfile%\Desktop" "userprofile%\OneDrive\Desktop") The header's varied on the docx files, some just zero and others random data. Some examples attached. Retried a few that are all small files, < 200kb Seems what is recovered is not getting the full docx file. Also, if I scan with the filter for office documents it finds nothing at all, zero files, but if I scan without the .docx filter, it does return lots of docx files with the green/excellent scan result, but all give the 'word found unreadable content' message when opening the recovered doc. Seems that recovered is not all the 'parts' of the zip for a word doc. Again, since it's global rather than a few stepped on files. I do have to start the program with a right click and 'run as administrator' or recuva is blocked from running. Questions: Does recuva need to be running with real full admin? I can do that, but only after a request to get it temp for few days (work computer). Will recuva always fail to pull office documents if drive is encrypted? (I know I said the drive was not encrypted, bitlocker is off so it should be, but I am double checking that next week). Thanks for your time and advice. HeadersAndResults.pdf Link to comment Share on other sites More sharing options...
Moderators Augeas Posted March 21, 2020 Moderators Share Posted March 21, 2020 If you have an SSD with TRIM enabled on both the device and the O/S - which I assume you have - then file recovery is with a few exceptions impossible. The TRIM'd data has gone forever and nothing that Recuva or anything else can do can retrieve it. Small files (under 700 bytes) will lbe stored in the MFT so they will be recoverable. Link to comment Share on other sites More sharing options...
janareed Posted March 22, 2020 Author Share Posted March 22, 2020 Makes sense. I will check into that. At least the SQL queries were recovered. In addition to being plain text they are same so gues that is why they worked thanks for the help Link to comment Share on other sites More sharing options...
janareed Posted March 22, 2020 Author Share Posted March 22, 2020 Typo - SQL queries that recovered okay are ‘small’ and probably in mft and thus worked Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now